It is clear Ledger implants have evolved a lot in recent months, aimed at improving stealth, reliability and ease of ins | Hanami
It is clear Ledger implants have evolved a lot in recent months, aimed at improving stealth, reliability and ease of install. Older implants required a lot more work to install, with some solder points only aimed at improving placement, while the newest implant has holes for the surface mounted capacitors.
Ledger Nano X uses a class of SPI controlled screens known as SSD1312, which are fairly well known and documented.
The implant aims at watching the screen to take note and transmit the seed phrase you'll be setting up on your ledger.
SPI (Serial Peripheral Interface) is the protocol used by Ledger to communicate with the screen. Instead of having a GPU and generating 30 or 60 fps, the ledger instead only sends data to the screen when it needs to be updated. A SPI screen typically uses 4 pins: CLK, DC, CS and MOSI.
CLK is the most important, as it defines when each bit is read. MOSI contains the actual data, while DC allows differentiating if the bits being sent are a command (draw screen, etc) or actual pixels. CS allows the ledger to tell the screen it's its turn to listen, and while there is only one device on the bus, it also allows the recipient to group bits into bytes as it comes down between each byte (every 8 bits).
The newer implant isn't tapping SE RESET, likely instead waking up on SPI CLK (to be confirmed).
By not reading the command/data selector (SPI DC), the spy implant does not know anymore if the bits it reads are data or command, meaning the software in the implant has been upgraded to trim the command at the beginning of the data when reading each screen update.