1
00:00:00,000 --> 00:00:09,900
Thank you for being here. I know that the third day of DEF CON is hard to get up so early, so thank you for being here.

2
00:00:10,060 --> 00:00:13,680
So this is Cesare Pizzi, my name is Cesare Pizzi, and this is the ArduSploit presentation.

3
00:00:14,100 --> 00:00:18,980
So ArduSploit is a proof of concept of an Arduino code injection.

4
00:00:19,220 --> 00:00:29,140
So what I try to do is to inject some arbitrary code in a working sketch without knowing the source code, without knowing how it works, and so on.

5
00:00:29,140 --> 00:00:33,700
So I try to put some arbitrary code there.

6
00:00:34,360 --> 00:00:38,320
Okay, so let's start. So a few words about me before starting.

7
00:00:39,780 --> 00:00:44,720
Okay, my real job, let's say, I work as a security engineer in an Italian company.

8
00:00:45,360 --> 00:00:49,800
And then, okay, as a hobby I have everything more or less that is technologically related.

9
00:00:50,140 --> 00:00:53,420
I work on a lot of open source projects and so on.

10
00:00:53,760 --> 00:00:58,720
And so I work a lot also on hardware, on the hardware field.

11
00:00:59,700 --> 00:01:05,320
Starting from more or less 2009, working on the first Arduino version and so on.

12
00:01:05,400 --> 00:01:13,260
I also built a custom Arduino compatible board with a GPS tracker called Here You Are.

13
00:01:13,340 --> 00:01:17,600
You can find all the details here in the site.

14
00:01:18,100 --> 00:01:23,120
Okay, so let's jump immediately into the presentation.

15
00:01:23,500 --> 00:01:27,800
So the basic idea of the project was actually to...

16
00:01:29,140 --> 00:01:31,760
Put some code in a working sketch.

17
00:01:33,140 --> 00:01:36,620
So these will be probably the main steps we have to follow to do it.

18
00:01:36,840 --> 00:01:39,860
The first one is dump the flash content.

19
00:01:40,300 --> 00:01:43,860
So we have the content of the board.

20
00:01:43,980 --> 00:01:45,380
We have to get it in some ways.

21
00:01:45,560 --> 00:01:53,180
Then we have to modify it because we need to put our code there and leave the previous functionalities working.

22
00:01:54,000 --> 00:01:58,100
And then refresh the injected code back.

23
00:01:59,140 --> 00:01:59,800
Into the board.

24
00:02:01,660 --> 00:02:05,940
We will see together that there were more than one way to do this.

25
00:02:06,020 --> 00:02:07,820
This is the important part, inject the payload.

26
00:02:09,460 --> 00:02:14,700
I don't know if you are aware of how the Arduino board works.

27
00:02:14,820 --> 00:02:20,440
In any case, usually it has a main loop that is repeatedly executed.

28
00:02:21,140 --> 00:02:24,380
And one of the options was to put the code there.

29
00:02:24,800 --> 00:02:28,680
But it wasn't, I didn't go in that way.

30
00:02:29,140 --> 00:02:35,320
Because it was more difficult to have a control on how often this code will be executed, actually.

31
00:02:35,500 --> 00:02:39,900
And so I tried to follow a different path to do it and we will see it together.

32
00:02:40,180 --> 00:02:42,620
I would like to split the presentation in three parts mainly.

33
00:02:43,700 --> 00:02:48,020
One with an overview of the AVR architecture.

34
00:02:48,300 --> 00:02:51,720
AVR is the MCU on which the Arduino is based.

35
00:02:52,200 --> 00:02:57,920
So I would like to do this just to have the same common ground to start up.

36
00:02:58,000 --> 00:02:59,120
Then we will see how it works.

37
00:02:59,120 --> 00:02:59,840
How the script works.

38
00:03:00,200 --> 00:03:10,180
And then we will also have a live demo to see the script, how it works and how it can get the code executed.

39
00:03:11,760 --> 00:03:18,860
Just a very, very, very fast overview on the AVR architecture.

40
00:03:20,140 --> 00:03:23,280
Flash, EEPROM and RAM are all integrated on the same chip.

41
00:03:23,380 --> 00:03:27,060
So the AVR chip holds everything in one piece of hardware.

42
00:03:27,260 --> 00:03:27,700
No.

43
00:03:29,120 --> 00:03:31,540
You don't have to mess with other components there.

44
00:03:31,720 --> 00:03:34,060
So you can just go with the same chip.

