ProHoster > Блог > Isakoso > Yiyipada ati gige Aigo ara-encrypting ita HDD drive. Apá 2: Gbigba idalenu lati Cypress PSoC

Yiyipada ati gige Aigo ara-encrypting ita HDD drive. Apá 2: Gbigba idalenu lati Cypress PSoC

Eyi ni apakan keji ati ikẹhin ti nkan naa nipa gige awọn awakọ fifi ẹnọ kọ nkan ti ita. Jẹ ki n ran ọ leti pe laipe kan ẹlẹgbẹ mi mu wara lile Patriot (Aigo) SK8671 wa fun mi, ati pe Mo pinnu lati yi pada, ati nisisiyi Mo n pin ohun ti o jade ninu rẹ. Ṣaaju kika siwaju, rii daju lati ka apakan akọkọ ìwé.

4. A bẹrẹ lati ya idalẹnu lati inu kọnputa filasi PSoC inu
5. Ilana ISSP
– 5.1. Kini ISSP
– 5.2. Demystifying Vectors
– 5.3. Ibaraẹnisọrọ pẹlu PSoC
– 5.4. Idanimọ ti awọn iforukọsilẹ lori-chip
– 5.5. Aabo die-die
6. First (kuna) kolu: ROMX
7. Keji Attack: Tutu Boot Tracing
– 7.1. imuse
– 7.2. Kika abajade
– 7.3. Flash alakomeji atunkọ
– 7.4. Wiwa adirẹsi ipamọ koodu PIN
– 7.5. Gbigba idalenu ti Àkọsílẹ No.. 126
– 7.6. PIN koodu imularada
8. Kini atẹle?
9. Ipari

Yiyipada ati gige Aigo ara-encrypting ita HDD drive. Apá 2: Gbigba idalenu lati Cypress PSoC


4. A bẹrẹ lati ya idalẹnu lati inu kọnputa filasi PSoC inu

Nitorinaa, ohun gbogbo tọka (bi a ti fi idi rẹ mulẹ ni [apakan akọkọ] ()) pe koodu PIN ti wa ni ipamọ ni awọn ijinle filasi ti PSoC. Nitorinaa, a nilo lati ka awọn ijinle filasi wọnyi. Iwaju ti iṣẹ pataki:

  • gba iṣakoso ti "ibaraẹnisọrọ" pẹlu microcontroller;
  • wa ọna lati ṣayẹwo boya “ibaraẹnisọrọ” yii ni aabo lati kika lati ita;
  • wa ọna lati fori aabo.

Awọn aaye meji lo wa nibiti o jẹ oye lati wa koodu PIN to wulo:

  • ti abẹnu filasi iranti;
  • SRAM, nibiti koodu PIN le wa ni ipamọ lati ṣe afiwe rẹ pẹlu koodu PIN ti olumulo tẹ sii.

Ni wiwa niwaju, Emi yoo ṣe akiyesi pe MO tun ṣakoso lati mu idalẹnu ti awakọ filasi PSoC ti inu - lilọja eto aabo rẹ nipa lilo ikọlu ohun elo kan ti a pe ni “iwapa bata bata” - lẹhin yiyipada awọn agbara ti ko ni iwe aṣẹ ti Ilana ISSP. Eyi gba mi laaye lati da koodu PIN gangan silẹ taara.

$ ./psoc.py 
syncing: KO OK
[...]
PIN: 1 2 3 4 5 6 7 8 9

Ipari koodu eto:

5. Ilana ISSP

5.1. Kini ISSP

"Ibaraẹnisọrọ" pẹlu microcontroller le tumọ si awọn ohun ti o yatọ: lati "olutaja si ataja" si ibaraenisepo nipa lilo ilana ilana tẹlentẹle (fun apẹẹrẹ, ICSP fun Microchip's PIC).

Cypress ni ilana ti ara rẹ fun eyi, ti a pe ni ISSP (ilana siseto serial in-system), eyiti o jẹ apejuwe ni apakan ninu imọ sipesifikesonu. Itọsi US7185162 tun fun diẹ ninu awọn alaye. O tun wa deede OpenSource ti a pe ni HSSP (a yoo lo diẹ diẹ). ISSP ṣiṣẹ bi atẹle:

  • atunbere PSoC;
  • jade nọmba idan si PIN data ni tẹlentẹle ti PSoC yii; lati tẹ ipo siseto ita;
  • fi ase, eyi ti o wa gun bit awọn gbolohun ọrọ a npe ni "vectors".

