Teardowns on Colin O'Flynn

Teardown Archive

Wed, 15 Jul 2026 00:00:00 +0000

PLACEHOLDER — an index of the teardown posts, pulled together in one place.

Apple AirTag Teardown & Test Point Mapping

Sat, 08 May 2021 18:24:32 +0000

What’s inside of Apple’s new AirTag? There was already an iFixIt teardown (which I swear was missing a few items that are there now), but of course was curious to see what sort of protection was enabled. Notably the nRF chip used is likely vulnerable to a known bypass of security as well. With that in mind, I set out to see how we could dump some data from this thing - the good news is you can access a lot of interesting stuff (including the SPI flash) right from the backside, which requires you to simply pop the first plastic cover off. This is super-easy to do without damaging anything. Going further than that is tricky to keep it all intact.

Analog Discover Pro Teardown

Sat, 17 Apr 2021 16:14:13 +0000

NOTE: This was going to be a twitter thread but twitter was down? So this is a lazy blog post…

Analog Discovery Pro (from Digilent Website)

Anyone used to Digilent would expect this to be based on Zynq or similar - the fact the device has USB + ethernet ports makes it a pretty much sure thing! Taking the screws off the bottom gives us this view:

Square Terminal Teardown

Mon, 06 Apr 2020 13:30:57 +0000

Part-way through the Square Terminal Teardown

I recently tore down a square terminal (the one with the LCD screen) and wanted to share some of these results. I haven’t photographed everything as was mostly interested in how the secure areas of it are down. You can see an overview in the following video if you want to see how the whole thing fits together.

https://www.youtube.com/watch?v=pB8T5wZJLcM

Teardown of Square Terminal Video

Amazon Echo Dot Gen 3 - Microphone Disable Circuitry

Sat, 18 Jan 2020 17:36:11 +0000

Have you been interested in the Echo Dot device? One feature they mention is that there is a microphone off button. I spent a few hours reverse engineering this, and recorded (in un-edited glory) the process:

https://youtu.be/xH8LnK9hh6w

The resulting schematic is shown below:

The astute reader will note the only pin under direct control allows the disabling of the microphone, it cannot re-enable it. However - there is one more loophole to check.

Philips Hue - R.E. Whitepaper from Black Hat 2016

Thu, 04 Aug 2016 14:37:33 +0000

At Black Hat 2016 I presented on some reverse engineering of the Philips Hue (also see my other post about getting root on it, which was part of that presentation).

If you were at the talk, you would have also seen mention that you'll want to keep your eyes out for future publications by Eyal Ronen. You can see his website for more research related to the Hue as well, and follow him on twitter @eyalr0. He's been doing some work in parallel that I think will do more than just R.E. the bulbs (as I did), and actually bring some of my `possible' attacks to become real proof-of-concepts.