Upgrade to Pro — share decks privately, control downloads, hide ads and more …

AIS3-Firmware Security Analysis

AIS3-Firmware Security Analysis

terrynini

July 30, 2019
Tweet

More Decks by terrynini

Other Decks in Technology

Transcript

  1. What is firmware ROM EPROM flash memory firmware firmware firmware

    Firmware is a piece of code stored in ROM, EPROM, flash memory. It may provide some functions to software to control hardware. Or, it may be the only program that will run on the embedded system.
  2. Boot loader PC RAM Hard Disk boot loader MBR MBR

    Boot loader Boot loader完成載入
  3. ARM ARM 有兩個模式 一個 ARM,一個 Thumb Thumb 是 ARM 的子集,

    ARM 一條指令需要 4Byte 的編碼 , Thumb 則是 2 or 4 byte
  4. ARM 00010400 <main>: 10400: b580 push {r7, lr} 10402: af00

    add r7, sp, #0 10404: 4b03 ldr r3, [pc, #12] ; (10414 <main+0x14>) 10406: 0018 movs r0, r3 10408: f7ff ff68 bl 102dc <puts@plt> 1040c: 2300 movs r3, #0 1040e: 0018 movs r0, r3 10410: 46bd mov sp, r7 10412: bd80 pop {r7, pc} 000103fc <main>: 103fc: e92d4800 push {fp, lr} 10400: e28db004 add fp, sp, #4 10404: e59f000c ldr r0, [pc, #12] ; 10418 <main+0x1c> 10408: ebffffb3 bl 102dc <puts@plt> 1040c: e3a03000 mov r3, #0 10410: e1a00003 mov r0, r3 10414: e8bd8800 pop {fp, pc}
  5. ARM 暫存器 R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 2.1.3 Core registers
  6. ARM MOV R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0x0000FA05 MOV R1, #0xFA05 3.5.6 MOV and MVN
  7. ARM R0 R1 R2 R3 R4 R5 R6 R7 R8

    R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0x0000FA05 0x00000100 MOV R1, #0xFA05 MOV R5, #256 MOV 3.5.6 MOV and MVN
  8. ARM R0 R1 R2 R3 R4 R5 R6 R7 R8

    R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0x0000FA05 0x0000BEEF 0x00000100 MOV R1, #0xFA05 MOV R5, #256 MOVW R3, #0xBEEF MOV 3.5.6 MOV and MVN
  9. ARM R0 R1 R2 R3 R4 R5 R6 R7 R8

    R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0x0000FA05 0xDEADBEEF 0x00000100 MOV R1, #0xFA05 MOV R5, #256 MOVW R3, #0xBEEF MOVT R3, #0xDEAD MOV 3.5.6 MOV and MVN
  10. ARM R0 R1 R2 R3 R4 R5 R6 R7 R8