45
00:03:34,720 --> 00:03:37,280
All the program instructions are stored into the flash.

46
00:03:37,380 --> 00:03:40,940
This is very important to remember because we are going to mess with this code.

47
00:03:41,060 --> 00:03:43,280
So we know that everything is there.

48
00:03:43,420 --> 00:03:44,680
So we can get it.

49
00:03:46,360 --> 00:03:49,760
There is also an EEPROM available for permanent data storing.

50
00:03:49,920 --> 00:03:53,380
This is accessible through usual macros and so on.

51
00:03:54,760 --> 00:03:58,120
Then we have to consider that all the MCU are 8-bit.

52
00:03:59,120 --> 00:04:05,680
But the instruction set is built on instructions that are built on one or two 16-bit words.

53
00:04:05,840 --> 00:04:10,820
That means that the opcodes will be 16 or 32-bit words.

54
00:04:11,120 --> 00:04:12,240
Or 32-bits.

55
00:04:13,080 --> 00:04:18,480
All the opcodes are very well documented in the AVR datasheets and sites.

56
00:04:18,620 --> 00:04:21,520
So you can get all the documentation there.

57
00:04:21,640 --> 00:04:22,880
It's very well done.

58
00:04:23,120 --> 00:04:28,800
It is very important if you are going to start to play with this.

59
00:04:28,800 --> 00:04:31,340
Because obviously we are working at assembly level at this point.

60
00:04:31,440 --> 00:04:38,160
So we are going to inject some assembly code directly into the working code.

61
00:04:40,640 --> 00:04:42,580
As the last part.

62
00:04:42,920 --> 00:04:45,620
All the instructions are one or two clock cycles.

63
00:04:46,480 --> 00:04:50,020
Except jump and call that requires three or four clock cycles.

64
00:04:50,540 --> 00:04:56,220
Consider also that jump and calls are the few instructions that are 32-bits.

65
00:04:56,600 --> 00:04:58,720
This is because they have to address this.

66
00:04:58,800 --> 00:05:01,440
The whole memory of the board.

67
00:05:01,600 --> 00:05:02,300
Of the board.

68
00:05:02,380 --> 00:05:02,660
Of the MCU.

69
00:05:02,980 --> 00:05:11,320
And so they rely on the 32-bits to be able to set the correct address to the jump.

70
00:05:12,000 --> 00:05:14,520
This is the absolute jump and absolute call.

71
00:05:14,660 --> 00:05:21,760
So there will be also the relative jumps available in the opcodes of the MCU.

72
00:05:23,800 --> 00:05:26,340
This is how the flash memory is organized.

73
00:05:27,300 --> 00:05:28,180
Very important.

74
00:05:28,180 --> 00:05:30,420
Because the flash memory will be our playground here.

75
00:05:30,700 --> 00:05:38,280
And we are going to make some modification there to put our injected code.

76
00:05:39,180 --> 00:05:39,740
Okay.

77
00:05:39,860 --> 00:05:41,820
This is the main format.

78
00:05:43,040 --> 00:05:47,100
We have the flash memory starting at address zero.

79
00:05:47,200 --> 00:05:47,560
There.

80
00:05:48,720 --> 00:05:51,080
Where we have immediately a jump to the program start.

81
00:05:51,700 --> 00:05:54,260
So the real application will start here.

82
00:05:54,260 --> 00:06:00,920
All the room granted by the first part of the memory is for the interrupt vector table.

83
00:06:02,260 --> 00:06:05,660
We will go into details about this after because it's very important.

84
00:06:06,100 --> 00:06:07,860
Then there is the application section.

85
00:06:08,040 --> 00:06:14,500
Here it's where the code of the user, that the user will write with the proper ID is placed.

86
00:06:14,880 --> 00:06:17,140
And then there is the bootloader section at the end.

87
00:06:17,300 --> 00:06:22,500
The bootloader section is especially important because it allows to, let's say,

88
00:06:24,860 --> 00:06:29,940
write and manage easily the content of the flash.

89
00:06:30,120 --> 00:06:33,920
Because as you probably know, but I'm not sure if everyone knows that,

90
00:06:35,440 --> 00:06:41,820
the AVR MCU can be programmed by using an external programmer.

91
00:06:42,560 --> 00:06:46,540
So you don't have the need of the bootloader in that case.

92
00:06:47,160 --> 00:06:50,880
Or you can just use the board itself.

