Information Technology & Cybersecurity

In this post I will keep on adding the best references for the stuffs related to Linux Kernel like powerful tools and utilities, memory related stuffs, vulnerabilities & hacks, process, kernel internals etc. 1. How to translate the virtual into physical address through /proc/pid/pagemap http://fivelinesofcode.blogspot.com/2014/03/how-to-translate-virtual-to-physical.html This I tried, but I am not sure if the physical address that has been read from the pagemap is proven. I was getting a 64-Bit long address. 2. Understanding how insmod works http://gomathikumar1006.blogspot.com/2013/09/linux-kernel-module-internals-of-insmod.html

In this write up, we will focus mainly on the ARMv8-A exceptions, the role of ARM Trusted Firmware (that provides Secure Monitor functionality) and how the World Switch happens between Secure and Normal. If we look on the the architectural diagram of ARM Trustzone w.r.t ARMv8-A, the Execution Level is divided into four levels namely: EL0 (Secure & Non-Secure) - User Application EL1 (Secure & Non-Secure) - Kernel EL2 - Hypervisor for running different OS's simuntaneously EL3 - Security Monitor Now, whenever a normal world User Application calls for some Secure Operation, the calls goes via IOCTL call to the Linux Driver, which ultimately calls the smc instruction. To understand what the smc instruction, we have to look on the Exceptions in ARMv8 ARMv8 Exceptions In ARMv8 the exceptions are divided into two categories: Synchronous & Asynchronous.  An exception is described as synchronous if it is generated as a result of execution or attempted executi...

The scope of this documentation is to understand the Memory Management Unit for ARMv8 Based processor. Memory management Unit converts the virtual Address (in CPU's logical space) into Physical Address. For an example let us suppose in the following program: int variable; printf("Addrss of variable = 0x%x\n", &variable); The address could be anything (Let's assume  0x40000200 ). Now 0x40000200 may or may not the actual memory address in the Physical Memory (RAM). It could be anything thing (lets assume  0xA0000200 ). Thus the CPU produce the logical address 0x40000200 which is converted into the physical address 0xA0000200 by the Memory Management Unit. Now the question remains Why we require an Address Translation, or in other word in the above program why we don't operate on actual physical memory 0xA0000200? Let us suppose a program that requires a huge amount of contagious memory in the RAM. Now our external memory would have that much memory requ...

What if you write some piece of code that consist of VULNERABILITIES , that could lead to undesirable behavior of the flow of execution, if exploited by the hacker. One of the most common attack or exploit that is used today is a Stack Overflow type attack. Stack Overflow is an undesirable situation when the program tends to use more memory space then the call stack available. If we take a simple C program, that copies the memory from source to destination using memcpy function: #define STRING "I LOVE HACKING" char buffer[10]; memcpy(buffer, STRING, strlen(STRING)); In the above program, the actual size of buffer is 10, while memcpy will tend to copy 14 bytes of data to buffer. This will lead to overwrite some stack area that don't belong to the  buffer . In simple word, this is a vulnerability in the program, that can be exploited and which might lead to change the actual behavior of the program. Now let's see how the stacks are organized in an actual p...

In this post I have discussed about, how I set my ARM reverse engineering platform in Yocto Qemu. Generally when we are talking about reverse engineering then we need a target platform where we could exercise our experiments. We Can choose Raspberry pi, Beagle Bone etc. for these kind of experimentation. But what we can do in these platforms, can also be performed in some virtual environments. Only for experimenting on some kind of side channel attacks, we would need the actual hardware. For making the setup, you would need some PC with very good configuration likely atleast 4 GB of RAM, 100 GB of free space, and with atleast Quad Core Processor. I have installed VMWare (non-commercial version) which is running Ubuntu 18.04. If you have ubuntu installed in your PC itself then it is well and good. I have followed this link to install Ubuntu. The following steps would help: 1. First clone the source code of Yocto. You might also require some dependencies to get it installed: $ c...

In continuation to my previous experiment , this experiment is all about hacking into an ELF binary file. Means we will change the characteristics of and ELF file by reverse engineering its assembly instructions. For this experiment I have choose AARCH64 binary which is suppose to run in an 64 bit ARM machine. Here I have used these utilities: readelf / aarch64-linux-gnu-readelf aarch64-linux-gnu-objdump - Used to dump all the assembly instructions in a binary xxd (which I feel one of most power free weapon of reverse engineering). NOTE that the toolchain I have installed while building the raspberry secure images . To understand the reverse engineering, one should atleast know the forward engineering that means the basis conditional statements (if, else) and loop statements (for / while). I've demonstrate a program which takes input string (key), compare it with some hard-coded one and accordingly execute the access condition. This is something like an decade ol...

During my journey towards the reverse engineering of boot binary, I tried a lot of way to disassemble a boot binary. Generally  hackers use tools like IDA pro. But this tools comes with a cost ( IDA pro costs 1000 Dollar for single user license ). Freeware version of IDA pro is available (for non-commercial use only), but this comes with limited disassembler functionality (like ARMv7 & ARMv8 not supported). A lot of open sourced tools like Ghidra (from NSA) is present, but it has very much limited functionality. So, I finally decided to disassemble a flat binary from my own (may be using GNU). But it is not a straight forward task. When we build a boot binary (let say OPTEE or bootloader or ATF), at first a Executable & Linkable File is created then using objcopy tool a flat binary file is finally produced which goes to the ROM. In the continued series of this post, we will crack from scratch what is the significance of ELF, its various sections, why ELF is not flashed...

Here we will experiment with Raspberry Pi  3 Model B+ board. I have built some image for it using OPTEE manifest. I am currently using Ubuntu 16.04 OS. I have faced some dependency issue while building the complete set of images. Hardware required: 1. Raspberry Pi 3 Model B+ 2. USB to serial cable (BaudRate = 115200) 3. Power Cable or MicroUSB cable (I have drawn power from my PC) 4. Micro SD card formatted in FAT32 format. Serial Cable Connection with PI Refer to this diagram. PIN 6, 8 & 9 shall be used. In my case I have drawn power from my PC, hence I didn't required any GND connection. How to Build images: Prerequisite: Following dependencies need to be installed.: $ sudo apt-get install android-tools-fastboot autoconf bison cscope curl  flex gdisk libc6:i386 libfdt-dev libglib2.0-dev  libpixman-1-dev libstdc++6:i386 libz1:i386 netcat  python-crypto python-serial uuid-dev xz-utils zlib1g-dev libssl-dev curl repo vim $ sudo apt install py...