BEGIN:VCALENDAR VERSION:2.0 PRODID:Data::ICal 0.24 BEGIN:VEVENT DESCRIPTION: 'Title: Breaking the Ethereum Phone: From BootROM to Wallet Signing\n Keys\n Tags: DEF CON Official Talk | Demo 💻 | Exploit 🪠²\n When: Friday\, Aug 7\, 10:00 - 10:30 PDT\n Where: LVCCW Level 1 Ha ll 3 1007 (Main Track 2) and DCTV-2 - [1]Map\n\n Description:\n\n Cryp to phones promise the convenience of a mobile OS with\n hardware-backed key management. We tested that claim on dGEN1\, the\n Ethereum phone mar keted for digital-asset custody\, and present a full\n compromise from b ootrom to wallet key recovery.\n\n Starting from a bootrom-level misconf iguration\, we reverse the modern\n MediaTek bootchain and introduce a L oader-of-the-Loader technique for\n patching later boot stages entirely in memory\, yielding EL3 code\n execution without modifying physical fla sh. From that foothold\, we\n trace how boot-level compromise propagates into the device’s\n lock-screen verification path\, enabling offline brute-forcing of the\n user PIN and recovery of the wallet’s primary E RC-4337 signing key.\n We further show that a separate identity flaw in the asset-claim\n workflow allows pre-activation theft using identifiers printed on a\n sealed retail box.\n\n SpeakerBio: Guanxing Wen\n\n Guanxing Wen is a security researcher with over a decade of experience\n exploiting bootloaders\, TEEs\, kernels\, and IoT systems. He is a top\n winner of Huawei bug bounty (2021/2022) and is listed in the Ledger\n Hall of Fame. His research has been presented at Black Hat\, MOSEC\,\n INFILTRATE\, Summercon\, and QPSS. He currently works at CertiK\, where\n he focuses on low-level systems exploitation and blockchain\n infrastr ucture.\n\n '\n\n 1. #LVCCW_Level1_Hall3\n\n\n DTEND:20260807T173000Z DTSTART:20260807T170000Z LOCATION:DEF CON Talks - LVCCW Level 1 Hall 3 1007 (Main Track 2) and DCTV- 2 SUMMARY:Breaking the Ethereum Phone: From BootROM to Wallet Signing Keys END:VEVENT END:VCALENDAR