A family of processor architectures used in many embedded applications, network and other appliances, and almost all smartphones.
0
votes
0answers
39 views
Get matching disassembly for ARM ROP exploit examples
So I am trying to do some testing for class on Raspberry Pi (Debian Wheezy) to reproduce ARM exploits such as:
...
2
votes
1answer
111 views
Loading code securely in the Trusted Execution Environment (ARM)
I am reading up on TEE in ARM. I am looking for pointers for the following questions:
How does the TEE load code from the OS securely and guarantee that its not malicious code?
I am guessing the ...
27
votes
4answers
4k views
A tiny version of wget (51 bytes?)
On this ISC article on DVR compromise the author talks about the compromise of an embedded system. In particular, the attacker executes a series of echo commands on the remote host, and:
This DVR ...
0
votes
0answers
80 views
ARM Trust ZONE with Normal and Secure World
I am new to Security testing and I am working on 64bit ARM server.
We are using ARM TrustZone technology.
Is it possible for me to check If i am in Secure world or Normal world.
How do I test the ...
3
votes
2answers
355 views
Does the ARM TrustZone technology support sealing a private key under a code hash?
One of the extremely valuable functions of a Trusted Platform Module (TPM) chip is its ability to seal a private key under the hash of the code that will use it. This means that one can create a ...
3
votes
1answer
167 views
What are security implications of enabling access to performance counters on ARM Cortex A9?
On an ARM Cortex A9 core, privileged instructions have to be executed so that unprivileged code can use performance counters. For instance with this GCC inline code, which would have to be run in a ...
5
votes
1answer
581 views
ROP Exploitation on ARM
I was wondering about since, Ret2Libc attack doesn't works on ARM, and we have to rely on ROP for that. How different is ROP on ARM from the x86 architecture.
Are there any tools, such as mona.py ...
2
votes
3answers
1k views
Stack Overflow on ARM : Null Bytes Issue
I am trying to follow the research paper by Tiger Security for ARM Exploitation : Link
For the simple stack overflow exploitation, the code is :
#include <stdio.h>
#include <string.h>
...
5
votes
1answer
322 views
Hardware enforced DEP on different CPUs
Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)?
Are there any significant differences how hardware DEP works on x86 ...