Awọn iwe ISSP n ṣalaye awọn ipasẹ wọnyi fun ọwọ kekere ti awọn aṣẹ:

  • Ibẹrẹ-1
  • Ibẹrẹ-2
  • Bibẹrẹ-3 (awọn aṣayan 3V ati 5V)
  • ID-SETUP
  • KA-ID-ỌRỌ
  • SET-BLOCK-NUM: 10011111010dddddddd111, nibiti dddddddd = idinamọ #
  • OLOPO NU
  • ETO-Àkọsílẹ
  • IDAJO-ETO
  • KA-BYTE: 10110aaaaaaZDDDDDDDDZ1, nibiti DDDDDDDD = data jade, aaaaa = adirẹsi (6 bits)
  • WRITE-BYTE: 10010aaaaaaddddddd111, nibiti dddddddd = data wa ninu, aaaaa = adirẹsi (6 bits)
  • NIPA
  • Ayẹwo-SETUP
  • KA-CHECKSUM: 10111111001ZDDDDDDDDZ110111111000ZDDDDDDDDZ1, nibiti DDDDDDDDDDDDDDDD = data jade: checksum ẹrọ
  • DÁJỌ NU

Fun apẹẹrẹ, fekito fun Initialize-2:

1101111011100000000111 1101111011000000000111
1001111100000111010111 1001111100100000011111
1101111010100000000111 1101111010000000011111
1001111101110000000111 1101111100100110000111
1101111101001000000111 1001111101000000001111
1101111000000000110111 1101111100000000000111
1101111111100010010111

Gbogbo fekito ni kanna ipari: 22 die-die. Awọn iwe HSSP ni diẹ ninu awọn alaye afikun lori ISSP: “Ohun ISSP fekito kii ṣe nkan diẹ sii ju lẹsẹsẹ diẹ ti o duro fun eto awọn ilana.”

5.2. Demystifying Vectors

Jẹ ká ro ero ohun ti n ṣẹlẹ nibi. Ni ibẹrẹ, Mo ro pe awọn adaṣe kanna jẹ awọn ẹya aise ti awọn ilana M8C, ṣugbọn lẹhin ti ṣayẹwo idawọle yii, Mo rii pe awọn opcodes ti awọn iṣẹ ṣiṣe ko baramu.

Nigbana ni mo googled awọn fekito loke ati ki o wa kọja eyi a iwadi ibi ti onkowe, biotilejepe o ko ni lọ sinu apejuwe awọn, yoo fun diẹ ninu awọn italolobo to wulo: "Kọọkan ilana bẹrẹ pẹlu mẹta die-die ti o badọgba si ọkan ninu awọn mẹrin mnemonics (ka lati Ramu, kọ to Ramu, ka Forukọsilẹ, Kọ Forukọsilẹ). Lẹhinna awọn die-die adirẹsi 8 wa, atẹle nipasẹ awọn die-die data 8 (ka tabi kọ) ati nikẹhin awọn die-die iduro mẹta.”

Lẹhinna Mo ni anfani lati ṣajọ diẹ ninu alaye ti o wulo pupọ lati apakan “Abojuto ROM (SROM)”. imọ Afowoyi. SROM jẹ ROM ti o ni koodu lile ni PSoC ti o pese awọn iṣẹ iwulo (ni ọna kanna si Syscall) fun koodu eto nṣiṣẹ ni aaye olumulo:

  • 00h: SWBootTunto
  • 01h: ReadBlock
  • 02h: WriteBlock
  • 03h: EraseBlock
  • 06h: TableRead
  • 07h: Ṣayẹwo Sum
  • 08h: Calibrate0
  • 09h: Calibrate1

Nipa ifiwera awọn orukọ fekito si awọn iṣẹ SROM, a le ṣe maapu ọpọlọpọ awọn iṣẹ ṣiṣe ti o ni atilẹyin nipasẹ ilana yii si awọn aye SROM ti a nireti. Ṣeun si eyi, a le ṣe iyipada awọn die-die mẹta akọkọ ti awọn olutọpa ISSP:

  • 100 => "wrem"
  • 101 => "rdmem"
  • 110 => "aṣiṣe"
  • 111 => "rdreg"

Sibẹsibẹ, oye pipe ti awọn ilana lori-chip le ṣee gba nipasẹ ibaraẹnisọrọ taara pẹlu PSoC.

5.3. Ibaraẹnisọrọ pẹlu PSoC

Niwon Dirk Petrautsky ti tẹlẹ ported Koodu HSSP ti Cypress lori Arduino, Mo lo Arduino Uno lati sopọ si asopo ISSP ti igbimọ keyboard.

Jọwọ ṣe akiyesi pe lakoko ṣiṣe iwadii mi, Mo yi koodu Dirk pada diẹ diẹ. O le wa iyipada mi lori GitHub: nibi ati iwe afọwọkọ Python ti o baamu fun sisọ pẹlu Arduino, ninu ibi ipamọ mi cypress_psoc_tools.

Nitorinaa, ni lilo Arduino, Mo kọkọ lo awọn alaiṣe “osise” nikan fun “ibaraẹnisọrọ”. Mo gbiyanju lati ka ROM ti inu nipa lilo aṣẹ VERIFY. Bi o ti ṣe yẹ, Emi ko le ṣe eyi. Boya nitori otitọ pe awọn iwọn aabo kika ti mu ṣiṣẹ ninu kọnputa filasi naa.

Lẹhinna Mo ṣẹda diẹ ninu awọn adaṣe ti o rọrun ti ara mi fun kikọ ati kika iranti / awọn iforukọsilẹ. Jọwọ ṣe akiyesi pe a le ka gbogbo SROM botilẹjẹpe kọnputa filasi ti ni aabo!