93
00:06:50,880 --> 00:06:53,760
Because the bootloader in this case is able to get from,

94
00:06:53,780 --> 00:06:57,420
to understand if from the USB port something is coming

95
00:06:57,420 --> 00:07:01,860
and it's able to rewrite the complete content of the flash over.

96
00:07:02,160 --> 00:07:05,220
So this is what allows us, for example,

97
00:07:05,220 --> 00:07:11,140
to use Arduino or similar boards directly with USB connection to program them.

98
00:07:11,620 --> 00:07:14,500
If you remove in some way the bootloader,

99
00:07:14,540 --> 00:07:18,520
you will end up with a brick, let's say, board.

100
00:07:19,380 --> 00:07:20,380
This happens.

101
00:07:20,380 --> 00:07:23,140
If you will start to play with the flash.

102
00:07:23,620 --> 00:07:25,520
But it's also true that it's easy to fix

103
00:07:25,520 --> 00:07:31,560
because you can reload the bootloader very easily with an external hardware.

104
00:07:32,020 --> 00:07:34,320
That could be another Arduino board, for example.

105
00:07:34,500 --> 00:07:36,700
So it's very easy to fix in this case.

106
00:07:37,100 --> 00:07:42,940
Consider that the whole memory is not protected in any way.

107
00:07:43,040 --> 00:07:47,280
So there are no protection for system or other ways.

108
00:07:47,280 --> 00:07:52,040
So you can write everywhere if you want.

109
00:07:52,480 --> 00:07:54,880
That means also that you can also damage something

110
00:07:54,880 --> 00:07:57,580
if you are not paying attention to what you are writing.

111
00:07:57,660 --> 00:08:01,100
Because there are no protection at all on the flash.

112
00:08:01,280 --> 00:08:05,020
So for the chip itself, you can write everywhere what you want.

113
00:08:06,320 --> 00:08:11,620
It's easy for us so that we can inject our code without checking so much things.

114
00:08:11,700 --> 00:08:17,040
But it's also dangerous because it allows us to make damage to the memory itself.

115
00:08:19,040 --> 00:08:21,880
So another important thing to consider are the fuses.

116
00:08:22,000 --> 00:08:25,940
Fuses are set of bits used by the MCU to store the initial configuration.

117
00:08:26,380 --> 00:08:31,340
Like, for example, the clock speed, the watchdog timer, and the bootloader location.

118
00:08:32,040 --> 00:08:33,860
I underline this because this is important.

119
00:08:34,120 --> 00:08:37,900
We need to understand if there is a bootloader in the flash

120
00:08:37,900 --> 00:08:44,500
because we have to stay away from it when we are going to modify the code to inject our payload.

121
00:08:44,720 --> 00:08:45,640
We have to stay away

122
00:08:45,640 --> 00:08:49,080
because otherwise we are going to probably break the MCU.

123
00:08:49,420 --> 00:08:56,940
So the bootloader location is stored in these bits here

124
00:08:57,440 --> 00:09:01,260
in a way that it's documented in the datasheet.

125
00:09:01,360 --> 00:09:04,320
The AVR datasheet says how to set this bit

126
00:09:04,320 --> 00:09:11,980
and how to set the proper bit to give the proper address for the code itself.

127
00:09:12,420 --> 00:09:15,120
Or you can use, for example, an utility like this one,

128
00:09:15,160 --> 00:09:15,620
which is a server.

129
00:09:15,640 --> 00:09:18,860
This is the site that will be referenced in the presentation reference here.

130
00:09:21,420 --> 00:09:25,640
By using some pulldowns menu or some check,

131
00:09:25,800 --> 00:09:28,580
you can, for example, as you can see here,

132
00:09:29,600 --> 00:09:32,320
set the bootloader present and where it is placed.

133
00:09:32,500 --> 00:09:33,160
So in this address.

134
00:09:34,120 --> 00:09:35,480
You can choose this.

135
00:09:35,740 --> 00:09:38,280
If you press a button on the site,

136
00:09:38,480 --> 00:09:42,520
this will compute for you the values of the fuses bits that you have to set

137
00:09:42,520 --> 00:09:45,540
to get this.

138
00:09:45,540 --> 00:09:47,940
This value written on the board.

139
00:09:48,160 --> 00:09:51,220
Consider that the fuses bits can only be read,

140
00:09:52,240 --> 00:09:57,520
but to be written it requires a specific external programmer.

141
00:09:57,840 --> 00:10:01,280
So you can read them with the usual utilities.

142
00:10:01,600 --> 00:10:08,060
We will use the common AVR utilities to perform our job.

