1. “Preliminary” Study on Design
and Exploitation of Trustzone
@若渴 2018.3.24
<ajblane0612@gmail.com>
AjMaChInE

2. Outline
• Design category of using trustzone
• TEE Exploitation

3. Isolation
Process Isolation -> Kernel Isolation-> Function Isolation
(symmetrically call – non-preemptive)
[0]

4. ARM TrustZone Technology
“It aims at enabling the creation of an execution environment,
for protecting the confidentiality and integrity of critical code,
allowing that code to be executed isolated from the main
operating system (OS).” [0]
EL3
EL1
EL0

5. Design Category of Using TrustZone
• Security services
• Virtualization
• Development frameworks

6. Security Services
• DroidVault [1]
• TrustOTP [2]
• TZ-RKP [3]

7. DroidVault - Allowing the Secure
Management of Storage [1]
R0,R1
R2,R3

8. TrustOTP - Information Leakage of OTP
[2]

9. Why to Use Reliable Switch [2]
• SMC instruction
– When REE (Normal) Kernels are compromised
• Secure Interrupt
– Non-maskable GPIO-2 Secure Interrupt

10. Reliable Switch - Non-Maskable
Interrupt (NMI) Mechanism [2]
• Non-maskable GPIO-2 Secure Interrupt
Central Security Unit (CSU)

11. TZ-RKP: Avoid Bypassing the Memory
Protection using Double Mapping [3]

12. TZ-RKP: Control Instruction Emulation
and Trapping Translation Table Updates

13. Trsut-RKP OS Virtaul Memory Layout [3]

14. Virtualization

15. vTZ: When TEE OS is Compromised [4]

16. (c) is an Excellent Design [4]

17. Development Frameworks [0]
TrusrFrame [0]

18. GlobalPlatform API
ARM Trustzone API GlobalPlatform API
ARM Trustzone ARM Trustzone Intel SGX

19. E.G. OP-TEE

20. E.G. TrustFrame [0]
(ioctl)

21. Exploitation
• Semantic gap (BOOMERANG) [5]
• Revoke vulnerable trustlets [6]

22. Semantic Gap
• [利用特性]
– the secure world always maintains complete control
over and visibility into the non-secure world (similar
to a hypervisor and its guests)
– Visibility: the secure world and its associated TAs
have the ability to read and write to non-secure world
memory
• BOOMERANG (自食其果~”~) exploits the
semantic gap inherent to the design of all the
current TEE implementations.

23. BOOMERANG – PTR as DATA cannot
be Checked [5]

24. Revocation
• QSEE revocation
– The Attestation certificate preventing “rolling back”
to older versions of the software image
– 但 all trustlets share the same image identifier
• Kinibi revocation
– Reverse-engineer the bootloader binary including TEE
kernel
– 沒有DOC ->找到TEE kernel->又找到parsing
signature->解出the structure of the signature
– 但直接送有問題的tasklet就可@@a
[6]

25. Reference
• [0] 2016, Joao Rocheteau Ramos, TrustFrame, a Software
Development Framework for TrustZone-enabled Hardware
• [1] 2014, Xiaolei Li, DroidVault- A Trusted Data Vault for Android
• [2] 2015, He Sun, etc., TrustOTP- Transforming Smartphones into
Secure One-Time Password Tokens
• [3] 2014, Ahmed M Azab, etc. Hypervision Across Worlds : Real-
time Kernel Protection from the ARM TrustZone Secure World
• [4] 2017, Zhichao Hua, etc. vTZ- Virtualizing ARM TrustZone
• [5] 2017, Nick Stephens, etc. Boomerang- Exploiting the Semantic
Gap in Trusted Execution Environments
• [6] 2017, Gal Beniamini, Trust Issues-Exploiting TrustZone TEEs