5.4. Idanimọ ti awọn iforukọsilẹ lori-chip

Lẹhin ti n wo awọn apanirun “ti tuka”, Mo ṣe awari pe ẹrọ naa nlo awọn iforukọsilẹ ti ko ni iwe-aṣẹ (0xF8-0xFA) lati ṣalaye awọn opcodes M8C, eyiti o ṣiṣẹ taara, ni ikọja aabo. Eyi jẹ ki n ṣiṣẹ ọpọlọpọ awọn opcodes gẹgẹbi "ADD", "MOV A, X", "PUSH" tabi "JMP". Ṣeun si wọn (nipa wiwo awọn ipa ẹgbẹ ti wọn ni lori awọn iforukọsilẹ) Mo ni anfani lati pinnu eyi ti awọn iforukọsilẹ ti ko ni iwe-aṣẹ jẹ awọn iforukọsilẹ deede (A, X, SP ati PC).

Bi abajade, koodu “tuka” ti ipilẹṣẹ nipasẹ ohun elo HSSP_disas.rb dabi eyi (Mo ṣafikun awọn asọye fun mimọ):

--== init2 ==--
[DE E0 1C] wrreg CPU_F (f7), 0x00   # сброс флагов
[DE C0 1C] wrreg SP (f6), 0x00      # сброс SP
[9F 07 5C] wrmem KEY1, 0x3A     # обязательный аргумент для SSC
[9F 20 7C] wrmem KEY2, 0x03     # аналогично
[DE A0 1C] wrreg PCh (f5), 0x00     # сброс PC (MSB) ...
[DE 80 7C] wrreg PCl (f4), 0x03     # (LSB) ... до 3 ??
[9F 70 1C] wrmem POINTER, 0x80      # RAM-указатель для выходных данных
[DF 26 1C] wrreg opc1 (f9), 0x30        # Опкод 1 => "HALT"
[DF 48 1C] wrreg opc2 (fa), 0x40        # Опкод 2 => "NOP"
[9F 40 3C] wrmem BLOCKID, 0x01  # BLOCK ID для вызова SSC
[DE 00 DC] wrreg A (f0), 0x06       # номер "Syscall" : TableRead
[DF 00 1C] wrreg opc0 (f8), 0x00        # Опкод для SSC, "Supervisory SROM Call"
[DF E2 5C] wrreg CPU_SCR0 (ff), 0x12    # Недокумментированная операция: выполнить внешний опкод

5.5. Aabo die-die

Ni ipele yii Mo le ṣe ibasọrọ tẹlẹ pẹlu PSoC, ṣugbọn Emi ko tun ni alaye igbẹkẹle nipa awọn iwọn aabo ti kọnputa filasi naa. Inu yà mi pupọ nipasẹ otitọ pe Cypress ko pese olumulo ẹrọ naa pẹlu ọna eyikeyi lati ṣayẹwo boya o ti mu aabo ṣiṣẹ. Mo ti walẹ jinlẹ si Google lati ni oye nipari pe koodu HSSP ti o pese nipasẹ Cypress ti ni imudojuiwọn lẹhin Dirk ṣe idasilẹ iyipada rẹ. Igba yen nko! Fekito tuntun yii ti farahan:

[DE E0 1C] wrreg CPU_F (f7), 0x00
[DE C0 1C] wrreg SP (f6), 0x00
[9F 07 5C] wrmem KEY1, 0x3A
[9F 20 7C] wrmem KEY2, 0x03
[9F A0 1C] wrmem 0xFD, 0x00 # неизвестные аргументы
[9F E0 1C] wrmem 0xFF, 0x00 # аналогично
[DE A0 1C] wrreg PCh (f5), 0x00
[DE 80 7C] wrreg PCl (f4), 0x03
[9F 70 1C] wrmem POINTER, 0x80
[DF 26 1C] wrreg opc1 (f9), 0x30
[DF 48 1C] wrreg opc2 (fa), 0x40
[DE 02 1C] wrreg A (f0), 0x10   # недокументированный syscall !
[DF 00 1C] wrreg opc0 (f8), 0x00
[DF E2 5C] wrreg CPU_SCR0 (ff), 0x12

Lilo fekito yii (wo read_security_data ni psc.py), a gba gbogbo awọn iwọn aabo ni SRAM ni 0x80, nibiti awọn die-die meji wa fun bulọọki aabo.