143
00:10:08,380 --> 00:10:10,720
So if you download the Arduino IDE,

144
00:10:10,940 --> 00:10:12,240
everything is already there.

145
00:10:12,480 --> 00:10:14,640
You have all the utilities you need

146
00:10:14,640 --> 00:10:18,700
to go ahead with what we are doing tonight,

147
00:10:18,860 --> 00:10:19,680
this evening.

148
00:10:22,260 --> 00:10:22,700
OK.

149
00:10:22,900 --> 00:10:24,980
The bootloader, it's just a section of code,

150
00:10:25,100 --> 00:10:27,860
like all the other sections of the Flash,

151
00:10:28,820 --> 00:10:32,780
but with specific behavior and duties.

152
00:10:35,840 --> 00:10:38,700
So when the AVR is power or reset,

153
00:10:38,840 --> 00:10:39,580
it starts the boot sequence.

154
00:10:39,740 --> 00:10:40,880
So depending on the fuses status,

155
00:10:40,960 --> 00:10:41,380
as we said,

156
00:10:41,560 --> 00:10:43,360
it starts from the address 0,

157
00:10:43,360 --> 00:10:45,300
where we have the jump to the program start,

158
00:10:45,540 --> 00:10:49,220
or it starts the bootloader.

159
00:10:49,280 --> 00:10:52,620
The bootloader has these functionalities,

160
00:10:52,660 --> 00:10:54,740
but they may have also others,

161
00:10:55,320 --> 00:10:57,000
like initializing the control peripheral,

162
00:10:57,700 --> 00:10:59,140
load selected user application,

163
00:11:00,900 --> 00:11:02,780
and upload new code, for example,

164
00:11:02,900 --> 00:11:04,240
by using the USB connection.

165
00:11:04,540 --> 00:11:05,780
So that's very important.

166
00:11:06,040 --> 00:11:08,680
And so what we need to do is to avoid to mess up

167
00:11:08,680 --> 00:11:09,680
with the bootloader code.

168
00:11:10,940 --> 00:11:14,420
You can also decide to get rid of the bootloader

169
00:11:14,420 --> 00:11:18,300
when you are programming on an Arduino AVR board,

170
00:11:18,480 --> 00:11:21,360
because mainly the main reason why you want to do it

171
00:11:21,360 --> 00:11:22,740
is to save space.

172
00:11:22,920 --> 00:11:26,260
When you have to deal with 32 kilobytes of RAM,

173
00:11:26,420 --> 00:11:27,520
of Flash,

174
00:11:28,220 --> 00:11:31,160
you have a situation where the additional two

175
00:11:31,160 --> 00:11:33,080
or four kilobytes used by the bootloader

176
00:11:33,080 --> 00:11:34,400
are very important.

177
00:11:34,480 --> 00:11:36,620
So you may want to not use it.

178
00:11:36,740 --> 00:11:39,540
So if you don't want to use it,

179
00:11:39,540 --> 00:11:41,820
you just have to set the free uses accordingly,

180
00:11:43,140 --> 00:11:46,540
and you can use the bootloader area without any damage.

181
00:11:47,800 --> 00:11:49,480
Consider that the ARDU-Sploit,

182
00:11:49,560 --> 00:11:52,140
which is the script that will automate this process,

183
00:11:52,520 --> 00:11:54,760
it's independent on the presence of the bootloader.

184
00:11:54,820 --> 00:11:57,020
So it will work with a dampened content.

185
00:11:58,120 --> 00:12:02,880
There is no problem if it has been obtained

186
00:12:02,880 --> 00:12:05,080
through the bootloader, through the AVR-DUDE,

187
00:12:05,120 --> 00:12:06,220
through an external program.

188
00:12:06,320 --> 00:12:08,840
It just works with the dampened Flash.

189
00:12:11,760 --> 00:12:16,520
So let's go a bit into the interrupt vector table.

190
00:12:16,740 --> 00:12:23,540
Because I said before, my main target

191
00:12:24,180 --> 00:12:25,780
was to inject the payload.

192
00:12:26,580 --> 00:12:29,340
I said before, OK, I can put it into the main loop,

193
00:12:29,420 --> 00:12:31,300
but I'd lose control on it.

194
00:12:31,580 --> 00:12:34,040
And so the other solution was to try

195
00:12:34,040 --> 00:12:37,840
to use interrupts on the board itself.

196
00:12:38,340 --> 00:12:39,420
What is an interrupt?

