Ninja: Towards Transparent Tracing and Debugging on ARM
summary
NINJA claims a low‑artifact, OS‑agnostic malware analysis environment built inside ARM TrustZone that uses TrustZone to isolate the analyzer and leverages hardware tracers PMU and ETM for instruction and performance tracing. The prototype implements tracing and debugging subsystems without modifying system software, protects PMU/ETM registers via secure‑domain traps, and reports hardware tracing with negligible overhead while Android API semantic bridging adds ~17% CPU cost and some software bridges can slow certain benchmarks up to ~4×. TrustZone switches are microseconds vs. SMM orders of magnitude slower.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:25Outline
- 1:00Evasion Malware
- 2:20Malware Analysis
- 6:38Transparency Requirements
- 8:40Background - TrustZone
- 12:30Overview
- 15:37Hardware Traps
- 18:05Evaluation - Transparency
- 19:49Evaluation - Performance of the TS
- 21:38Evaluation - Domain Switching Time
- 22:58Conclusion
related talks
43mBreaking Samsung's ARM TrustZone
49mThe ARMs race for kernel protection
08mSecure Debug IoT on v8-M Cortex-M33
19mDisARMed: Attacking ARM TrustZone from Userspace with Memory Aliasing
24mTriaging Crashed With Backward Taint Analysis For Arm Architecture
48mOP-TEE: Using the ARM Trust-Zone to Control Tamper Resistant Processors
39mReflections on Trusting TrustZone
41mPanel: A New Root Of Trust: Changing Computing With TEE