x86-64 Intel Firmware Attack & Defense

Go HERE to take this class as a 4-Day Buffet course.
Go HERE to take this class as a 3-Day Buffet course.
Go HERE to join just the x86-64 assembly class.
Go HERE to join just the x86-64 OS internals class.

This class is run a little different from most classes. We provide you purpose-built recorded lectures instead of trapping you in realtime with live-lectures. But fear not, the instructor is always right there eagerly waiting to mingle with the students and answer any questions you have. (The instructor really likes being asked questions. It shows you’re paying attention ;)). One of many benefits is that you can watch lectures at 2x speed and zoom ahead of the other students and get to the hands on labs quicker. Or if there’s bits of material you already know, you can just skip them and move on to the bits you don’t know! Another big benefit is that you get to take the full lectures and labs with you! That means if you forget stuff and then need it in 6 months, you can quickly re-bootstrap yourself! Or you can watch the class twice, to really grow those neural connections and cement it in your brain! And unlike live lectures, our lectures are always getting more factually accurate, by having any accidental errors edited out.

Because we give you all the lecture and lab materials and videos after class, what you’re really paying for is support from the instructor! So you’ll be entitled to keep asking up to 20 questions after class, with 1-2 hour turnaround answers (after accounting for time-zone differences.) This lets you keep productively working through the material if you run out of time at the conference. If you’d like to learn more about the benefits of this style of class delivery, please read this blog post.

Key Learning Objectives

• Understand the original 16-bit “Real Mode” which the x86 CPU reset vector executes in.
• Understand 16-bit segmentation & assembly.
• Understand the evolution of Intel chipsets, and how to find the manual which corresponds to any given hardware.
• Understand how firmware uses IO to configure Intel and 3rd party hardware at boot time.
• Understand how firmware interacts with PCIe devices at boot time, both within the CPU/chipset, and 3rd party peripherals.
• Understand the core purposes of PCIe Option ROMs, but also how they can be used by attackers.
• Being capable of manually reading/writing the firmware-storage SPI flash through the register interface.
• Understand the protection mechanisms for the SPI flash and how they can be bypassed.
• Understand the protection mechanisms for System Management Mode how they can be bypassed.
• Understand how Chipsec can be used to assess the security posture of a firmware for both attack and defense.
• Understand how the ACPI S3 “sleep” power state can be used to attack systems.
• Being comfortable with Reading The Fun Manual(!) to go seek out the most accurate details of how things work.

What Students say about this training

SO much visualization; there is zero “wall of texts” slides.

I loved the threat trees and explanations that went along with them, the more narrative approach made it easy to stay engaged.

I like that it’s progressive and well taught with lots of tricks to make the material less dry

Really enjoyed the mix of lecture with some practical investigation on hardware with Chipsec.

The animated diagrams and humor mixed in with the slides worked really well for communicating how memory and registers were arranged and how bytes and nibbles split into different fields.

The “go forth and read things you will now understand better” research unlocked sections were great motivation for learning new things and letting me dive into rabbit holes of neat information.

The explanation of how the manuals are organized and how to find information in them along with the little fact lookup missions are so valuable, especially with Intel manuals.

I really enjoyed this class and the material. I will be referring to it frequently I am sure. I am also thankful for the collection of data sheets in the gitlab repo. That is a nice touch and I’m sure it took a long time to collect and organize.

Topics covered

Introduction

• Attacker motivations & capabilities

Reset Vector

• The “Real Mode” execution environment
• Reading reset vector assembly and the transitions to “Protected Mode”

Chipsets

• The evolution of the platform architecture
• Finding the correct manual for the hardware you bring to class, to find the correct offsets to memory mapped IO registers for the rest of the class

Input/Output

• Memory Mapped IO (MMIO) as used by firmware
• Port IO (PIO) as used by firmware
• Hardware-defined vs. reconfigurable memory spaces

PCIe

• Evolution, topology, and usage by firmware
• Configuration address space MMIO vs. PIO accesses
• Base address registers & extended configuration address space
• “Option ROMs” and how they’ve been repeatedly used for attacks

SPI Flash

• Introduction & supported SPI operation modes on x86
• MMIO register-based SPI flash programming interface
• SPI flash layout & the Intel flash descriptor
• SPI protection threat tree, moves and counter-moves
• – Protected Range Registers (PRRs) and bypasses like failure to FLOCKDN + sleep attacks
• – SMM-based BIOS Lockdown and bypasses like SMI Suppression + sleep attacks

System Management Mode (SMM)

• Introduction & System Management Interrupts (SMIs)
• System Management RAM (SMRAM) & the protection thereof
• SMM threat tree, moves and counter-moves:
• – Caching Attacks
• – Remapping Attacks
• – SMM Call-Out Vulnerabilities
• – SMM Confused Deputy Attacks
• – SMM TOCTOU Attacks

Power-transition attacks

• x86 ACPI S3 low-power sleep effects on SPI & SMM protection
• Attacks exploiting S3 sleep states

Conclusion

Go HERE to take this class as a 4-Day Buffet course.
Go HERE to take this class as a 3-Day Buffet course.
Go HERE to join just the x86-64 assembly class.
Go HERE to join just the x86-64 OS internals class.