197
00:12:39,540 --> 00:12:44,560
It's a way MCU and CPUs use to execute asynchronous code.

198
00:12:44,720 --> 00:12:47,220
So when there is an asynchronous event on an MCU

199
00:12:47,220 --> 00:12:52,300
or on a CPU, usually it is handled by an interrupt

200
00:12:52,300 --> 00:12:55,480
because the program flow can be at this point

201
00:12:55,480 --> 00:12:58,740
interrupted by these calls coming from external events

202
00:12:58,740 --> 00:13:00,520
like a keyboard press or something like that.

203
00:13:00,640 --> 00:13:02,900
So probably you already know this.

204
00:13:04,360 --> 00:13:06,940
So as we said before, the interrupt vector table

205
00:13:06,940 --> 00:13:08,160
is at the beginning of the Flash.

206
00:13:08,820 --> 00:13:10,340
True for the Arduino device.

207
00:13:10,720 --> 00:13:12,780
AVR is also used by other devices,

208
00:13:12,820 --> 00:13:13,820
not only for Arduino.

209
00:13:14,140 --> 00:13:19,100
And so this could be also placed in other place.

210
00:13:20,320 --> 00:13:24,120
And this is defined by these values,

211
00:13:24,340 --> 00:13:26,940
which are the boot RST fuse bit,

212
00:13:27,100 --> 00:13:29,380
the IV cell bit in MCU control register.

213
00:13:31,180 --> 00:13:33,500
These are data coming from the AVR data sheet.

214
00:13:33,700 --> 00:13:36,600
So you can have a look to them.

215
00:13:38,160 --> 00:13:41,460
A very important thing to say is that AVR and HTML

216
00:13:41,460 --> 00:13:46,760
do really a very good job in providing the documentation

217
00:13:46,760 --> 00:13:48,900
of their MCU.

218
00:13:49,100 --> 00:13:52,080
So you can find everything very easily

219
00:13:52,080 --> 00:13:55,980
about how the MCU are working.

220
00:13:57,220 --> 00:14:01,700
So OK, this is the interrupt vector table.

221
00:14:02,060 --> 00:14:03,660
This is coming from, on the left side,

222
00:14:03,700 --> 00:14:07,840
you see the description coming from the data sheet.

223
00:14:08,720 --> 00:14:10,860
On the right side, you see the disassembly

224
00:14:10,860 --> 00:14:13,220
from a dump of the Flash ROM.

225
00:14:13,400 --> 00:14:17,100
As you can see, OK, this is the table.

226
00:14:17,200 --> 00:14:21,500
It describes the position and which kind of function

227
00:14:21,500 --> 00:14:23,880
is handled by this specific interrupt.

228
00:14:25,160 --> 00:14:26,800
In the reality, it's just a jump.

229
00:14:27,020 --> 00:14:30,180
So it's an absolute jump to a specific location.

230
00:14:30,380 --> 00:14:33,540
As you can see here, most of these jumps

231
00:14:33,540 --> 00:14:35,900
are pointing to the same location,

232
00:14:36,020 --> 00:14:37,160
which is in this case,

233
00:14:37,160 --> 00:14:39,620
it's 0xba, xhmlba.

234
00:14:41,580 --> 00:14:43,440
This means that it's not used.

235
00:14:43,620 --> 00:14:45,420
So the interrupt vector is not used because it's jumping.

236
00:14:45,520 --> 00:14:48,140
If you are going to check this address,

237
00:14:48,400 --> 00:14:53,200
it's just a jump back to the 0 location,

238
00:14:53,460 --> 00:14:55,340
so at the very beginning of the problem.

239
00:14:55,500 --> 00:14:58,660
So when you see something different like this one,

240
00:14:58,720 --> 00:15:00,660
that means that the interrupt vector is in use.

241
00:15:00,800 --> 00:15:04,020
And this is actually the address of the ISR,

242
00:15:04,100 --> 00:15:06,220
which is the interrupt service routing.

243
00:15:07,160 --> 00:15:09,480
So the specific code will be executed

244
00:15:09,480 --> 00:15:11,560
when a specific interrupt is triggered.

245
00:15:15,520 --> 00:15:16,860
This output is very important.

246
00:15:17,020 --> 00:15:19,480
It's coming out from a very neat utility

247
00:15:19,480 --> 00:15:22,500
in the AVR toolchain coming with the Arduino environment,

248
00:15:22,680 --> 00:15:25,020
which is the AVR object dump.