    R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0x0000FA05 0xFFFFFFF0 0xDEADBEEF 0x00000100 MOV R1, #0xFA05 MOV R5, #256 MOVW R3, #0xBEEF MOVT R3, #0xDEAD MVN R2, #0xF MOV 3.5.6 MOV and MVN
  11. ARM LDR/STR R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0xFFFFFFF0 0xDEADBEEF 0x00000100 0x100 0x104 0xfaceb00c 0xdeadbeef LDR R1, [R5] 3.4 Memory access instructions
  12. ARM LDR/STR R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0xfaceb00c 0xFFFFFFF0 0xDEADBEEF 0x00000100 LDR R1, [R5] 0x100 0x104 0xfaceb00c 0xdeadbeef 3.4 Memory access instructions
  13. ARM LDR/STR R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0xfaceb00c 0xFFFFFFF0 0xDEADBEEF 0x00000100 LDR R1, [R5] STR R2, [R5,#4] 0x100 0x104 0xfaceb00c 0xdeadbeef 3.4 Memory access instructions
  14. ARM LDR/STR R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0xfaceb00c 0xFFFFFFF0 0xDEADBEEF 0x00000100 0x100 0x104 0xfaceb00c 0xFFFFFFF0 LDR R1, [R5] STR R2, [R5,#4] 3.4 Memory access instructions
  15. ARM LDR/STR R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0xfaceb00c 0xFFFFFFF0 0xDEADBEEF 0x00000100 0x100 0x104 0xfaceb00c 0xFFFFFFF0 LDR R1, [R5] STR R2, [R5,#4] LDR R2, [R5],#4 3.4 Memory access instructions
  16. ARM LDR/STR R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0xfaceb00c 0xfaceb00c 0xDEADBEEF 0x00000104 0x100 0x104 0x108 0xfaceb00c 0xFFFFFFF0 LDR R1, [R5] STR R2, [R5,#4] LDR R2, [R5],#4 3.4 Memory access instructions
  17. ARM LDR/STR R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0xfaceb00c 0xfaceb00c 0xDEADBEEF 0x00000104 0x100 0x104 0x108 0xfaceb00c 0xFFFFFFF0 LDR R1, [R5] STR R2, [R5,#4] LDR R2, [R5],#4 STR R2, [R5,#4]! 3.4 Memory access instructions
  18. ARM LDR/STR R0 R1 R2 R3 R4 R5 R6 R7

    R8 R9 R10 R11 R12 SP(R13) LR(R14) PC(R15) 0xfaceb00c 0xfaceb00c 0xDEADBEEF 0x00000108 0x100 0x104 0x108 0xfaceb00c 0xFFFFFFF0 0xfaceb00c LDR R1, [R5] STR R2, [R5,#4] LDR R2, [R5],#4 STR R2, [R5,#4]! 3.4 Memory access instructions
  19. ARM 單位 10101010 10101010 10101010 10101010 10101010 10101010 10101010 1

    BYTE 1 Half Word 1 Word LDR LDRH, LDRSH LDRB, LDRBH
  20. ARM condition execution N -> negative Z -> zero C

    -> carry V -> overflow CMP R1, #3 LDREQ R1, [R5] 3.3.7 Condition execution
  21. ARM condition execution N -> negative Z -> zero C

    -> carry V -> overflow if( r1 == 3 ) r1 = *r5 3.3.7 Condition execution
  22. ARM condition execution CMP R1, #3 IT EQ LDREQ R1,

    [R5] N -> negative Z -> zero C -> carry V -> overflow 3.3.7 Condition execution
  23. ARM condition execution N -> negative Z -> zero C

    -> carry V -> overflow if( r1 == 3 ) r1 = *r5 3.3.7 Condition execution
  24. ARM condition execution CMP R1, #3 ITT EQ LDREQ R1,

    [R5] LDREQ R2, [R5] N -> negative Z -> zero C -> carry V -> overflow 3.3.7 Condition execution
  25. ARM condition execution N -> negative Z -> zero C

    -> carry V -> overflow if( r1 == 3 ){ r1 = *r5 r2 = *r5 } 3.3.7 Condition execution
  26. ARM condition execution CMP R1, #3 ITTE EQ LDREQ R1,

    [R5] LDREQ R2, [R5] ADDNE R1, #1 N -> negative Z -> zero C -> carry V -> overflow 3.3.7 Condition execution
  27. ARM condition execution N -> negative Z -> zero C

    -> carry V -> overflow if( r1 == 3 ){ r1 = *r5 r2 = *r5 }else{ r1 += 1 } 3.3.7 Condition execution
  28. ARM B{cond} lable 跳轉 BL{cond} lable 跳轉,把 return address 放進

    LR BX{cond} Rm 跳轉 BXL{cond} Rm 跳轉,把 return address 放進 LR 3.10 Branch and control instructions
  29. Secure Boot Reset ROM Bootloader Bootloader input Signed? yes no

    Bootloader firmware input Signed? yes no Stop
 or Recover