S12X Patch Diffing with QBinDiff

arXiv:2608.05350 · cs.CR · Submitted 2026-08-05 · Read on arXiv

Ben Gardiner

NMFTA Inc

cs.CR

Submitted: 2026-08-05

Comments: Preprint of paper to be presented at VehicleSec 2026. This version includes appendices beyond the page limits of the conference

Code: https://github.com/hotwolf/HSW12

License: http://creativecommons.org/licenses/by/4.0/

The gist: This paper presents a reverse engineering analysis of a firmware update for a commercial vehicle Brake ECU.

Terminology

• Steering — 8× in this paper · explained in 2 episodes
• Papers — 2× in this paper · explained in 3 episodes
• Remote Code Execution — 2× in this paper
• ABS Denial of Service — 1× in this paper
• Actor — 1× in this paper · explained in 3 episodes
• Automatic Traction Control — 1× in this paper
• Automotive Safety Integrity Level — 1× in this paper
• Calibration — 1× in this paper · explained in 9 episodes
• Cooperation — 1× in this paper · explained in 2 episodes
• Core — 1× in this paper · explained in 2 episodes
• Electronic Stability Program — 1× in this paper
• Enhanced Capture Timer — 1× in this paper
• Fidelity — 1× in this paper · explained in 2 episodes
• Hysteresis — 1× in this paper · explained in 3 episodes
• J1587 Transport Protocol — 1× in this paper
• Power Line Carrier — 1× in this paper
• Programmable Interrupt Timer — 1× in this paper
• SCI2 Data Register Low — 1× in this paper
• Software Defined Radio — 1× in this paper
• Trace — 1× in this paper · explained in 2 episodes

Abstract

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Estimating the Social Cost of Corporate Data Breaches
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills