After 4 years, ARMX is changing its call sign. EMUX now features both ARM and MIPS device emulation, in a unified framework! Join us as we unveil EMUX and take you into the inner workings of emulating both ARM and MIPS IoT devices. We will be releasing a new Docker image featuring a MIPS CTF challenge to test your MIPS exploit development skills. Slides from my workshop at Ringzer0's December 2021 Workshop Advent Calendar.

1. @therealsaumil
@_ringzer0
UNVEILING
SAUMIL SHAH
@therealsaumil
ringzerø
DEC2021 workshops

2. @therealsaumil
@_ringzer0
# WHO AM I
Saumil Shah
@therealsaumil
educating, entertaining
and exasperating
audiences since 1999

3. @therealsaumil
@_ringzer0
ARMX is now
ARM + MIPS
emux.exploitlab.net

4. @therealsaumil
@_ringzer0
Case Study: Trivision NC218

5. @therealsaumil
@_ringzer0
compressed FS
CPU
Kernel
Boot Loader
mounted
FS
nvram
init
scripts
Services
Apps
libnvram
The IoT Boot Up Process
conf
conf
conf
conf
firmware
Loads Kernel.
Uncompresses FS to ramdisk,
invokes init process.
ramdisk
userland
Reads config from nvram.
Builds system config files on
the fly.
Starts up system services.
Invokes Applications and
Application services.
READY
POWER ON

6. @therealsaumil
@_ringzer0
Extracting Firmware
Firmware
.bin file
from
Web/FTP
UART
Serial
Console
Direct
from
Flash
memory

7. @therealsaumil
@_ringzer0
1: Web/FTP site

8. @therealsaumil
@_ringzer0
2: Hidden UART interfaces

9. @therealsaumil
@_ringzer0
3: Take it directly from the chip!

10. @therealsaumil
@_ringzer0
SPI Flash Memory
/CS
DO
/WP
GND
VCC
/HOLD
CLK
DI
1
2
3
4
8
7
6
5

11. @therealsaumil
@_ringzer0
Tigard ß à SPI Flash
/CS
DO
/WP
GND
VCC
/HOLD
CLK
DI
1
2
3
4
8
7
6
5
Tigard SPI Tigard SPI
CS /CS VTGT VCC
CIPO DO /HOLD
/WP SCK CLK
GND GND COPI DI

12. @therealsaumil
@_ringzer0
SPI Flash from an
IP Camera
Breakout Board for Testing à

13. @therealsaumil
@_ringzer0
init scripts
QEMU
CPU and
Limited
Hardware
Kernel
Drivers
uncompressed
Filesystem
emulated
nvram
Services
Apps
libnvram
Emulating Firmware
x
x
x
x
BUILDROOT
Match the kernel with the
one on the device
chroot environment
Implemented as an INI file,
preloaded before "boot up"
conf
conf
Fix to match QEMU environment
Not all drivers load successfully

14. @therealsaumil
@_ringzer0
IPCam Firmware Image
CramFS
root file system
gzipped data
kernel
tar archive
131244 0x200AC
148508 0x2441C
1520204 0x17324C
8323080 0x7F0008
8MB
0
Compile a matching
kernel for QEMU
Extract rootfs using
cramfsck utilities
configuration
sys.conf
umconfig.conf

15. @therealsaumil
@_ringzer0
EMUX docker container

16. @therealsaumil
@_ringzer0
EMUX directory layout

17. @therealsaumil
@_ringzer0
EYOD

18. @therealsaumil
@_ringzer0
Starting an EMUX device

19. @therealsaumil
@_ringzer0
HERE BE THE GOODS
https://github.com/therealsaumil/emux
!
Announcements: @therealsaumil

20. @therealsaumil
@_ringzer0
THANK YOU
SAUMIL SHAH
@therealsaumil
ringzerø
DEC2021 workshops