Abajade jẹ irẹwẹsi: ohun gbogbo ni aabo ni ipo “mu kika ita ati kikọ silẹ”. Nitorinaa, kii ṣe nikan a ko le ka ohunkohun lati kọnputa filasi, ṣugbọn a ko le kọ ohunkohun boya (fun apẹẹrẹ, lati fi sori ẹrọ idalẹnu ROM kan nibẹ). Ati pe ọna kan ṣoṣo lati mu aabo kuro ni lati pa gbogbo ërún naa patapata. 🙁

6. First (kuna) kolu: ROMX

Sibẹsibẹ, a le gbiyanju ẹtan wọnyi: niwọn bi a ti ni agbara lati ṣiṣẹ awọn opcodes lainidii, kilode ti o ko ṣe ROMX, eyiti o lo lati ka iranti filasi? Ọna yii ni aye to dara lati ṣaṣeyọri. Nitori iṣẹ ReadBlock ti o ka data lati SROM (eyiti o jẹ lilo nipasẹ vectors) ṣayẹwo boya o pe lati ISSP. Sibẹsibẹ, ROMX opcode lakaye le ma ni iru ayẹwo kan. Nitorinaa eyi ni koodu Python (lẹhin fifi awọn kilasi oluranlọwọ diẹ kun si koodu Arduino):

for i in range(0, 8192):
    write_reg(0xF0, i>>8)       # A = 0
    write_reg(0xF3, i&0xFF)     # X = 0
    exec_opcodes("x28x30x40")    # ROMX, HALT, NOP
    byte = read_reg(0xF0)       # ROMX reads ROM[A|X] into A
    print "%02x" % ord(byte[0]) # print ROM byte

Laanu koodu yii ko ṣiṣẹ. 🙁 Tabi dipo o ṣiṣẹ, ṣugbọn ni iṣelọpọ a gba awọn koodu opcode tiwa (0x28 0x30 0x40)! Emi ko ro pe iṣẹ ṣiṣe ti ẹrọ naa jẹ ẹya ti aabo kika. Eyi jẹ diẹ sii bii ẹtan imọ-ẹrọ: nigbati o ba n ṣiṣẹ awọn opcodes ita, ọkọ akero ROM ti wa ni darí si ifipamọ igba diẹ.

7. Keji Attack: Tutu Boot Tracing

Niwọn igba ti ẹtan ROMX ko ṣiṣẹ, Mo bẹrẹ si ronu nipa iyatọ miiran ti ẹtan yii - ti a ṣalaye ninu atẹjade "Titan Imọlẹ pupọ lori Idaabobo Famuwia Microcontroller kan".

7.1. imuse

Iwe ISSP pese fekito atẹle fun CHECKSUM-SETUP:

[DE E0 1C] wrreg CPU_F (f7), 0x00
[DE C0 1C] wrreg SP (f6), 0x00
[9F 07 5C] wrmem KEY1, 0x3A
[9F 20 7C] wrmem KEY2, 0x03
[DE A0 1C] wrreg PCh (f5), 0x00
[DE 80 7C] wrreg PCl (f4), 0x03
[9F 70 1C] wrmem POINTER, 0x80
[DF 26 1C] wrreg opc1 (f9), 0x30
[DF 48 1C] wrreg opc2 (fa), 0x40
[9F 40 1C] wrmem BLOCKID, 0x00
[DE 00 FC] wrreg A (f0), 0x07
[DF 00 1C] wrreg opc0 (f8), 0x00
[DF E2 5C] wrreg CPU_SCR0 (ff), 0x12

Eyi n pe iṣẹ SROM ni pataki 0x07, bi a ti gbekalẹ ninu iwe (italics mine):

Ijẹrisi checksum iṣẹ yii. O ṣe iṣiro ayẹwo ayẹwo 16-bit ti nọmba awọn bulọọki pato olumulo ni banki filasi kan, ti o bẹrẹ lati odo. A lo paramita BLOCKID lati kọja nọmba awọn bulọọki ti yoo ṣee lo nigbati o ṣe iṣiro sọwedowo. Iye kan ti "1" yoo ṣe iṣiro iye owo ayẹwo nikan fun odo idina; nigba ti "0" yoo jẹ ki iṣiro lapapọ ti gbogbo awọn bulọọki 256 ti banki filasi lati ṣe iṣiro. Sọwedowo 16-bit ti pada nipasẹ KEY1 ati KEY2. Iparamita KEY1 tọju awọn iwọn kekere 8 ti checksum, ati pe paramita KEY2 tọju aṣẹ-giga 8 bit. Fun awọn ẹrọ pẹlu ọpọlọpọ awọn banki filasi, iṣẹ checksum ni a pe fun ọkọọkan lọtọ. Nọmba ile ifowo pamọ ti yoo ṣiṣẹ ni a ṣeto nipasẹ iforukọsilẹ FLS_PR1 (nipa ṣiṣeto bit ninu rẹ ti o baamu si banki filasi afojusun).

Ṣe akiyesi pe eyi jẹ sọwedowo ti o rọrun: awọn baiti ni a ṣafikun nirọrun kan lẹhin ekeji; ko si Fancy CRC quirks. Ni afikun, mimọ pe M8C mojuto ni eto awọn iforukọsilẹ kekere pupọ, Mo ro pe nigbati o ba ṣe iṣiro sọwedowo, awọn iye agbedemeji yoo gba silẹ ni awọn oniyipada kanna ti yoo lọ si abajade: KEY1 (0xF8) / KEY2 ( 0xF9).