249
00:15:25,520 --> 00:15:29,900
This is the most useful utility you have to use

250
00:15:29,900 --> 00:15:31,580
if you want to start to play with assembly

251
00:15:31,580 --> 00:15:34,160
and architecture and AVR architecture.

252
00:15:34,520 --> 00:15:37,100
So it will be your friend.

253
00:15:37,160 --> 00:15:38,000
In these cases.

254
00:15:42,580 --> 00:15:44,600
Different MCU may have different behaviors

255
00:15:45,280 --> 00:15:47,740
because, for example, the position of the vector interrupt

256
00:15:47,740 --> 00:15:48,580
can be different.

257
00:15:49,840 --> 00:15:52,500
And it's important that these things are realized

258
00:15:52,500 --> 00:15:54,780
when I was working on this project.

259
00:15:55,040 --> 00:15:58,260
For some specific MCU,

260
00:16:01,620 --> 00:16:03,880
the intervector table is built in a different way.

261
00:16:03,940 --> 00:16:05,720
For example, for the ATmega2560,

262
00:16:05,720 --> 00:16:10,720
which is the biggest one in this family of the Atmel MCU,

263
00:16:11,820 --> 00:16:16,900
the developers choose a different way

264
00:16:16,900 --> 00:16:19,860
to organize the memory of the compiler program.

265
00:16:19,960 --> 00:16:21,520
Because consider that one important thing,

266
00:16:21,660 --> 00:16:24,040
the intervector table is built by the compiler.

267
00:16:24,440 --> 00:16:29,180
So when the compiler creates the content of the flash

268
00:16:29,180 --> 00:16:33,320
and it uploads it on the MCU,

269
00:16:33,320 --> 00:16:35,980
it will prepare also the intervector table

270
00:16:35,980 --> 00:16:40,320
depending on what it has been done in the sketch.

271
00:16:41,680 --> 00:16:46,360
The GCC developers choose to go for a different solution

272
00:16:46,360 --> 00:16:47,080
for the ATmega.

273
00:16:47,180 --> 00:16:50,360
And they use relative jumps with a 16-bit opcode

274
00:16:50,360 --> 00:16:52,400
instead of the absolute jump.

275
00:16:53,980 --> 00:16:56,900
I can guess the reason of this choice,

276
00:16:57,880 --> 00:17:03,100
because the ATmega has 256 cores.

277
00:17:03,100 --> 00:17:04,220
It's a kilobytes of RAM.

278
00:17:04,400 --> 00:17:08,500
It cannot be addressed by the absolute jump in any case.

279
00:17:09,680 --> 00:17:13,100
So probably they choose to using a paging

280
00:17:15,940 --> 00:17:19,040
management of the memory by using the relative jumps.

281
00:17:19,780 --> 00:17:23,580
And so probably that's why they choose this way

282
00:17:23,580 --> 00:17:24,620
to code their outings.

283
00:17:24,700 --> 00:17:25,720
But in any case, they are deployed.

284
00:17:26,360 --> 00:17:27,600
My script will take care of this.

285
00:17:27,940 --> 00:17:29,220
And depending on the MCU,

286
00:17:29,460 --> 00:17:31,000
we are going to inject the code.

287
00:17:31,660 --> 00:17:32,500
It will act.

288
00:17:33,940 --> 00:17:34,460
Accordingly.

289
00:17:34,960 --> 00:17:35,480
OK.

290
00:17:36,520 --> 00:17:38,660
The last important thing is the entry point

291
00:17:38,660 --> 00:17:43,320
of the sketch of the program we are going to modify.

292
00:17:43,860 --> 00:17:47,600
So we said that we are going to use an interrupt

293
00:17:47,600 --> 00:17:48,340
to inject our code.

294
00:17:48,520 --> 00:17:52,120
But that means that also these interrupts

295
00:17:52,120 --> 00:17:53,580
must be initialized somewhere.

296
00:17:53,880 --> 00:17:58,360
Because otherwise, if you just go to place some code

297
00:17:58,360 --> 00:18:01,440
and modify the jump we saw before at the beginning

298
00:18:01,440 --> 00:18:02,860
without saying anything else

299
00:18:03,100 --> 00:18:03,680
to the MCU,

300
00:18:04,260 --> 00:18:05,640
I will not get anything

301
00:18:05,640 --> 00:18:08,440
because the interrupt itself is not initialized.

