Reverse Engineering SpaceX
SpaceX Is Now Public. Here's What Reverse Engineering Starlink Actually Revealed. SpaceX raised about $75 billion in a record IPO , and closed its first trading day at $160.95 on 12 June. The stock story is well covered. This piece is about the dish on a roof, which security researchers and radio engineers have been dissecting for years, and what they learned. A note on scope: I'm covering…
SpaceX completed an IPO raising approximately $75 billion and debuted at $160.95 on June 12. Researchers have been studying Starlink's dish since its launch, with security researchers and radio engineers examining the hardware. A primary focus of this examination is discovering potential vulnerabilities and attack vectors.
A group of researchers from KU Leuven discovered a custom quad-core Cortex-A53 SoC with verified boot, which includes custom fault injection countermeasures. The boot process was found to be secured, with a locked-down boot path and a disabled development login. Voltage fault injection bypassed the security measures, allowing arbitrary code execution from the second boot stage onwards. The researchers argued that the root of trust is in the ROM, and thus it cannot be fixed on the shipped units.
Quarkslab, another research group, later analyzed the Starlink device and reported on the organization of its flash memory. Almost every partition in the device appears twice (A/B), allowing updates to never overwrite the known-good copy. The integrity of the device's files is ensured through custom ECC, which uses Reed-Solomon coding and an MD5 over the whole file.
SpaceX uses a separate signed FIT image, which the final bootloader checks for a signature. The writable partitions are encrypted with LUKS, offering an additional layer of security.
The runtime startup is managed by SpaceX's own sxruntime_start, which is driven by a custom config format. It sets per-process conditions, users, AppArmor profiles, and CPU priorities. The user-facing process, user_terminal_frontend, is written in Go and is responsible for handling network connections. The internal bus of the device is connected via the Slate Sharing protocol, which runs over UDP on the loopback interface.
This protocol supports process communication through a central control process and a gRPC server on the LAN. SpaceX's gRPC server is exposed at 192.168.100.1:9200 and supports server reflection, allowing clients to discover its capabilities. The service is authenticated via mutual TLS, while the mobile app and web UI use an insecure channel to connect.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