Nitorinaa ni imọran ikọlu mi dabi eyi:

  1. A sopọ nipasẹ ISSP.
  2. A bẹrẹ iṣiro checksum nipa lilo CHECKSUM-SETUP fekito.
  3. A tun atunbere ero isise lẹhin akoko kan pato T.
  4. A ka Ramu lati gba checksum C lọwọlọwọ.
  5. Tun awọn igbesẹ 3 ati 4 ṣe, jijẹ T diẹ ni igba kọọkan.
  6. A gba data pada lati inu kọnputa filasi nipasẹ iyokuro checksum C ti tẹlẹ lati ọkan lọwọlọwọ.

Sibẹsibẹ, iṣoro kan wa: Initialize-1 vector ti a ni lati firanṣẹ lẹhin atunbere tun kọ KEY1 ati KEY2:

1100101000000000000000  # Магия, переводящая PSoC в режим программирования
nop
nop
nop
nop
nop
[DE E0 1C] wrreg CPU_F (f7), 0x00
[DE C0 1C] wrreg SP (f6), 0x00
[9F 07 5C] wrmem KEY1, 0x3A # контрольная сумма перезаписывается здесь
[9F 20 7C] wrmem KEY2, 0x03 # и здесь
[DE A0 1C] wrreg PCh (f5), 0x00
[DE 80 7C] wrreg PCl (f4), 0x03
[9F 70 1C] wrmem POINTER, 0x80
[DF 26 1C] wrreg opc1 (f9), 0x30
[DF 48 1C] wrreg opc2 (fa), 0x40
[DE 01 3C] wrreg A (f0), 0x09   # SROM-функция 9
[DF 00 1C] wrreg opc0 (f8), 0x00    # SSC
[DF E2 5C] wrreg CPU_SCR0 (ff), 0x12

Yi koodu ìkọlélórí wa iyebiye checksum nipa pipe Calibrate1 (SROM iṣẹ 9)... Boya a le kan fi awọn idan nọmba (lati ibẹrẹ ti awọn koodu loke) lati tẹ siseto mode, ati ki o si ka SRAM? Ati bẹẹni, o ṣiṣẹ! Koodu Arduino ti o ṣe ikọlu yii rọrun pupọ:

case Cmnd_STK_START_CSUM:
    checksum_delay = ((uint32_t)getch())<<24;
    checksum_delay |= ((uint32_t)getch())<<16;
    checksum_delay |= ((uint32_t)getch())<<8;
    checksum_delay |= getch();
    if(checksum_delay > 10000) {
        ms_delay = checksum_delay/1000;
        checksum_delay = checksum_delay%1000;
    }
    else {
        ms_delay = 0;
    }
    send_checksum_v();
    if(checksum_delay)
        delayMicroseconds(checksum_delay);
    delay(ms_delay);
    start_pmode();

  1. Ka checkum_delay.
  2. Ṣiṣe iṣiro checksum (send_checksum_v).
  3. Duro fun akoko kan pato; ni akiyesi awọn ipalara wọnyi:
    • Mo ti sofo pupo ti akoko titi ti mo ti ri jade ohun ti o wa ni jade idaduroMicro-aaya ṣiṣẹ ni deede nikan pẹlu awọn idaduro ko kọja 16383 μs;
    • ati lẹhinna tun pa iye akoko kanna titi emi o fi rii pe idaduroMicroseconds, ti 0 ba kọja si bi ohun kikọ sii, ṣiṣẹ ni aṣiṣe patapata!
  4. Tun atunbere PSoC sinu ipo siseto (a kan fi nọmba idan ranṣẹ, laisi fifiranṣẹ awọn olupilẹṣẹ ibẹrẹ).

Koodu ipari ni Python:

for delay in range(0, 150000):  # задержка в микросекундах
    for i in range(0, 10):      # количество считывания для каждойиз задержек
        try:
            reset_psoc(quiet=True)  # перезагрузка и вход в режим программирования
            send_vectors()      # отправка инициализирующих векторов
            ser.write("x85"+struct.pack(">I", delay)) # вычислить контрольную сумму + перезагрузиться после задержки
            res = ser.read(1)       # считать arduino ACK
        except Exception as e:
            print e
            ser.close()
            os.system("timeout -s KILL 1s picocom -b 115200 /dev/ttyACM0 2>&1 > /dev/null")
            ser = serial.Serial('/dev/ttyACM0', 115200, timeout=0.5) # открыть последовательный порт
            continue
        print "%05d %02X %02X %02X" % (delay,      # считать RAM-байты
                read_regb(0xf1),
                read_ramb(0xf8),
                read_ramb(0xf9))

Ni kukuru, kini koodu yii ṣe:

  1. Tun atunbere PSoC (o si fi nọmba idan ranṣẹ).
  2. Rán ni kikun pilẹṣẹ fekito.
  3. N pe iṣẹ Arduino Cmnd_STK_START_CSUM (0x85), nibiti idaduro ni awọn iṣẹju-aaya ti kọja bi paramita kan.
  4. Ka checksum (0xF8 ati 0xF9) ati iforukọsilẹ ti ko ni iwe-aṣẹ 0xF1.

