So recently a very hyped memory corruption security vulnerability was discovered in the OpenSSL punycode parser. Some folks including Hanno (https://twitter.com/hanno/status/1587775675397726209) asked why this is still happenning, why no one wrote a fuzzer for the punycode parser and if we as the security community have learned nothing from Heartbleed. I think we should give the developers the…
Compiling CLVK for Android. Many Android devices, especially Google Pixel, ship without the OpenCL library. At some point I needed OpenCL for my OpenCV prototyping, and I was also interested in using either CU2CL or a similar project to run CUDA code. Needless to say, as soon as I saw a project which promised to implement OpenCL on top of Vulkan, I decided to see if I can run it on Android. It…
Researchers from Team T5 recently published their write-up on exploiting a bug in S-Boot and obtaining code execution in the Samsung Secure Bootloader (S-Boot). This week, they're going to present it at the BlackHat 2020 conference. Their write-up contains a lot of technical details and I recommend you to read it.…
Introduction. Last year I published a post ( http://allsoftwaresucks.blogspot.com/2019/05/reverse-engineering-samsung-exynos-9820.html ) about reverse-engineering TEEGRIS and S-Boot on Samsung Exynos Galaxy S10. This is kind of a follow-up to that post which has received a lot of attention and led to interesting conversations with fellow security researchers. Funnily enough, this very blog with…
Reverse-engineering Samsung S10 TEEGRIS TrustZone OS It's been a while since my last post, huh? Even though I have quite a lot of stuff I'm planning to write about, time is very limited. Lately I've been working on reverse engineering and documenting the S-Boot bootloader and TrustZone OS from the Exynos version of Samsung Galaxy S10. TLDR: I can now run S-Boot and TEEGRIS TrustZone TAs in QEMU…
Introduction. One project I had in mind long time ago was getting Windows Mobile to run in QEMU. I think it's a lovely OS with a long history and the project seemed like a nice tecnhical challenge. Initially I started working on it two years ago back in 2014 and the plan was to later run it in KVM on Cortex-A15 with Virtualization Extensions. However, I had to suspend it because I started working…
Introduction. I have decided to check out the state of OpenCL support for AMD GPUs in Linux Open-Source stack. In this post I will describe the experience of debugging issues across the whole stack trying to get a few basic apps up and running. I have the AMD RX480 GPU which supports GCN 8.0.1 instruction set and has the code name "polaris10". At the time of writing, both Linux kernel and the Mesa…
Introduction Disclaimer: I have not yet fully read the specs on SPIR-V or Vulkan. I decided to find out how hard it is to crash code working with SPIR-V. Initially I wanted to crash the actual GPU drivers but for a start I decided to experiment with GLSLang. What I got I used the "afl-fuzz" fuzzer to generate test cases that could crash the parser. I have briefly examined the generated cases. I…
Introduction. In this blog post I mainly want to summarize my latest experiments at using clang's static analyzer and some thoughts on what could be further done at the analyzer, and open-source software quality in general. It's mostly some notes I've decided to put up. Here are the references to the people involved in developing clang static analyzer at Apple. I recommend following them on…
Recently I've been reading several interesting posts on hacking Windows OpenGL drivers to exploit the " GL_ARB_get_program_binary" extension to access raw GPU instructions. "Hacking GCN via OpenGL" by Tomasz Stachowiak ( @h3r2tic ) - Presentation on OneDrive " You Compiled This, Driver. Trust Me…." about hacking Intel Haswell GPU - The blog by Joshua Barczak @JoshuaBarczak Reverse engineering is…
The problem. Another tale from the endless firmware endeavours. The other day I ended up in a weird situation. I was locked in a room with three firmwares - one of them was built by myself from source, while the other two came in binary form from the vendor. Naturally the one I built was not fully working, and one of the binaries worked fine. So I set out on a quest to trace all PCI MMIO accesses.…
So lately I've been working on porting a large-sized application from a well-known RTOS to a custom kernel. The RTOS is VxWorks and the application is a router firmware. Unfortunately I will not be able to share any code of the porting layer. I'll just briefly go over the problems I've endeavoured and some thoughts I have come up with in the process. The VxWorks compiler (called "diab") is like…
So I have this task of porting a huge piece of software running on a proprietary OS to another OS. And I don't even have a clue how to compile it (well I do but it builds on windows so it's almost irrelevant). But luckily all code is linked into a single ELF file and the compilation produces intermediate object files. The first thought I had was to visualize the dependency graph of object files to…
