WITH GLITCHKIT 34TH CHAOS COMMUNICATION CONGRESS KATE TEMKIN & - - PowerPoint PPT Presentation

▶
with glitchkit
SMART_READER_LITE
LIVE PREVIEW

WITH GLITCHKIT 34TH CHAOS COMMUNICATION CONGRESS KATE TEMKIN & - - PowerPoint PPT Presentation

Mar 29, 2023 312 likes •705 views

OPENING CLOSED SYSTEMS WITH GLITCHKIT 34TH CHAOS COMMUNICATION CONGRESS KATE TEMKIN & DOMINIC SPILL WHO WE ARE Dominic Spill Kate Temkin @dominicgs @ktemkin Major projects: Major projects: FaceDancer HackRF GreatFET

slide-1
SLIDE 1

OPENING CLOSED SYSTEMS

34TH CHAOS COMMUNICATION CONGRESS

WITH GLITCHKIT

KATE TEMKIN & DOMINIC SPILL

slide-2
SLIDE 2

WHO WE ARE

Kate Temkin @ktemkin Major projects:

  • FaceDancer
  • GreatFET

Dominic Spill @dominicgs Major projects:

  • HackRF
  • GreatFET
slide-3
SLIDE 3

PEOPLE SMARTER THAN US

  • Micah Elizabeth Scott (@scanlime)
  • Colin O’Flynn (@colinoflynn)
  • Most of the people in this room!

PEOPLE WHO GIVE US MONEY

  • Great Scott Gadgets [thanks, Mike!]
slide-4
SLIDE 4
slide-5
SLIDE 5

INTEL 8051-DERIVATIVE MICROCONTROLLER

  • Serial bootloader in ROM
  • No debug or ISP port
  • Readout disabled
slide-6
SLIDE 6

FLIR TG-165 THERMAL CAMERA

slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11

SECURITY BY NOT MAKING ASSUMPTIONS

(my_stack_memory, user_input);

slide-12
SLIDE 12

SECURITY BY NOT MAKING ASSUMPTIONS …?!

(my_stack_memory, user_input);

slide-13
SLIDE 13

SOURCE: COLIN O’FLYNN, CHIPWHISPERER WIKI

(MODIFIED)

‘Increment’ PC Fetch Instruction Decide if Branch is Taken Next PC (branch not taken) Next PC (branch taken) Parallel Execution Paths Final Result (loaded into register)

slide-14
SLIDE 14

SOURCE: COLIN O’FLYNN, CHIPWHISPERER WIKI

SOURCE: NAVI ET AL, LO LOW-PO POWER AND HIGH-PE PERFORMANCE 1-BI BIT CMOS FUL ULL ADDER R CELL

slide-15
SLIDE 15

PSEUDOCODE PSEUDO-EXAMPLE

raw = (char *)items; length = N * sizeof(items[0]); while (--length) { send_byte(raw++); }

; [snip] ; compute length

MUL R1, R11, R12 loop: DEC R1, R1 ; --length JZ finish CALL send_byte INC R2, R2 ; raw++ JMP loop finish: NOP

slide-16
SLIDE 16

PSEUDOCODE PSEUDO-EXAMPLE

raw = (char *)items; length = N * sizeof(items[0]); while (--length) { send_byte(raw++); }

; [snip] ; compute length

loop: DEC R1, R1 ; --length JZ finish CALL send_byte INC R2, R2 ; raw++ JMP loop finish: NOP

...

