Daniel Sokil s0kil

Integrating purple-yolk With IHP

In your IHP project directory, create a file named .ghci-purple-yolk and copy the contents of the .ghci file
Add :l Main.hs to the end of the .ghci-purple-yolk file

.ghci-purple-yolk should look something like:

:set -XNoImplicitPrelude
:def source readFile

The list below is compiled to inform, guide, and inspire budding security researchers. Oh and to pick something for bedtime reading too.

Included in the list are works on the following topics related to MCU/SoC security:

Secure boot
Fault injection
Side channel attacks

At the end of the list, there is also a section with links to articles of potential general interest, not addressing vulnerabilities in any specific device.

Bitcoind Ubuntu Setup

N. P. O'Donnell, 2021

Getting Bitcoind

ARCH=x86_64
BITCOIN_VERSION=0.21.0
wget https://bitcoin.org/bin/bitcoin-core-$BITCOIN_VERSION/bitcoin-$BITCOIN_VERSION-$ARCH-linux-gnu.tar.gz

Zynq BootROM Secrets: Exposing the bootROM with the UART loader

Last time I wrote about this, I lied a little - There is an interesting bug in the UART loader, and it may have been exactly why Xilinx didn't document it. In short: The UART loader writes the entire UART payload to a location in memory (nominally 0x4_0000). The ROM is architected such that when the boot mode is selected, it registers a callback that is called when the ROM wants more data from the boot device. For the UART loader, this is pretty simple - here's the whole thing:

; void uart_callback(u32 r0_offset, void* r1_dest, i32 r2_nbytes)
ROM:0000A578 PUSH            {R3,LR}
ROM:0000A57C MOV             R3, #uart_buff
ROM:0000A584 MOV             R12, #1
ROM:0000A588 LDR             R3, [R3]

Learn Go in ~5mins

This is inspired by A half-hour to learn Rust and Zig in 30 minutes.

Basics

Your first Go program as a classical "Hello World" is pretty simple:

First we create a workspace for our project:

A half-hour to learn Zig

This is inspired by https://fasterthanli.me/blog/2020/a-half-hour-to-learn-rust/

Basics

the command zig run my_code.zig will compile and immediately run your Zig program. Each of these cells contains a zig program that you can try to run (some of them contain compile-time errors that you can comment out to play with)

	# Decompile
	dtc -I dtb -O dts -o devicetree.dts /boot/dtb/<your_devicetree_file_name>.dtb

	# Compile
	dtc -I dts -O dtb devicetree.dts -o <your_devicetree_file_name>.dtb

	# Merge with DTBO
	fdtoverlay -i modified-base.dtb -o modified-full.dtb /boot/tegra194-p3668-all-p3509-0000-user-custom.dtbo

	# DTS from fs

	#!/usr/bin/env python
	import sys

	from colors import *

	from unicorn import *
	from unicorn.arm_const import *

	from capstone import Cs, CS_ARCH_ARM, CS_MODE_ARM, CsError

	import base64
	from Crypto.Cipher import AES
	from Crypto.Util.Padding import pad,unpad

	#AES ECB mode without IV

	data = 'I love Medium'
	key = 'AAAAAAAAAAAAAAAA' #Must Be 16 char for AES128

	def encrypt(raw):

	require 'capybara/apparition'

	Capybara.server = :puma, { Silent: true }

	Capybara.register_driver :chrome_headless do \|app\|
	Capybara::Apparition::Driver.new(app, { headless: true, browser_options: { 'headless': '', 'no-sandbox': '' } })
	end

	Capybara.register_driver :chrome do \|app\|
	options = Selenium::WebDriver::Chrome::Options.new(args: %w[no-sandbox])