Unveiling EMUX - ARM and MIPS IoT Emulation Framework
•
0 likes•321 views
After 4 years, ARMX is changing its call sign. EMUX now features both ARM and MIPS device emulation, in a unified framework! Join us as we unveil EMUX and take you into the inner workings of emulating both ARM and MIPS IoT devices. We will be releasing a new Docker image featuring a MIPS CTF challenge to test your MIPS exploit development skills. Slides from my workshop at Ringzer0's December 2021 Workshop Advent Calendar.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Unveiling EMUX - ARM and MIPS IoT Emulation Framework
Similar to Unveiling EMUX - ARM and MIPS IoT Emulation Framework (20)
More from Saumil Shah
More from Saumil Shah (20)
Recently uploaded
Recently uploaded (20)
Unveiling EMUX - ARM and MIPS IoT Emulation Framework
- 2. @therealsaumil @_ringzer0 # WHO AM I Saumil Shah @therealsaumil educating, entertaining and exasperating audiences since 1999
- 3. @therealsaumil @_ringzer0 ARMX is now ARM + MIPS emux.exploitlab.net
- 5. @therealsaumil @_ringzer0 compressed FS CPU Kernel Boot Loader mounted FS nvram init scripts Services Apps libnvram The IoT Boot Up Process conf conf conf conf firmware Loads Kernel. Uncompresses FS to ramdisk, invokes init process. ramdisk userland Reads config from nvram. Builds system config files on the fly. Starts up system services. Invokes Applications and Application services. READY POWER ON
- 8. @therealsaumil @_ringzer0 2: Hidden UART interfaces
- 9. @therealsaumil @_ringzer0 3: Take it directly from the chip!
- 11. @therealsaumil @_ringzer0 Tigard ß à SPI Flash /CS DO /WP GND VCC /HOLD CLK DI 1 2 3 4 8 7 6 5 Tigard SPI Tigard SPI CS /CS VTGT VCC CIPO DO /HOLD /WP SCK CLK GND GND COPI DI
- 12. @therealsaumil @_ringzer0 SPI Flash from an IP Camera Breakout Board for Testing à
- 13. @therealsaumil @_ringzer0 init scripts QEMU CPU and Limited Hardware Kernel Drivers uncompressed Filesystem emulated nvram Services Apps libnvram Emulating Firmware x x x x BUILDROOT Match the kernel with the one on the device chroot environment Implemented as an INI file, preloaded before "boot up" conf conf Fix to match QEMU environment Not all drivers load successfully
- 14. @therealsaumil @_ringzer0 IPCam Firmware Image CramFS root file system gzipped data kernel tar archive 131244 0x200AC 148508 0x2441C 1520204 0x17324C 8323080 0x7F0008 8MB 0 Compile a matching kernel for QEMU Extract rootfs using cramfsck utilities configuration sys.conf umconfig.conf
- 18. @therealsaumil @_ringzer0 Starting an EMUX device
- 19. @therealsaumil @_ringzer0 HERE BE THE GOODS https://github.com/therealsaumil/emux ! Announcements: @therealsaumil