Depthcharge: U-Boot Exploit Tool

This post introduces Depthcharge, a Python toolkit for analyzing customized U-Boot bootloaders, and demonstrates its use in a real-world secure-boot bypass against Sonos Symfonisk devices (Royale Rev0.2). The report explains how an unauthenticated i2c command in the locked U-Boot console can be used as a write-what-where and arbitrary-read primitive (via a Depthcharge Companion I2C peripheral), how the authors patched the running U-Boot command table to bypass the authenticated unlock flow, and how transient changes produce a non-persistent root shell; it notes vendor OTA fixes and frames the work as research and guidance for product security improvement.