302
00:18:08,620 --> 00:18:12,840
So I need to find the entry point of the sketch itself

303
00:18:12,840 --> 00:18:15,640
to initialize the interrupt vector I'm using

304
00:18:15,640 --> 00:18:18,880
and say, OK, execute this every now and then

305
00:18:18,880 --> 00:18:19,680
when I tell you.

306
00:18:19,800 --> 00:18:26,940
And go ahead with the code.

307
00:18:27,940 --> 00:18:31,840
This is a specific section got from the AVROBG dump

308
00:18:31,840 --> 00:18:32,520
I said before.

309
00:18:33,480 --> 00:18:36,700
Run with this syntax here.

310
00:18:37,340 --> 00:18:44,300
And this is more or less from 99% of the code I checked

311
00:18:45,260 --> 00:18:50,380
where the initialization of the code itself begins.

312
00:18:50,540 --> 00:18:56,340
So the compiler, after the jump of the location 0

313
00:18:56,340 --> 00:18:57,920
and then it comes here,

314
00:18:58,100 --> 00:19:00,300
it executes these two jumps and then there

315
00:19:00,300 --> 00:19:02,600
is this closing jump to 0 again here.

316
00:19:02,740 --> 00:19:06,240
This is where the preamble routings of the compiler

317
00:19:06,240 --> 00:19:11,060
are handling over the control to the application, let's say.

318
00:19:11,260 --> 00:19:14,160
And so this is where we need to look

319
00:19:14,160 --> 00:19:15,680
for the proper entry point.

320
00:19:15,820 --> 00:19:18,900
Because if we put our initialization routing too early,

321
00:19:19,400 --> 00:19:26,700
it will be overwritten by the initial setup done

322
00:19:26,700 --> 00:19:27,860
by the compiler itself.

323
00:19:28,140 --> 00:19:30,180
So we need to find out the proper way

324
00:19:30,300 --> 00:19:33,640
to put the proper place to put our code here.

325
00:19:34,460 --> 00:19:37,280
And so this will be where we have to find out.

326
00:19:38,380 --> 00:19:40,460
My script will automate this process.

327
00:19:40,860 --> 00:19:46,120
And it has also some built-in addresses

328
00:19:46,120 --> 00:19:54,000
where I know for some program we can safely inject our code.

329
00:19:54,740 --> 00:19:58,060
This will not work for every single sketch.

330
00:19:58,060 --> 00:20:01,120
This requires a bit of manual processing in case.

331
00:20:01,380 --> 00:20:06,520
So you have to have a look around this address here or here,

332
00:20:06,640 --> 00:20:09,420
mainly here, to find the proper place

333
00:20:09,420 --> 00:20:13,020
if it is not working automatically as we expect.

334
00:20:13,320 --> 00:20:19,240
So this is the entry point where we need to do our job.

335
00:20:22,520 --> 00:20:25,720
As we said, we need to dump the content of the flash

336
00:20:26,660 --> 00:20:28,040
because we need to get that out.

337
00:20:28,060 --> 00:20:32,600
We need to get that out from the board itself,

338
00:20:32,700 --> 00:20:34,020
what is already running there.

339
00:20:34,300 --> 00:20:39,100
And OK, this is just the syntax of the well-known

340
00:20:39,100 --> 00:20:43,540
utility in order to just define

341
00:20:43,940 --> 00:20:48,680
which kind of process we are working on

342
00:20:48,680 --> 00:20:53,960
and the speed of the for the port and so on.

343
00:20:54,160 --> 00:20:55,460
And this is the important part.

344
00:20:55,660 --> 00:20:57,820
This is saying, OK, read the content

345
00:20:58,060 --> 00:21:01,960
of the flash and write it on the .hex file.

346
00:21:02,800 --> 00:21:07,140
This dot, comma, I here say specify the format

347
00:21:07,140 --> 00:21:10,020
of the output file, which will be, in this case,

348
00:21:10,080 --> 00:21:11,560
the hex file.

349
00:21:11,840 --> 00:21:15,580
You can also dump the content into binary files.

350
00:21:16,260 --> 00:21:20,460
In this case, we are going to use the hex file

351
00:21:20,460 --> 00:21:23,840
because it will be easier to manage through the script.

352
00:21:24,000 --> 00:21:25,920
The script itself will take care of everything

353
00:21:25,920 --> 00:21:27,660
so you don't have to mess up

354
00:21:27,660 --> 00:21:29,540
with the format.

355
00:21:29,660 --> 00:21:32,720
It will get this specific format

356
00:21:32,720 --> 00:21:36,420
and it will change everything to inject the payload.

