Hardware Hacking and Exploitation Bootcamp

VoidStar Security LLC

This course will help bootstrap security researchers and students of all experience levels in the field of hardware reverse engineering.

<h2>Description</h2><p>This five day course is designed to teach the fundamentals of hardware reverse engineering and exploitation. </p><p>Students learn how interfaces such as <a href="https://wrongbaud.github.io/posts/BasicFUN-flashing/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">SPI</a>, <a href="https://wrongbaud.github.io/posts/Holiday-Teardown/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">I2C</a>, <a href="https://wrongbaud.github.io/posts/jtag-hdd/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">JTAG</a>, <a href="https://wrongbaud.github.io/posts/stm-xbox-jtag/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">SWD  </a>work while developing tools to hack and attack these protocols. </p><p>Through the labs and exercises, students will learn how to extract firmware, utilize and access hardware debuggers using JTAG and SWD mechanisms, and write their own hardware hacking tools. All hardware is provided for this course and is kept by the students at the end of the course. </p><p>Labs include:</p><ul><li>Extracting router firmware</li><li>Enabling console access through firmware modifications</li><li>Performing JTAG/SWD debugging on ARM/MIPS based targets.</li><li>Modifying Xbox Controller firmware through hardware level debuggers.  </li></ul><h2>Course Goals</h2><p>After participating in this course, students will have experience with:</p><ul><li>Non-Invasive hardware analysis (component identification, etc)</li><li>Tracing and identifying points of interest on PCBs</li><li>Extracting firmware over multiple interfaces</li><li>Unpacking / analyzing binary blobs</li><li>Attacking hardware debuggers (JTAG,ETC)</li><li>Modifying, repacking and reflashing firmware</li></ul><p>Students will also learn how to augment existing tools to work around problems that may arise when extracting firmware! Throughout the laboratory exercises students will learn how to<a href="https://wrongbaud.github.io/posts/router-teardown/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer"> extract SPI/I2C based flash chips</a>, discover and gain access to consoles using UART, and identify, enumerate and actuate <a href="https://wrongbaud.github.io/posts/stm-xbox-jtag/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">hardware level debuggers such as JTAG and SWD</a></p><h2>Provided Materials</h2><p>Students will receive a kit including all necessary components to complete the course, the kit includes:</p><ul><li>1 x Raspberry Pi 4 (preloaded with all necessary software and materials)</li><li>1 x Travel Router (Target 1)</li><li>1 x Game Cabinet (Target 2) </li><li>1 x Game Console Controller (Target 3)</li><li>1 x SSD</li><li>1 x Breadboard </li><li>1 x Multimeter</li><li>1 x Logic Analyzer</li><li>1 x Jumper Wire Kit</li><li>1 x SPI Flash Clip and Probes</li><li>1 x SPI Flash IC for exercises</li><li>1 x I2C Flash IC for exercises</li></ul><h2>Prerequisites</h2><p>This course is targeted towards security researchers who want to learn more about the process of firmware extraction and embedded systems analysis. </p><p>Students should be familiar with the Linux command line, and be comfortable with a scripting language such as python. C experience is also useful but not required!</p><p>Due to shipping complications due to COVID19, hardware kits will only be shipped to US residents. If you wish to take the course and want to purchase the target hardware yourself, reach out to contact@voidstarsec.com</p><h2>Course Structure</h2><p>This course includes multiple modules, one for each protocol of interest. For each module, we will perform the following:</p><ul><li>Protocol Overview and Analysis</li><li>Understanding and Reviewing Captured Protocol Traffic</li><li>Protocol Analysis from a Reverse Engineering Perspective</li><li>Tools for Reverse Engineering Specific Protocols</li><li>Practical Attacks and Applications on Provided Targets</li></ul><p></p><p>After each protocol module, a target analysis will be performed to reinforce what was learned in the analysis segment. There are four targets that are used throughout the course that are all represented by the modules shown below. For each target, a specific set of goals are presented, and additional goals are also provided for those who may be more experienced.</p><h2>Course Outline</h2><h3>Hardware Hacking Intro and Overview</h3><ul><li>Embedded Electronics 101</li><li>How Printed Circuit Boards are made</li><li>Analyzing PCBs</li><li>Identifying Components of Interest</li></ul><h3>Tools of the Trade</h3><ul><li>Multimeter Labs</li><li>Measuring voltage and resistance</li><li>Testing for continuity</li><li>Logic Analyzer Labs</li><li>Analyzing Example Captures</li><li>Applying and Writing Signal Decoders</li></ul><h3>Protocol Session: UART</h3><ul><li>Protocol Overview</li><li>UART for Reverse Engineers</li><li>Identifying UART Signals</li></ul><h3>UART Labs</h3><ul><li>Identify and Analyze UART Signals</li><li>Calculate Proper UART Settings</li><li>Gain Shell Access to Target via UART</li></ul><h3>UBoot Labs</h3><ul><li>Review Linux boot sequence</li><li>Understand how UBoot is used in practice</li><li>Examine common misconfigurations / vulnerabilities in UBoot</li><li>Extend UBoot shell interactions with Python scripting</li></ul><h3>Protocol Session: