Possibility of Arbitrary Code Execution via Step‑Oriented Programming
summary
Explains how embedded devices use a simple on-device debugger stub that communicates with a host debugger over the Remote Serial Protocol (RSP), and shows that if that communication is hijacked an attacker can control the stub to perform Step-Oriented Programming (SOP): repeatedly changing the program counter and single-stepping to stitch together existing machine-code fragments into arbitrary functionality. Describes the SOP attack principle and demonstrates building and validating exploit code on real embedded systems, including a demo.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 4:45Debug port threats
- 9:25Remote debugging protocol
- 15:45RSP demo
- 23:13Machine code injection limits
- 26:12Security contest validation
- 33:39Competition server demo
- 47:13Conclusion
related talks
57mReturn Oriented Programming, an introduction
57mReturn Oriented Programming, an introduction
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
33mHacking in Darkness: Return-oriented Programming against Secure Enclaves
33mEmbedded Device Exploitation 101: An Introduction to Firmware Hacking
57mThe Anatomy of an Exploit
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
29mBackdooring of Real Time Automotive OS Devices