CPE/ECE Credits: 40

Course Description
This course will teach students how to analyze, reverse, debug, and exploit embedded RTOS firmware. Hands-on experience with a variety of real-world devices, RTOS’s, and architectures equip students with the practical knowledge and skills necessary to be proficient in RTOS vulnerability analysis and exploitation.

Prerequisites
Due to the nature of the material, we do expect students to already have experience with:

• basic overflows and ROP
• be comfortable in IDA’s user interface
• some prior knowledge of MIPS and ARM (a plus, but not required)

This course is a natural progression for students already familiar with embedded Linux/firmware exploitation. If you attended IoT Firmware Exploitation, then you meet the criteria!

Course Length
5 days

Day 1
Basic introduction to the concept of Real Time Operating Systems
Overview of MIPS architecture and design
Firmware analysis of our first target device
Debugging our first target device
Augmenting IDA’s auto analysis
Searching for backdoors

Day 2
Searching for stack overflows
Exploiting RTOS overflows
How not to crash your target
Practical exploitation of LAN services from the WAN

Day 3
Hardware & firmware analysis
Identifying functions without a symbol table
Debugging without a debugger
Searching for stack overflows
Writing stack overflows with limited debugging
Write stack overflow exploits for our second target device

Day 4
Parsing bugs
Dynamic call path identification
Complex ROP chains
Re-programming RTOS kernel code on-the-fly
Low-hanging crypto
Breaking custom crypto
Finding WPS crypto bugs
Practical exploitation of WPS crypto bugs

Day 5
More firmware analysis
Augmenting IDA’s auto analysis
V-Chip backdoors
Hidden manufacturer menus

Instructor Bio
Craig Heffner is a Vulnerability Researcher and has 15 years experience analyzing embedded systems – 10 actually paid while 5 were just “exploring” on his own. He’s also the creator of binwalk, and he operates the /dev/ttyS0 blog which is dedicated to firmware hacking topics. He has presented at events including Blackhat and DEFCON. His skin has never been exposed to sunlight and is bioluminescent at 200 meters (656 feet) below sea level.

Private, on-site training is available. Call +1 (443) 276–6990 or email us at sales@tacnetsol.com.