Yi koodu ti wa ni ṣiṣẹ 10 igba ni 1 microsecond. 0xF1 wa nibi nitori pe o jẹ iforukọsilẹ nikan ti o yipada nigbati o ṣe iṣiro sọwedowo naa. Boya o jẹ diẹ ninu iru oniyipada igba diẹ ti a lo nipasẹ ẹyọkan kannaa isiro. Ṣe akiyesi gige gige ti Mo lo lati tun Arduino pada nipa lilo picocom nigbati Arduino duro lati ṣafihan awọn ami igbesi aye (ko si idi idi).

7.2. Kika abajade

Abajade ti iwe afọwọkọ Python dabi eyi (irọrun fun kika):

DELAY F1 F8 F9  # F1 – вышеупомянутый неизвестный регистр
                  # F8 младший байт контрольной суммы
                  # F9 старший байт контрольной суммы

00000 03 E1 19
[...]
00016 F9 00 03
00016 F9 00 00
00016 F9 00 03
00016 F9 00 03
00016 F9 00 03
00016 F9 00 00  # контрольная сумма сбрасывается в 0
00017 FB 00 00
[...]
00023 F8 00 00
00024 80 80 00  # 1-й байт: 0x0080-0x0000 = 0x80 
00024 80 80 00
00024 80 80 00
[...]
00057 CC E7 00   # 2-й байт: 0xE7-0x80: 0x67
00057 CC E7 00
00057 01 17 01  # понятия не имею, что здесь происходит
00057 01 17 01
00057 01 17 01
00058 D0 17 01
00058 D0 17 01
00058 D0 17 01
00058 D0 17 01
00058 F8 E7 00  # Снова E7?
00058 D0 17 01
[...]
00059 E7 E7 00
00060 17 17 00  # Хмммммм
[...]
00062 00 17 00
00062 00 17 00
00063 01 17 01  # А, дошло! Вот он же перенос в старший байт
00063 01 17 01
[...]
00075 CC 17 01  # Итак, 0x117-0xE7: 0x30

Ti o sọ, a ni iṣoro kan: niwọn bi a ti n ṣiṣẹ pẹlu checksum gangan, baiti asan ko yi iye kika pada. Sibẹsibẹ, niwọn igba ti gbogbo ilana iṣiro (8192 awọn baiti) gba awọn aaya 0,1478 (pẹlu awọn iyatọ diẹ ni gbogbo igba ti o ba ṣiṣẹ), eyiti o dọgba si isunmọ 18,04 μs fun baiti, a le lo akoko yii lati ṣayẹwo iye checksum ni awọn akoko ti o yẹ. Fun awọn ṣiṣe akọkọ, ohun gbogbo ni a ka ni irọrun, nitori iye akoko ilana iṣiro nigbagbogbo fẹrẹ jẹ kanna. Sibẹsibẹ, opin idalẹnu yii ko ni deede nitori “awọn iyapa akoko kekere” lori ṣiṣe kọọkan ṣafikun lati di pataki:

134023 D0 02 DD
134023 CC D2 DC
134023 CC D2 DC
134023 CC D2 DC
134023 FB D2 DC
134023 3F D2 DC
134023 CC D2 DC
134024 02 02 DC
134024 CC D2 DC
134024 F9 02 DC
134024 03 02 DD
134024 21 02 DD
134024 02 D2 DC
134024 02 02 DC
134024 02 02 DC
134024 F8 D2 DC
134024 F8 D2 DC
134025 CC D2 DC
134025 EF D2 DC
134025 21 02 DD
134025 F8 D2 DC
134025 21 02 DD
134025 CC D2 DC
134025 04 D2 DC
134025 FB D2 DC
134025 CC D2 DC
134025 FB 02 DD
134026 03 02 DD
134026 21 02 DD

Iyẹn jẹ idalenu 10 fun gbogbo idaduro iṣẹju-aaya. Lapapọ akoko iṣẹ fun sisọ gbogbo awọn baiti 8192 ti kọnputa filasi jẹ nipa awọn wakati 48.

7.3. Flash alakomeji atunkọ

Emi ko ti pari kikọ koodu ti yoo tun ṣe koodu eto ti kọnputa filasi patapata, ni akiyesi gbogbo awọn iyapa akoko. Sibẹsibẹ, Mo ti mu pada ibẹrẹ koodu yii tẹlẹ. Lati rii daju pe mo ṣe ni deede, Mo ṣajọpọ ni lilo m8cdis:

