Introducing ARM-X
•
1 j'aime•21,041 vues
Officially announcing my latest project ARM-X Firmware Emulation Framework at HITB Cyberweek 2019
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Introducing ARM-X
Similaire à Introducing ARM-X (20)
Plus de Saumil Shah
Plus de Saumil Shah (20)
Dernier
Dernier (20)
Introducing ARM-X
- 1. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Introducing ARM-X Saumil Shah @therealsaumil 16 October 2019
- 2. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE # WHO AM I Saumil Shah CEO, Net Square @therealsaumil educating, entertaining and exasperating audiences since 1999
- 3. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Introducing ARM-X • An ARM Firmware Emulation Framework. • Ultimate Goal - create an IoT VM! • A Virtual IoT device makes for easy – runtime analysis – reverse engineering – fuzzing – exploit development • Great insight into embedded hardware by trying to emulate it.
- 4. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
- 5. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
- 6. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Take a look at an IoT device...
- 7. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE CPU and Hardware Kernel Drivers File System nvram User Processes API UI libnvram JTAG UART SPI ...it is a special computer...
- 8. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE compressed FS CPU Kernel Boot Loader mounted FS nvram init scripts Services Apps libnvram The IoT Boot Up Process conf conf conf conf firmware Loads Kernel. Uncompresses FS to ramdisk, invokes init process. ramdiskuserland Reads config from nvram. Builds system config files on the fly. Starts up system services. Invokes Applications and Application services. READY POWER ON
- 9. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel Drivers uncompressed Filesystem emulated nvram init scripts Services Apps libnvram Emulation: Goals and Challenges x x x x BUILDROOT Match the kernel with the one on the device chroot environment Implemented as an INI file, preloaded before "boot up" conf conf Fix to match QEMU environment Not all drivers load successfully
- 10. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel The ARM-X Startup Process
- 11. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
- 12. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
- 13. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel Drivers uncompressed Filesystem emulated nvram Emulation: Goals and Challenges conf conf
- 14. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
- 15. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
- 16. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel Drivers uncompressed Filesystem emulated nvram init scripts libnvram Emulation: Goals and Challenges conf conf
- 17. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
- 18. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel Drivers uncompressed Filesystem emulated nvram init scripts Services Apps libnvram Emulation: Goals and Challenges x x x x conf conf
- 19. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
- 20. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Obtaining the Firmware Firmware rootfs Firmware .bin file rootfs+nvram Serial Console Direct from Flash memory
- 21. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE 1: Web/FTP site
- 22. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE 2: Hidden UART interfaces Vcc (+3.3V) GND The other two pins have to be TX, RX. GND Verify continuity across GND
- 23. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Serial Console Device GND TX RX GND TX RX minicom Serial Port = /dev/ttyUSB0 115200 baud 8N1 Vcc
- 24. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Serial Console - working
- 25. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Finished Serial Port Projects
- 26. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE # cat /proc/partitions major minor #blocks name 31 0 256 mtdblock0 31 1 64 mtdblock1 31 2 64 mtdblock2 31 3 1472 mtdblock3 31 4 128 mtdblock4 31 5 64 mtdblock5 31 6 2048 mtdblock6 31 7 32768 mtdblock7 31 8 30975 mtdblock8 31 9 131072 mtdblock9 31 10 98304 mtdblock10 Firmware Extraction # cat /proc/mtd dev: size erasesize name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "devconf" mtd2: 00010000 00010000 "devdata" mtd3: 00170000 00010000 "mydlink" mtd4: 00020000 00010000 "langpack" mtd5: 00010000 00010000 "nvram" mtd6: 00200000 00010000 "flash" mtd7: 02000000 00020000 "upgrade" mtd8: 01e3ffa0 00020000 "rootfs" mtd9: 08000000 00020000 "nflash" mtd10: 06000000 00020000 "storage" dd if=/dev/mtdblock8 …
- 27. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE 3: Take it directly from the chip!
- 28. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE DEMO TIME!
- 29. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE WATCH THIS SPACE Downloads: https://armx.exploitlab.net/ ! Announcements: @therealsaumil Expect PREVIEW RELEASE 23 October 2019
- 30. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Thank you and … QUESTIONS? @therealsaumil 16 October 2019