Demystifying the Secure Enclave Processor

on YouTube ↗48m

" summary

Breaks down the SEP as a separate ARMv7a core with image4 manifest firmware supplied by the AP at every boot, inline memory encryption for external RAM, and a one-way hardware mailbox/out-of-line buffers RPC that exposes ~8 AKF endpoints (biometric among them). SEPOS runs an L4-derived microkernel with predictable load addresses, a K&R heap, weak stack cookies and no ASLR, making handler bugs exploitable; suggests practical hardware vectors (clock/voltage glitching, side‑channel, fuse/JTAG manipulation) and notes which mitigations exist and which do not.

AI-written summary · about

" chapters (40)

1. 0:00Intro
2. 1:56Talk Outline
3. 2:13SEP's ARM Core: Kingfisher
4. 4:19Physical Memory
5. 5:11SEP KF Filter Diagram
6. 7:20Memory Protections
7. 8:34SEP Memory Protection Bootstrap
8. 9:27Memory Encryption Modes
9. 10:20Key Generation
10. 10:35Beginning Stage 3
11. 12:44Img4 - Manifest
12. 13:23Reversing SEP's Img4 Parser: Stage 2
13. 14:48Img4 Parsing Flow
14. 16:56Mailbox Mechanism
15. 17:23Mailbox Message Format
16. 18:33SEP Endpoints (1/2)
17. 18:59Control Endpoint (EPO) Handles control requests issued to the SEP
18. 19:29Control Endpoint Opcodes
19. 20:24Endpoint Registration (AP)
20. 22:49SEPOS Architecture
21. 23:25Kernel (L4) Initializes the machine state to a point where it
22. 24:04System Calls (1/2)
23. 24:23Privileged System Calls
24. 25:21SEPOS (INIT) Initial process on boot root task
25. 26:00SEPOS App Initialization
26. 26:48Application List
27. 27:21Bootstrap Server Implements the core functionality of SEPOS
28. 29:56Entitlement Assignment
29. 31:20Driver Interaction
30. 32:45Service Interaction
31. 33:01SEP Applications Primarily designed to support various drivers running in the AP
32. 34:18Attack Surface: AKF Endpoints
33. 35:11Attack Surface: Endpoint Handler
34. 36:42Stack Corruptions
35. 38:22Heap Corruptions: malloc()
36. 40:20SEPOS Mitigations Summary
37. 41:39Attacking IMG4
38. 42:19Attack Surface: Hardware
39. 44:20End Game: JTAG
40. 45:11Conclusion SEPOS was designed with security in mind

" related talks

• 40mKeeping secrets in your opponent's handsLars Wikman · Øredev 2025
• 41mProtected Execution FacilityGuerney D. H. Hunt · Linux Security Summit Europe 2018
• 48mOP-TEE: Using the ARM Trust-Zone to Control Tamper Resistant ProcessorsJorge Ramirez-Ortiz · Linux Security Summit Europe 2023
• 38mOne Ring -3 To Secure Them All: Computing with Hardware EnclavesAaron Bedra · Craft Conference 2021
• 53mBehind the Scenes of Intel Security and Manageability EngineShai Hasarfaty, Yanai Moyal · Black Hat USA 2019
• 39mAn Overview of the Self Boot Engine (SBE) in POWER9 base OpenPOWER SystemsAmit Tendolkar · OpenPOWER Summit North America 2019
• 55mProtected Execution Facility On PowerMichael E Anderson, Guerney D. H. Hunt, Ram Pai · OpenPOWER Summit North America 2019
• 28mSanctum: Minimal Hardware Extensions for Strong Software IsolationSrinivas Devadas, Victor Costan, Ilia Lebedev · USENIX Security '16