0000: 80 67   jmp  0068h     ; Reset vector
[...]
0068: 71 10   or  F,010h
006a: 62 e3 87 mov  reg[VLT_CR],087h
006d: 70 ef   and  F,0efh
006f: 41 fe fb and  reg[CPU_SCR1],0fbh
0072: 50 80   mov  A,080h
0074: 4e    swap A,SP
0075: 55 fa 01 mov  [0fah],001h
0078: 4f    mov  X,SP
0079: 5b    mov  A,X
007a: 01 03   add  A,003h
007c: 53 f9   mov  [0f9h],A
007e: 55 f8 3a mov  [0f8h],03ah
0081: 50 06   mov  A,006h
0083: 00    ssc
[...]
0122: 18    pop  A
0123: 71 10   or  F,010h
0125: 43 e3 10 or  reg[VLT_CR],010h
0128: 70 00   and  F,000h ; Paging mode changed from 3 to 0
012a: ef 62   jacc 008dh
012c: e0 00   jacc 012dh
012e: 71 10   or  F,010h
0130: 62 e0 02 mov  reg[OSC_CR0],002h
0133: 70 ef   and  F,0efh
0135: 62 e2 00 mov  reg[INT_VC],000h
0138: 7c 19 30 lcall 1930h
013b: 8f ff   jmp  013bh
013d: 50 08   mov  A,008h
013f: 7f    ret

Wulẹ oyimbo o sese!

7.4. Wiwa adirẹsi ipamọ koodu PIN

Ni bayi ti a le ka checksum ni awọn akoko ti a nilo, a le ni irọrun ṣayẹwo bii ati ibiti o ṣe yipada nigbati a:

  • tẹ koodu PIN ti ko tọ si;
  • yi awọn pin koodu.

Ni akọkọ, lati wa adiresi ibi ipamọ isunmọ, Mo mu idalẹnu checksum kan ni awọn afikun 10 ms lẹhin atunbere. Nigbana ni mo ti tẹ PIN ti ko tọ sii mo si ṣe kanna.

Abajade ko dun pupọ, nitori ọpọlọpọ awọn ayipada wa. Ṣugbọn ni ipari Mo ni anfani lati pinnu pe checksum yipada ni ibikan laarin 120000 µs ati 140000 µs ti idaduro. Ṣugbọn “pincode” ti Mo ṣafihan pe ko tọ patapata - nitori ohun elo ti ilana idaduroMicroseconds, eyiti o ṣe awọn ohun ajeji nigbati 0 ba kọja si.

Lẹhinna, lẹhin lilo fere awọn wakati 3, Mo ranti pe ipe eto SROM CheckSum gba ariyanjiyan bi titẹ sii ti o ṣalaye nọmba awọn bulọọki fun checksum! Iyẹn. a le ni rọọrun agbegbe adirẹsi ibi ipamọ ti koodu PIN ati counter “awọn igbiyanju ti ko tọ”, pẹlu deede ti o to bulọki 64-baiti.

Awọn ṣiṣe akọkọ mi ṣe abajade atẹle:

Yiyipada ati gige Aigo ara-encrypting ita HDD drive. Apá 2: Gbigba idalenu lati Cypress PSoC

Lẹhinna Mo yi koodu PIN pada lati "123456" si "1234567" o si gba:

Yiyipada ati gige Aigo ara-encrypting ita HDD drive. Apá 2: Gbigba idalenu lati Cypress PSoC

Nitorinaa, koodu PIN ati counter ti awọn igbiyanju ti ko tọ dabi pe o wa ni ipamọ ni Àkọsílẹ No.. 126.

7.5. Gbigba idalenu ti Àkọsílẹ No.. 126

Àkọsílẹ #126 yẹ ki o wa ni ibikan ni ayika 125x64x18 = 144000μs, lati ibẹrẹ ti iṣiro checksum, ni idalẹnu mi ni kikun, ati pe o dabi ohun ti o ṣeeṣe. Lẹhinna, lẹhin sisọ ọpọlọpọ awọn idalẹnu ti ko wulo (nitori ikojọpọ “awọn iyapa akoko kekere”), Mo pari gbigba awọn baiti wọnyi (ni idaduro ti 145527 μs):

Yiyipada ati gige Aigo ara-encrypting ita HDD drive. Apá 2: Gbigba idalenu lati Cypress PSoC

O han gbangba pe koodu PIN ti wa ni ipamọ ni fọọmu ti a ko fi pamọ! Awọn iye wọnyi, dajudaju, ko ni kikọ sinu awọn koodu ASCII, ṣugbọn bi o ti wa ni jade, wọn ṣe afihan awọn kika ti o ya lati ori kọnputa capacitive.

Nikẹhin, Mo sare awọn idanwo diẹ sii lati wa ibiti a ti fipamọ counter igbiyanju buburu naa. Eyi ni abajade:

Yiyipada ati gige Aigo ara-encrypting ita HDD drive. Apá 2: Gbigba idalenu lati Cypress PSoC

0xFF - tumọ si "awọn igbiyanju 15" ati pe o dinku pẹlu igbiyanju kọọkan ti o kuna.