time

slide-17
SLIDE 17

TARGET: DMA CONTROLLERS

+1

  • 1

to_send addr

Bus Access Hardware Transceiver

slide-18
SLIDE 18

CHIPWHISPERER LITE GLITCHING & SIDE-CHANNEL BOARD

https://newae.com/tools/chipwhisperer/ https://github.com/newaetech/chipwhisperer

slide-19
SLIDE 19
slide-20
SLIDE 20

Synchronization Features Stimulus Generation Triggering Features

GlitchKit

Event Routing Clock Management USB Host eMMC Device (not yet complete) USB Device Simple Event Triggers UART Triggers Trigger Output

slide-21
SLIDE 21
slide-22
SLIDE 22

Synchronization Features Stimulus Generation Triggering Features

GlitchKit

Event Routing Clock Management USB Host eMMC Device (not yet complete) USB Device Simple Event Triggers UART Triggers Trigger Output

slide-23
SLIDE 23

Synchronization Features Stimulus Generation Triggering Features

GlitchKit

Event Routing Clock Management USB Host eMMC Device (not yet complete) USB Device Simple Event Triggers UART Triggers Trigger Output

slide-24
SLIDE 24

Synchronization Features Stimulus Generation Triggering Features

GlitchKit

Event Routing Clock Management USB Host eMMC Device (not yet complete) USB Device Simple Event Triggers UART Triggers Trigger Output

slide-25
SLIDE 25

MICAH ELIZABETH SCOTT (SCANLIME)’S

GLITCHY FIRMWARE DESCRIPTOR GRAB

http://scanlime.org/2016/10/scanlime015-glitchy-descriptor-firmware-grab/

slide-26
SLIDE 26
slide-27
SLIDE 27
slide-28
SLIDE 28

Field Value Length 256 Address 0x1000 Field Value Length 192 Address 0x1040 Field Value Length 128 Address 0x1080 Field Value Length 64 Address 0x10C0 Field Value Length Address 0x1100

PID IN 64 bytes data PID IN 64 bytes data PID IN 64 bytes data PID IN 64 bytes data PID IN 0 bytes data

slide-29
SLIDE 29

Field Value Length 256 Address 0x1000 Field Value Length 1,321,6… Address 0x1040 Field Value Length 1,321,6… Address 0x1080 Field Value Length 1,321,6… Address 0x10C0 Field Value Length 1,321,6… Address 0x1100

PID IN 64 bytes data PID IN 64 bytes data PID IN 64 bytes data PID IN 64 bytes data PID IN 64 bytes data

slide-30
SLIDE 30

FACEWHISPERER USB CHIPWHISPERER TARGET

http://github.com/scanlime/facewhisperer

SOURCE: MICAH ELIZABETH SCOTT, IN HER FACEWHISPERER REPO

slide-31
SLIDE 31

SOURCE: MICAH ELIZABETH SCOTT, IN AFOREMENTIONED VIDEO

slide-32
SLIDE 32

EQUIVALENT GLITCHKIT CODE

gf = GreatFET() gf.switch_to_external_clock() gf.glitchkit.provide_target_clock(VBUS_ENABLED); gf.glitchkit.simple.watch_for_event( 1, [('EDGE_RISING', 'J1_P7')]) gf.glitchkit.use_events_for_synchronization(COUNT_REACHED) gf.glitchkit.trigger_on_events(HOST_SETUP_TRANSFER_QUEUED) gf.glitchkit.usb.capture_control_in(request=GET_DESCRIPTOR, value=GET_DEVICE_DESCRIPTOR, length=18)

slide-33
SLIDE 33

WITH APOLOGIES TO MICHAEL OSSMANN

slide-34
SLIDE 34

WITH APOLOGIES TO MICHAEL OSSMANN

TO EVERYONE

GLITCH IN MEASURE OUT (SCA)

HIGHER-Z DECOUPLING NETWORK

slide-35
SLIDE 35
slide-36
SLIDE 36

LPC43XX

MEMORY MAP

slide-37
SLIDE 37
slide-38
SLIDE 38

Synchronization Features Stimulus Generation Triggering Features

GlitchKit

Event Routing Clock Management USB Host eMMC Device USB Device Simple Event Triggers UART Triggers Trigger Output SPI Device + Host I2C Device + Host … more? Ethernet Peer Ethernet Monitor

slide-39
SLIDE 39

THANKS FOR LISTENING!

QUESTIONS?

JOIN US: https://github.com/glitchkit