Virtual Lab: Bare-metal Reverse Engineering & Hardware Hacking - Thomas Roth & Dmitry Nedospasov
Part 1: Bare-metal reverse engineering with Ghidra
After a brief introduction to bare-metal code and the ARM Cortex-M architecture we jump right into reverse-engineering ARM firmware. First, we analyze some simple crackmes, look at some useful scripts and tools and learn some tricks to efficiently navigate firmware. Next, we’ll analyze the actual BootROM of a popular series of microcontroller and identify an attack vector for a low-level hardware attack. Participants are welcome to ask questions and encouraged to follow along. Please join the HITB #virtuallab channel on Slack
Part 2: Glitching for fun and profit
After Identifying the potential vulnerability in Ghidra, we will now devise a strategy to exploit this vulnerability in the underlying hardware. This will include, preparing the ARM microcontroller for the attack, wiring up the circuit to induce the fault and programming an FPGA to control the system boot and perform the attack in real time. And, instead of just showing slides on how such an attack could be performed, we will solder it live, running through all the issues together and answering questions as we go along.
https://www.youtube.com/watch?v=VNzKVOsn5qQ&t=30621