DEF CON 33 - Reverse Engineering Marine Engines: Make powerboats do your bidding - Alex Lorman

Optimized Summary (Revised Based on Feedback):

The video presents a practical, accessible approach to enabling autonomy in marine vessels—specifically power boats—by avoiding complex reverse engineering of proprietary communication protocols and instead intervening at the user input level. Rather than decoding encrypted or non-standard CAN bus messages, the presenter demonstrates that autonomous control can be achieved by emulating human-like user inputs, such as throttle and steering commands, using simple voltage signals.

Key Insights & Takeaways:

• Market Dominance & Legal Barriers:
  Major outboard manufacturers—Mercury, Yamaha, Honda, and Suzuki—dominate the market and actively restrict access to their systems due to legal liability concerns, especially around warranty claims and safety. Mercury, in particular, has been known to send formal warnings against such work.

• Legacy vs. Modern Systems:
  While modern engines use advanced digital control systems (e.g., CAN buses, ECUs), many still support legacy cable-driven controls (e.g., push-pull cables for throttle and shift). These systems are more accessible to reverse engineering because they rely on analog voltage signals rather than encrypted or proprietary digital protocols.

• Hacking via Voltage Emulation:
  The core technique involves reading and replicating voltage outputs from Hall effect sensors in throttle controls. For example:

  • Yamaha’s CDU (2022) uses two Hall effect sensors that output voltages between 0.15V and 1.4V.
  • By measuring these ranges and replicating them with simple DACs or digipots, a system can emulate a human operator’s input.
  • This method is feasible, reliable, and requires minimal hardware (e.g., $3 components like PWM-to-voltage converters).

• Mercury DTS Architecture (User Space as Intervention Point):
  Mercury’s DTS system uses three abstraction layers:

  1. Engine Space