7.6. PIN koodu imularada

Eyi ni koodu ẹgbin mi ti o ṣajọpọ eyi papọ:

def dump_pin():
  pin_map = {0x24: "0", 0x25: "1", 0x26: "2", 0x27:"3", 0x20: "4", 0x21: "5",
        0x22: "6", 0x23: "7", 0x2c: "8", 0x2d: "9"}
  last_csum = 0
  pin_bytes = []
  for delay in range(145495, 145719, 16):
    csum = csum_at(delay, 1)
    byte = (csum-last_csum)&0xFF
    print "%05d %04x (%04x) => %02x" % (delay, csum, last_csum, byte)
    pin_bytes.append(byte)
    last_csum = csum
  print "PIN: ",
  for i in range(0, len(pin_bytes)):
    if pin_bytes[i] in pin_map:
      print pin_map[pin_bytes[i]],
  print

Eyi ni abajade ti ipaniyan rẹ:

$ ./psoc.py 
syncing: KO OK
Resetting PSoC: KO Resetting PSoC: KO Resetting PSoC: OK
145495 53e2 (0000) => e2
145511 5407 (53e2) => 25
145527 542d (5407) => 26
145543 5454 (542d) => 27
145559 5474 (5454) => 20
145575 5495 (5474) => 21
145591 54b7 (5495) => 22
145607 54da (54b7) => 23
145623 5506 (54da) => 2c
145639 5506 (5506) => 00
145655 5533 (5506) => 2d
145671 554c (5533) => 19
145687 554e (554c) => 02
145703 554e (554e) => 00
PIN: 1 2 3 4 5 6 7 8 9

Hooray! Awọn iṣẹ!

Jọwọ ṣakiyesi pe awọn iye lairi ti Mo lo le ṣe pataki si PSoC kan pato - eyiti Mo lo.

8. Kini atẹle?

Nitorinaa, jẹ ki a ṣe akopọ ni ẹgbẹ PSoC, ni aaye ti awakọ Aigo wa:

  • a le ka SRAM paapa ti o ba ti wa ni ka ni idaabobo;
  • A le fori aabo ilodi-ra nipasẹ lilo ikọlu bata bata tutu ati kika koodu PIN taara.

Sibẹsibẹ, ikọlu wa ni diẹ ninu awọn abawọn nitori awọn iṣoro imuṣiṣẹpọ. O le ni ilọsiwaju bi atẹle:

  • Kọ ohun elo kan lati ṣe iyipada data ti o jade ni deede ti o gba nitori abajade ikọlu “itọpa bata tutu”;
  • lo ohun elo FPGA lati ṣẹda awọn idaduro akoko kongẹ diẹ sii (tabi lo awọn aago ohun elo Arduino);
  • gbiyanju ikọlu miiran: tẹ koodu PIN ti ko tọ si, atunbere ki o da Ramu silẹ, nireti pe koodu PIN to pe yoo wa ni fipamọ ni Ramu fun lafiwe. Sibẹsibẹ, eyi kii ṣe rọrun lati ṣe lori Arduino, nitori ipele ifihan agbara Arduino jẹ 5 volts, lakoko ti igbimọ ti a ṣe ayẹwo ṣiṣẹ pẹlu awọn ifihan agbara folti 3,3.

Ohun kan ti o nifẹ ti o le gbiyanju ni lati mu ṣiṣẹ pẹlu ipele foliteji lati fori aabo kika naa. Ti ọna yii ba ṣiṣẹ, a yoo ni anfani lati gba data deede lati inu kọnputa filasi - dipo gbigbekele kika iwe ayẹwo kan pẹlu awọn idaduro akoko aiṣedeede.

Niwọn bi SROM ṣe le ka awọn ẹṣọ ẹṣọ nipasẹ ipe eto ReadBlock, a le ṣe ohun kanna bi ṣàpèjúwe lori bulọọgi Dmitry Nedospasov - imuse atunṣe ti ikọlu Chris Gerlinski, ti a kede ni apejọ "REcon Brussels 2017".

Ohun igbadun miiran ti o le ṣee ṣe ni lati lọ kuro ninu ọran naa: lati mu idalẹnu SRAM kan, ṣe idanimọ awọn ipe eto ti ko ni iwe-aṣẹ ati awọn ailagbara.

9. Ipari

Nitorinaa, aabo ti awakọ yii fi silẹ pupọ lati fẹ, nitori pe o nlo deede (kii ṣe “lile”) microcontroller lati tọju koodu PIN naa… Plus, Emi ko wo (sibẹsibẹ) ni bii awọn nkan ṣe n lọ pẹlu data ìsekóòdù lori ẹrọ yi!

Kini o le ṣeduro fun Aigo? Lẹhin itupalẹ awọn awoṣe meji ti awọn awakọ HDD ti paroko, ni ọdun 2015 Mo ṣe igbejade lori SyScan, ninu eyiti o ṣe ayẹwo awọn iṣoro aabo ti ọpọlọpọ awọn awakọ HDD ita, ati ṣe awọn iṣeduro lori ohun ti o le ni ilọsiwaju ninu wọn. 🙂

Mo lo awọn ọsẹ meji ati ọpọlọpọ awọn irọlẹ ni ṣiṣe iwadii yii. Lapapọ nipa awọn wakati 40. Kika lati ibẹrẹ pupọ (nigbati Mo ṣii disk) si ipari (idasonu koodu PIN). Awọn wakati 40 kanna pẹlu akoko ti Mo lo kikọ nkan yii. O jẹ irin-ajo igbadun pupọ.

orisun: www.habr.com

Fi ọrọìwòye kun