Dmitry Nedospasov, Thorsten Schreder. Let the Hardware Do All the Work: Adding Programmable Logic to Your Toolbox.
•
0 likes•1,212 views
Recommended
Recommended
More Related Content
Viewers also liked
Viewers also liked (16)
Similar to Dmitry Nedospasov, Thorsten Schreder. Let the Hardware Do All the Work: Adding Programmable Logic to Your Toolbox.
Similar to Dmitry Nedospasov, Thorsten Schreder. Let the Hardware Do All the Work: Adding Programmable Logic to Your Toolbox. (20)
More from Positive Hack Days
More from Positive Hack Days (20)
Recently uploaded
Recently uploaded (20)
Dmitry Nedospasov, Thorsten Schreder. Let the Hardware Do All the Work: Adding Programmable Logic to Your Toolbox.
- 1. Let the Hardware do all the Work PHDays 2013, Москва Dmitry Nedospasov, Thorsten Schröder
- 2. About us Dmitry Nedospasov • PhD Student TU Berlin Thorsten Schröder • Founder, modzero AG
- 5. Microcontroller • Real-time analysis. • High-level programming languages. • Cheap. • Integrated interfaces for embedded protocols.
- 10. Field Programmable Gate Array • Reprogrammable logic. • Logic simultaneously “executes” in a single clock cycle. • Embedded memories for data buffering. Source: http://commons.wikimedia.org/wiki/File:LEGO_Bits_Box_2.jpg
- 13. When in doubt...
- 15. Terasic DE Nano Source: Terasic 80€
- 18. Die Datenkrake • Open-Source Hardware & Software • User friendly interfaces and connectors • Test pads, breakout of GPIO pins (terminated & unterminated), bread-boardable • Firmware & bitstream updates of the DDK via USB serial interface
- 19. Die Datenkrake • NXP LPC1765 ARM Cortex-M3 microcontroller - 100 MHz, 512kB Flash ROM, 64kB RAM • Microsemi Actel A3PN125 FPGA - 125k system gates, 36 kbit SRAM, 71 IO • FTDI FT230X Serial-USB converter - 3Mbaud
- 20. Microcontroller • Controls FPGA power and reset • Controls buffer power • Provides clock for FPGA • Interfaces to the user/PC • IEEE1532 ISP of FPGA
- 21. FPGA • 3 UARTs / 6 GPIO interfacing the µC for data exchange • 16bit parallel bus interfacing the µC for data and command exchange • 56 general purpose 3.3/5V tolerant, terminated I/O for interfacing your targets
- 22. Die Datenkrake
- 23. Die Datenkrake
- 24. Die Datenkrake
- 25. Die Datenkrake
- 27. Targets
- 28. Hardware Fuzzing • Fuzzing multiple hardware instances. • Determine the current state of the target. • Example application: concurrent monitoring of embedded linux devices via serial interface (Odroid-U2) • Crash detection, target device reset and logging (FIFO memory). • Multiplexing signals to the device.
- 29. chX u1 u2 rst1 tx1 rx1 rst2 tx2 rx2 Figure 1: Odroid channel module Hardware Fuzzing
- 30. Hardware Glitching • Transient, non-invasive fault injection (rise & hold-time violations). • Attacks a single clock cycle. May cause "incorrect" values to be loaded into registers or memory locations. • Require precise timing on the order of fractions of clock-cycles of the target. • Two common forms: Voltage supply and clock glitching.
- 31. Clock Glitching • Alter the clock period during execution. • Results in incorrect intermediate values as the result is sampled too early. • DDK includes PLLs, frequency dividers and multiple global clock signals. • Multiple clock frequencies can be generated (i.e. 20ns, 10ns ...).
- 32. Hardware Glitching in- ges, se- im- rial per eset six ces our -U2 . In har- nce hin uto- dule chX smartcard mvcc mgnd vcc gnd oe clk rst I/O s1 s2 vcc vglitch vglitch Figure 2: Hardware Glitcher Secure systems are susceptible to several classes of
- 33. Software Defined Radio • Utilize digital RF transceivers with a digital serial output of data. • Multiple transceivers and multiple configurations can be monitored simultaneously. • Only certain parts of the payload are of interest while others can be discarded. • Protocol decoding must keep up with the data rate of the target.
- 34. Software Defined Radio • Example: Keykeriki - Difficulties & challenges • 2.4GHz Nordic Semiconductor NRF24 family • Enhanced Shockburst protocol • 2Mbit/s RF (2MHz = 500ns per bit)
- 35. Software Defined Radio chX RF mode cs sck sdio gio Figure 4: A7125/RF channel module
- 36. Acknowledgements • Joachim Steiger (roh) • Daniel Mack • Jonas Hilt • Felix von Leitner (Фефе) • Hugo Fortier
- 37. Rec0n Training • http://recon.cx • 4-Day training • Datenkrake!1!!! • Oscilloscopes!!!
- 38. Questions?