Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Introducing ARM-X

6,071 views

Published on

Officially announcing my latest project ARM-X Firmware Emulation Framework at HITB Cyberweek 2019

Published in: Software
  • Be the first to comment

Introducing ARM-X

  1. 1. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Introducing ARM-X Saumil Shah @therealsaumil 16 October 2019
  2. 2. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE # WHO AM I Saumil Shah CEO, Net Square @therealsaumil educating, entertaining and exasperating audiences since 1999
  3. 3. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Introducing ARM-X • An ARM Firmware Emulation Framework. • Ultimate Goal - create an IoT VM! • A Virtual IoT device makes for easy – runtime analysis – reverse engineering – fuzzing – exploit development • Great insight into embedded hardware by trying to emulate it.
  4. 4. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
  5. 5. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
  6. 6. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Take a look at an IoT device...
  7. 7. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE CPU and Hardware Kernel Drivers File System nvram User Processes API UI libnvram JTAG UART SPI ...it is a special computer...
  8. 8. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE compressed FS CPU Kernel Boot Loader mounted FS nvram init scripts Services Apps libnvram The IoT Boot Up Process conf conf conf conf firmware Loads Kernel. Uncompresses FS to ramdisk, invokes init process. ramdiskuserland Reads config from nvram. Builds system config files on the fly. Starts up system services. Invokes Applications and Application services. READY POWER ON
  9. 9. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel Drivers uncompressed Filesystem emulated nvram init scripts Services Apps libnvram Emulation: Goals and Challenges x x x x BUILDROOT Match the kernel with the one on the device chroot environment Implemented as an INI file, preloaded before "boot up" conf conf Fix to match QEMU environment Not all drivers load successfully
  10. 10. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel The ARM-X Startup Process
  11. 11. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
  12. 12. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
  13. 13. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel Drivers uncompressed Filesystem emulated nvram Emulation: Goals and Challenges conf conf
  14. 14. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
  15. 15. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
  16. 16. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel Drivers uncompressed Filesystem emulated nvram init scripts libnvram Emulation: Goals and Challenges conf conf
  17. 17. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
  18. 18. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE QEMU CPU and Limited Hardware Kernel Drivers uncompressed Filesystem emulated nvram init scripts Services Apps libnvram Emulation: Goals and Challenges x x x x conf conf
  19. 19. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
  20. 20. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Obtaining the Firmware Firmware rootfs Firmware .bin file rootfs+nvram Serial Console Direct from Flash memory
  21. 21. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE 1: Web/FTP site
  22. 22. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE 2: Hidden UART interfaces Vcc (+3.3V) GND The other two pins have to be TX, RX. GND Verify continuity across GND
  23. 23. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Serial Console Device GND TX RX GND TX RX minicom Serial Port = /dev/ttyUSB0 115200 baud 8N1 Vcc
  24. 24. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Serial Console - working
  25. 25. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Finished Serial Port Projects
  26. 26. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE # cat /proc/partitions major minor #blocks name 31 0 256 mtdblock0 31 1 64 mtdblock1 31 2 64 mtdblock2 31 3 1472 mtdblock3 31 4 128 mtdblock4 31 5 64 mtdblock5 31 6 2048 mtdblock6 31 7 32768 mtdblock7 31 8 30975 mtdblock8 31 9 131072 mtdblock9 31 10 98304 mtdblock10 Firmware Extraction # cat /proc/mtd dev: size erasesize name mtd0: 00040000 00010000 "u-boot" mtd1: 00010000 00010000 "devconf" mtd2: 00010000 00010000 "devdata" mtd3: 00170000 00010000 "mydlink" mtd4: 00020000 00010000 "langpack" mtd5: 00010000 00010000 "nvram" mtd6: 00200000 00010000 "flash" mtd7: 02000000 00020000 "upgrade" mtd8: 01e3ffa0 00020000 "rootfs" mtd9: 08000000 00020000 "nflash" mtd10: 06000000 00020000 "storage" dd if=/dev/mtdblock8 …
  27. 27. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE 3: Take it directly from the chip!
  28. 28. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE DEMO TIME!
  29. 29. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE WATCH THIS SPACE Downloads: https://armx.exploitlab.net/ ! Announcements: @therealsaumil Expect PREVIEW RELEASE 23 October 2019
  30. 30. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE Thank you and … QUESTIONS? @therealsaumil 16 October 2019

×