Analyzing embedded software technologies on RISC-V64 using Ghidra - - PowerPoint PPT Presentation

▶
analyzing embedded software technologies on risc v64
SMART_READER_LITE
LIVE PREVIEW

Analyzing embedded software technologies on RISC-V64 using Ghidra - - PowerPoint PPT Presentation

Aug 30, 2022 149 likes •525 views

Presented by: Joris Jonkers Both & Patrick Spaans Supervisor: Alexandru Geana Analyzing embedded software technologies on RISC-V64 using Ghidra driving your security forward 1 Introduction RISC-V64 - Like ARM but open source - One

slide-1
SLIDE 1

1

driving your security forward Analyzing embedded software technologies on RISC-V64 using Ghidra

Presented by: Joris Jonkers Both & Patrick Spaans Supervisor: Alexandru Geana

slide-2
SLIDE 2

2

Introduction

RISC-V64

  • Like ARM but open source
  • One base image
  • Extendable with extensions (e.g. M for

multiplications)

slide-3
SLIDE 3

3

Introduction

RISC-V64

  • Like ARM but open source
  • One base image
  • Extendable with extensions (e.g. M for

multiplications)

  • Security of embedded systems
slide-4
SLIDE 4

4

Introduction

RISC-V64

  • Like ARM but open source
  • One base image
  • Extendable with extensions (e.g. M for

multiplications)

  • Security of embedded systems

Ghidra SRE Framework

slide-5
SLIDE 5

5

Introduction

RISC-V64

  • Like ARM but open source
  • One base image
  • Extendable with extensions (e.g. M for

multiplications)

  • Security of embedded systems

Ghidra SRE Framework Kendryte K210 SoC

  • System on a Chip
  • Maix-bit
  • AI capable IoT device
slide-6
SLIDE 6

6

Related Work

Ghidra only recently open source Analyzing security using reverse engineering is not a new concept

  • Udupa et al. in 2005
  • Zaddach and Costin in 2013
slide-7
SLIDE 7

7

RISC-V64

I → base integer instruction set M → standard integer multiplication & division extension A → standard atomic instruction extension F → single-precision floating-point extension D → standard double-precision floating-point extension C → standard extension for compressed instructions Q → standard extension for quad-precision floating-point

Supported extensions

{

G

slide-8
SLIDE 8

8

RISC-V64

I → base integer instruction set M → standard integer multiplication & division extension A → standard atomic instruction extension F → single-precision floating-point extension D → standard double-precision floating-point extension C → standard extension for compressed instructions Q → standard extension for quad-precision floating-point So, Risc-V64GC == Risc-V64IMAFDC...

Supported extensions

{

G

slide-9
SLIDE 9

9

Research Question

In what ways can a disassembly and decompile tool be used to analyze and enhance the working

  • f embedded technologies?
slide-10
SLIDE 10

10

Research Subquestions

  • What are the possibilities of implementing

a Ghidra plugin for RISC-V?

  • What are the possibilities of using

reverse-engineering to enable hidden features on the Kendryte K210?

slide-11
SLIDE 11

11

Methodology

Creating a Ghidra Plugin for RISC-V64GC Reverse engineering the Kendryte K210 bootrom Research into writing to the Kendryte K210 OTP in order to implement secure boot

slide-12
SLIDE 12

12

confidential

Creating a Ghidra Plugin

for RISC-V64GC

  • Add support for architectures
  • Specifies register layouts and hardware specs
  • Must contain all instructions specifications to allow

successful decompilation

slide-13
SLIDE 13

13

Creating a Ghidra Plugin

Plugin structure

.ldefs file

(language definition)

slide-14
SLIDE 14

14

Creating a Ghidra Plugin

Plugin structure

.ldefs file

(language definition)

.sla file

(Instruction definitions)

Example:

slide-15
SLIDE 15

15

Creating a Ghidra Plugin

Plugin structure

.ldefs file

(language definition)

.sla file

(Instruction definitions)

.pspec file

(Processor specification)

slide-16
SLIDE 16

16

Creating a Ghidra Plugin

Plugin structure

.ldefs file

(language definition)

.sla file

(Instruction definitions)

.pspec file

(Processor specification)

.cspec file

(Compiler specification)

...

slide-17
SLIDE 17

17

Creating a Ghidra Plugin

Plugin structure

.ldefs file

(language definition)

.sla file

(Instruction definitions)

.pspec file

(Processor specification)

.cspec file

(Compiler specification)

slide-18
SLIDE 18

18

Reverse engineering the Kendryte K210 bootrom

Using the plugin

…

slide-19
SLIDE 19

19

Reverse engineering the Kendryte K210 bootrom

Using the plugin

… Can be: “f3 01 e7 00” or “f3 01” Neither are in the documentation …

slide-20
SLIDE 20

20

Reverse engineering the Kendryte K210 bootrom

Using an alternative reverse engineering tool

An alternative to Ghidra could be used to find out more about these functions.

slide-21
SLIDE 21

21

An alternative to Ghidra could be used to find out more about these functions.

Reverse engineering the Kendryte K210 bootrom

Using an alternative reverse engineering tool Ghidra Radare2

slide-22
SLIDE 22

22

Reverse engineering the Kendryte K210 bootrom

Using the complete bootrom

slide-23
SLIDE 23

23

Reverse engineering the Kendryte K210 bootrom

Using the complete bootrom There are still some unrecognized instructions

slide-24
SLIDE 24

24

Reverse engineering the Kendryte K210 bootrom

Debugging

Using J-Link and OpenOCD (on-chip-debugger)

slide-25
SLIDE 25

25

Reverse engineering the Kendryte K210 bootrom

Debugging

It turns out that all instructions left were no actual instructions

slide-26
SLIDE 26

26

Research into writing to the Kendryte K210 OTP

Implementing secure boot

slide-27
SLIDE 27

27

Research into writing to the Kendryte K210 OTP

Implementing secure boot

slide-28
SLIDE 28

28

Research into writing to the Kendryte K210 OTP

Implementing secure boot

slide-29
SLIDE 29

29

Research into writing to the Kendryte K210 OTP

Implementing secure boot

slide-30
SLIDE 30

30

Research into writing to the Kendryte K210 OTP

Implementing secure boot

slide-31
SLIDE 31

31

Research into writing to the Kendryte K210 OTP

Implementing secure boot

slide-32
SLIDE 32

32

Research into writing to the Kendryte K210 OTP

Trying to write to the OTP

We used the Ghidra plugin to find the OTP write function

slide-33
SLIDE 33

33

Research into writing to the Kendryte K210 OTP

Trying to write to the OTP

We used the Ghidra plugin to find the OTP write function While being the correct function, it is yet unable to write

slide-34
SLIDE 34

34

Research into writing to the Kendryte K210 OTP

What is this return value?

In the function, the following is specified:

slide-35
SLIDE 35

35

Research into writing to the Kendryte K210 OTP

What is this return value?

In the function, the following is specified: So what is this _DAT_50420060?

slide-36
SLIDE 36

36

Conclusion

The Ghidra Plugin works, and is able to completely reverse engineer the Kendryte K210 Bootrom However, it is not possible to enable any features that require writing to the OTP if the write disabling bit has been set.

slide-37
SLIDE 37

37

Future Work

Test the write function on a Kendryte K210 chip with an unwritten OTP Use the Ghidra Plugin as a means to analyze the security of embedded SoC’s Enable other features of the Kendryte K210 using reverse engineering Create a plugin for other RISC-V types or extensions