{"code":"UDUZHL","speakers":[{"code":"8UZ3UP","name":"Gerhard Hechenberger","biography":"Gerhard is a Principal Security Consultant at SEC Consult who specializes in embedded systems and critical infrastructure. He works in the SEC Consult Hardware Laboratory in Vienna. His main job is executing security assessments of embedded systems, IoT/OT devices and OT networks to uncover configuration issues and zero-day vulnerabilities. He is a holder of several IT security certificates, speaker at local conferences, and has published numerous security advisories and blog posts.","avatar":"http://cfp.bsidesvienna.at/media/avatars/2022_white_far_zhrBvMS.jpg"}],"title":"Windows CE Memory Archaeology - Recovering Files from Windows CE 5.0 on NXP i.MX28 NAND Flash","submission_type":{"en":"Medium Talk"},"track":{"en":"Mittlerer Saal (Track 1 - 260 pax)"},"state":"confirmed","abstract":"This talk tells the story how a “let’s quickly look at the files” span to a multi-day journey into ancient Windows CE filesystems and NXP processor NAND flash handling in an embedded system. Expect a deeply technical talk that explains how handling single bits make a difference and lets you peek into the complexity below (embedded) operating systems.","description":"One of the first steps in embedded systems vulnerability research is to access the firmware, obtained from firmware updates or from a physical device. How hard can it be? Usually not that much. But in this case, after failing miserably using the quick and easy standard approach, we doubled down and layer by layer uncovered how files are stored by Windows CE 5.0 on devices using the NXP i.MX28 processor. The single topics are nothing new, but due to the age and targeting (mobile phones and PDAs) of most Windows CE tooling and hardware specifics, ready-to-use tools failed repeatedly. Starting with no clue about Windows CE internals, our approach was to leverage a combination of ancient technology (Windows XP) and modern technology (AI) to understand what we are dealing with and to adapt and build our customized tooling.","duration":55,"slot_count":1,"do_not_record":false,"is_featured":false,"content_locale":"en","slot":{"room":{"en":"Mittlerer Saal (Track 1)"},"start":"2026-06-27T16:10:00+02:00","end":"2026-06-27T17:05:00+02:00"},"image":null,"resources":[{"resource":"/media/bsidesvienna-0x7ea/submissions/UDUZHL/resources/Windows_CE_Memory_Archaeology_BSides_Vie_cQmojwP.pdf","description":"Slides"}]}