You've probably already heard the story: we got contracted to analyze a bunch of trains breaking down after being serviced by third-party workshops. We reverse engineered them and found code which simulated failures when they detected servicing attempts. We presented our findings at 37C3… and then shit hit the fan. This presentation will fill the gap which was left after 37C3 - the juicy technical details of how exactly we analyzed the trains: - electric trains 101 - how to reverse engineer Tricore code - an adventure through Ghidra bugs and shortcomings - how to find interesting things in 500 KB of machine code which contained only 6 strings