One useful technique for maintaining software quality is code coverage. While routinely used by high-level developers it is completely forgotten by many C hackers, especially when it comes to kernel. In fact, Linux is the only kernel which supports being compiled with the GCOV coverage tool. GCOV works by instrumenting your code. It inserts some code to increment the stats counters around each…
At work I had several occasions when I needed to hook a function on a Linux system. I will not go deep into technical details but the examples provided in the links contain the code which can be easily plugged into a project. A simple case. First let us consider a case when we only need to replace a function in our application without replacing it in dynamic libraries loaded by the application. In…
This year I got a chance to participate in the Google Summer of Code with the FreeBSD project. I have long wanted to learn about the FreeBSD kernel internals and port it to some ARM board but was getting sidetracked whenever I tried to do it. So it looked like a perfect chance to stop procrastinating. Feel free to scroll down to the "other stuff" paragraph if you don't feel like reading thre…
I communicate with a lot of people on the internet and they have various opinions on FOSS ranging from "only proprietary software written by a renowned company can deliver quality" to "if you're using binary blobs, you're a dick". Since these issues arise very often in discussions, I think I need to write it up so I can just shove the link next time. On the one hand, I am a strong proponent of…
I've been quite busy with work and university recently so I did not have much time to work on my projects or write rants, so I decided to roll out a short post discussing several unrelated ideas. On deprecating Linux (not really) Recently several Russian IT bloggers have been writing down their ideas about what's broken with Linux and how it should be improved. Basically, one guy started by saying…
I've always wanted to try writing a toy compiler, but have not made myself actually learn the theory of parsing (I plan to do it and post some notes into the blog soon though). However, recently I've been playing with Clang and LLVM. I've not yet used it for compiling, but I want to share my experience of using and extending Clang's error detection tools. LLVM is a specification of…
Two weeks ago I have taken some time to look at the XNU port to the ARM architecture done by the developer who goes by the handle "winocm". Today I've decided to summarize my experience. Here is a brief checklist if you want to start porting XNU to your board: Start from reading Wiki https://github.com/darwin-on-arm/wiki/wiki/Building-a-bootable-system Clone the DeviceTrees repository:…
Look, to some extent I like Mac OS X. It's a UNIX, it has some software (though, very little compared to linux). I like the objective-c language, and developing for iOS is a huge buzz with high salaries. Oh, and it has DTrace. Other than that I don't really have a reason to like it. Some things about this OS are undocumented and badly broken. Take file system management for example. Tonight I…
Hi! In this post I'll summarize the steps I needed to do in order to get KVM working on the OMAP5 ARM board using the virtualization extensions. ARM A15 HYP mode. In Cortex-A15, ARM have introduced a new operating mode called HYP (hypervisor). It has lower permissions than TruztZone. In fact, HYP splits the "insecure" world into two parts, one for hypervisor and the other one for the guests. By…
After playing with the HID interface in OS X, I have found out there exists an API for simulating input events from user space, so I've implemented the touchscreen driver using it. One unexpected caveat was that you need to set up an increasing event number to be able to click the menu bar. Even worse, when launched from XCode, the app would hang if you clicked the XCode menu bar. If you click any…
Hi there! I happen to have a Dell S2340T multitouch monitor (quite an expensive toy btw) which has a touch controller from 3M. It works fine in Windows (which I don't have any plans to use), sort of works in linux (which is my primary work environment) and does not work at all in OS X (not a big deal but it would be cool to have it). So I set out on the search for a driver and have figured out the…
Introduction. I have a laptop with so-called hybrid graphics. That is, it has two GPUs - one of them is part of the SoC (Intel HD3000 GPU), the other one is the "discrete" PCIe Radeon HD 6630M from AMD. Typicaly, older models of dual-GPU laptops (and new Apple Macbook Pro machines) have a multiplexer that switches the output from the GPU to display. As the majority of modern laptops, my features a…