10-18, 13:00–15:00 (America/New_York), Track 3 (205AB)
Language: English
Ever wanted to make a CPU says Hello world? Or figure how a driver to communicate with hardware? Or how to reverse engineer a bootloader? Then this workshop is for you.
The ultimate goal of this workshop is to make participants understand how they could emulate and debug binaries which runs directly on a CPU, without an underlying operating system. Good examples of such binaries are bootloaders and the kernel of the operating system itself.
To this end, this workshop propose the following:
- Install a cross compiler toolchain and compile the Qemu emulator from source code.
- Try code samples with our compiled Qemu
- Modify these samples to make them work on different machine types
- Solve CTF challenge with static and dynamic analysis of a more complex binary using Qemu's debugging capabilities.
Abstract:
Ever wanted to make a CPU says Hello world? Or figure how a driver to communicate with hardware? Or how to reverse engineer a bootloader? Then this workshop is for you.
The ultimate goal of this workshop is to make participants understand how they could emulate and debug binaries which runs directly on a CPU, without an underlying operating system. Good examples of such binaries are bootloaders and the kernel of the operating system itself.
Prerequisites:
This workshop is designed to run under a docker container. Therefore, the docker engine needs to be installed first. Please refer to official instructions to install docker on your operating system:
Then clone the workshop repository
Outline:
This workshop is divided into 4 exercises as follows:
Exercise 1
The objective is to test if the docker container and the software within it are functioning properly by running the emulator on a simple binary that should print "Hello world!"
Exercise 2
The objective is to modify the source code of exercise 1 to port it on a different emulated board and architecture.
Exercise 3
Understand the difference between Qemu 's options used to load code (-bios, -kernel and -
device,loader=...)
Trace the reset vector in Qemu, look it up in the source code
Learn how to set the cpu state so the program could run (c runtime)
Use reconnaissance techniques to locate the UART in the memory map
Exercise 4
CTF time!
Break the firmware encryption implemented by a mock bootloader and get the flag
Marc-andre Labonte was a system administrator for more than a decade at the McGill Genome Center while it was known as the McGill University and Genome Quebec Innovation Center.
Then, he joined the ETTIC team at Desjardins in 2016 as infrastructure penetration tester. Currently doing vulnerability research on IOT devices, he also presented "Automated contact tracing experiment on ESP Vroom32" workshop at NSEC in 2021. His work is motivated by curiosity and a strong sense of personal privacy.