MIDNIGHT POSTS ON HACKING HARDWARE, FPGAS, FIRMWARE, AND OS KERNELS
Disclaimer: it s a 3.9 MB Linux kernel ; ) N.b. whilst I will try to explain concepts to those new to this field, this blog assumes a lot of fundamental knowledge on FPGAs, RTL development, Vivado, Petalinux, SOC/CPU architecture, memory managers, memory hardware, SPI NOR flash memory, reset vectors, multi-stage bootloaders, kernel device trees, and Continue reading Building A Bare-Bones 3 MB…
This is the circuit diagram we will create. Video below. 7-segment display Each segment is an LED, and collectively they can represent all single numerical digits. For convenience each segment is assigned a letter from a to g. E.g. to display the digit 1 , we would enable segment b and c. Truth table To represent Continue reading Binary to 7-segment decoder circuit
In this blogpost @astralvx will describe the physical hardware attack to capture a Bitlocker key in transit across the SPI bus. All information here is in the public domain in one form or another and not proprietary. We shall discuss the details of Bitlocker, boot flow from pre-boot to OS, an introduction to TPM 2.0 Continue reading Stealing the Bitlocker key from a TPM
In this blogpost @astralvx will introduce Peripheral Component Interconnect Express (PCIe), a standard for connecting high-speed component to PC s such as video cards, network cards, raid controllers, NVME SSDs, WIFI cards, etc. From PCI 1.0 introduced in the 90 s at speeds of 130 MB/s, the bandwidth has been doubling every three years. Next came PCI Continue reading Introduction to PCIe
When writing assembly in Real Mode as 16 bit, all posts online (stackoverflow, etc) all talk from the perspective of developing on Linux. However in this blogpost we ll go through how easy it is to adapt these techniques to work from a Windows host, and get Cygwin GDB to understand segments, break at segment offsets, Continue reading Debugging 16-bit in QEMU with GDB on Windows
Many of you may have used PCIe Screamer by LambdaConcept and variants with firmware by U. Frisk, for all sorts of activities from physical pentests, bypassing antiviruses, bypass anticheat products in games, and so on. In this blogpost @astralvx will explain the PCIe packet TLP used in bus mastering/DMA. Introduction Direct Memory Access (DMA) is Continue reading DMA explained
By @AstralVx. The badge for 2020 was a cassette, but the challenges were split over 3 items the cassette badge (sides A and B), the lanyard, and the liner (front and back) as seen in the images below. In summary the challenges consisted of ciphers from rot n, Vignere, one time pads, alphabetic index, Continue reading DEF CON 28 Badge Challenges
Introduction Windows does not make it easy to do digital signature checks from a kernel driver. All the documented and easy to use wintrust.h APIs only reside in usermode, so you re left to fend for your self. The 1st option is to use OpenSSL but if you build a driver targeting 1903+, the WHQL process Continue reading Authenticode certificates and checks from a KM driver
In this blogpost I’m going to talk about how the PNP Manager is able to discover devices and install/run the appropriate drivers from INF files. Some terminology: Physical Device Object (PDO) the bus driver uses it to represent the connection between the device and the bus Function Device Object (FDO) the function driver Continue reading PNP Manager device enumeration
Recently I ve had to do some access checks on FILE_OBJECTs from a kernel driver (but not from the perspective of the current user). I couldn t just pass the data to a usermode component as it would introduce delays in the I/O path especially for network files and I m not operating against current user per-se. It Continue reading Access checks from the kernel