SPI</h3><ul><li>Protocol Overview</li><li>SPI for Reverse Engineers</li><li>Identifying SPI Signals</li></ul><h3>SPI Labs</h3><ul><li>Analyze and Understanding SPI Traffic Captures</li><li>Reconstructing Firmware Images from SPI Traffic</li><li>Extracting SPI Flash</li><li>Reflashing SPI Flash</li></ul><h3>Firmware Image Analysis</h3><ul><li>Finding Data of Interest</li><li>Extracting Filesystems</li><li>Repacking and Modifying Firmware</li></ul><h3>Target Analysis Lab 1: Root and Route</h3><ul><li>Unpack firmware image extracted from target</li><li>Analyze extracted image to find data of interest</li><li>Modify image to allow for more privileged access</li><li>Reflash to target for increased access</li></ul><h3>Protocol Session: I2C</h3><ul><li>Protocol Overview</li><li>I2C for Reverse Engineers</li><li>Identifying I2CSignals</li></ul><h3>I2C Labs</h3><ul><li>Enumerating Unknown I2C Devices</li><li>Analyzing I2C Signals / Reconstructing Traffic</li><li>Extracting I2C Flash</li><li>Reflashing I2C Flash Devices</li></ul><h3>Target Analysis Lab 2: Where in the World is my Flash Data?</h3><ul><li>Extract all data from relevant flash devices</li><li>Analyze images to look for data of interest</li><li>Reflash devices, demonstrating that data of interest has been found</li></ul><h3>Protocol Session: Serial Wire Debug</h3><ul><li>SWD Overview</li><li>SWD for Reverse Engineers</li><li>Interfacing with SWD via OpenOCD</li></ul><h3>SWD Labs</h3><ul><li>OpenOCD Usage and Overview</li><li>GDB and SWD</li><li>Extracting Memory with SWD</li></ul><h3>Target Analysis Lab 3:  Controlling a Controller</h3><ul><li>Identify Hardware Level Debug interface</li><li>Use OpenOCD to gain debug access</li><li>Extract firmware via hardware debugger</li><li>Analyze firmware</li><li>Reflash firmware, showing that you have modified it</li></ul><h3>Protocol Session: JTAG</h3><ul><li>JTAG Overview</li><li>JTAG  for Reverse Engineers</li><li> Identifying and Discovering JTAG Ports</li></ul><h3>JTAG Labs</h3><ul><li>Enumerate JTAG scan chain</li><li>Identifying JTAG registers</li><li>GDB via JTAG</li><li>Extracting memory via JTAG</li></ul><h3>Target Analysis Lab 4:  SSDs and GDB</h3><ul><li>Identify Hardware Level Debug interface</li><li>Use OpenOCD to gain debug access</li><li>Extract RAM via hardware debugger</li><li>Use GDB to set breakpoints and demonstrate control over the target device</li></ul><h2>Instructor Bio</h2><p><a href="https://www.linkedin.com/in/matthew-t-alt/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Matthew Alt </a>is a reverse engineer with a focus on embedded systems. He began his career in the automotive performance industry, searching for vulnerabilities in engine control units and diagnostic implementations. After that, he worked at MIT Lincoln Laboratory in the Cyber Systems Assessment Group as a team lead on a program that focused on embedded systems exploitation and reverse engineering. He currently works as a security consultant for various customers in the realm of embedded and IoT systems. Matthew also generates regular <a href="https://wrongbaud.github.io/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">content on his website</a>, with a focus on teaching the low level fundamentals of hardware reverse engineering. </p><p>Past public courses that Matthew has taught include <a href="https://hackaday.io/project/172292-introduction-to-reverse-engineering-with-ghidra" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Hackaday’s Introduction to Reverse Engineering Software with Ghidra</a>, the recorded versions of these courses can be found on <a href="https://www.youtube.com/watch?list=PL_tws4AXg7auglkFo6ZRoWGXnWL0FHAEi&amp;v=d4Pgi5XML8E" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">YouTube</a>. </p><h2>Course Feedback</h2><p>&quot;Love the course. I really went in with low knowledge and solidly learned something.&quot;</p><p>&quot;Instructor was really good and knowledgeable - didn&#x27;t want the class to end so quickly!&quot; </p><p></p><p>&quot;I just used the skills you  taught at the hardware hacking lesson to un-brick old ubiquity edge router.  Thank you for that!&quot;</p><p>“I have not had that sense of learning and challenge in quite a long time.”</p><p></p><p>“The course was very helpful. I am looking forward to expanding on these skills for IoT devices. The pace of the course made it easier as a software developer with software RE experience to learn.”</p><h2>QUESTIONS</h2><p>Please reach out to contact@voidstarsec.com with questions or inquiries regarding this course!</p>

Our {communityGuidelinesLink} describe the sort of content we prohibit on Eventbrite. If you suspect an event may be in violation, you can report it to us so we can investigate.

To report other categories of prohibited or illegal content, submit {link}

Hardware Hacking and Exploitation Bootcamp

More events from VoidStar Security LLC

Discover more events from VoidStar Security LLC, from Science & Tech to other experiences you might love.

Still looking for the right event?

Explore all online events to browse and filter by date, category, and more.

Hardware Hacking and Exploitation Bootcamp

More events from VoidStar Security LLC

Discover more events from VoidStar Security LLC, from Science & Tech to other experiences you might love.

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.

Still looking for the right event?

Explore all online events to browse and filter by date, category, and more.