357
00:21:36,760 --> 00:21:40,700
This is how exactly looks a .hex file

358
00:21:40,700 --> 00:21:42,080
dumped from an Arduino.

359
00:21:42,880 --> 00:21:44,680
The format, it's a standard one,

360
00:21:44,760 --> 00:21:49,140
so it's not nothing very custom or something.

361
00:21:49,460 --> 00:21:50,540
This is the description.

362
00:21:50,800 --> 00:21:53,620
So you have the line start with the column.

363
00:21:55,460 --> 00:21:57,280
The byte count for the line.

364
00:21:57,660 --> 00:22:01,980
The address where the byte code are written.

365
00:22:02,400 --> 00:22:04,400
Our record type, it's always zero

366
00:22:04,400 --> 00:22:07,500
for the dumped content of the .hex.

367
00:22:07,500 --> 00:22:08,220
And there is the data.

368
00:22:08,300 --> 00:22:09,440
This is actually assembly code.

369
00:22:09,720 --> 00:22:11,600
Consider that and keep into consideration

370
00:22:11,600 --> 00:22:16,540
that the .hex, .hex, .hex are

371
00:22:16,540 --> 00:22:17,660
a little Indian architecture.

372
00:22:17,960 --> 00:22:19,300
So the byte are swooped.

373
00:22:19,460 --> 00:22:23,640
So here you have to swoop the bytes

374
00:22:23,640 --> 00:22:26,840
to read the proper code of the assembly line.

375
00:22:27,760 --> 00:22:29,480
And then there is a checksum at the end

376
00:22:30,040 --> 00:22:33,140
for the line.

377
00:22:33,660 --> 00:22:35,840
The hard-to-sploit will modify everything

378
00:22:37,600 --> 00:22:39,600
and the checksum as well.

379
00:22:39,720 --> 00:22:41,800
So you don't have to take care of this.

380
00:22:42,160 --> 00:22:42,660
Okay.

381
00:22:44,020 --> 00:22:45,720
Let's prepare something to inject.

382
00:22:46,040 --> 00:22:50,580
This is the hello world for the hardware hacking,

383
00:22:50,720 --> 00:22:51,580
so a blinking LED.

384
00:22:52,200 --> 00:22:54,320
This is the assembly code to blink a LED

385
00:22:54,880 --> 00:22:56,540
on a specific board.

386
00:22:56,540 --> 00:22:58,920
This could be different depending on the board

387
00:22:58,920 --> 00:23:01,000
you are working with because, for example,

388
00:23:01,540 --> 00:23:03,180
we will see during the live demo,

389
00:23:03,360 --> 00:23:07,200
we will make an Arduino Uno blinking.

390
00:23:08,620 --> 00:23:12,440
The LED is on a specific line of the MCU in this case,

391
00:23:12,480 --> 00:23:14,020
and so it is defined here,

392
00:23:15,180 --> 00:23:17,160
which is the first instruction here.

393
00:23:18,520 --> 00:23:19,680
Obviously, if you are working,

394
00:23:19,780 --> 00:23:21,080
and we can see if you have time,

395
00:23:21,200 --> 00:23:23,540
with another board like the Arduino micro,

396
00:23:24,180 --> 00:23:26,520
for example, the LED is on another board.

397
00:23:26,540 --> 00:23:29,560
So we have to change this.

398
00:23:29,720 --> 00:23:32,520
But the script will provide some example payloads

399
00:23:32,520 --> 00:23:35,180
already done for different architecture.

400
00:23:35,600 --> 00:23:38,500
So also these things will be automated.

401
00:23:38,900 --> 00:23:41,440
This is just a bunch of assembly.

402
00:23:41,880 --> 00:23:42,480
Okay.

403
00:23:43,660 --> 00:23:47,220
As I said, we have most different of them

404
00:23:47,220 --> 00:23:53,140
for specific different boards.

405
00:23:53,360 --> 00:23:54,840
I prepared this in the script.

406
00:23:55,060 --> 00:23:56,040
The script itself,

407
00:23:56,540 --> 00:23:56,820
and then Python.

408
00:23:57,560 --> 00:23:59,080
I'm not a Python guru.

409
00:23:59,360 --> 00:24:00,220
You will see it.

410
00:24:01,160 --> 00:24:05,680
I choose Python because it was easy to understand

411
00:24:05,680 --> 00:24:08,380
and to write the script in,

412
00:24:08,460 --> 00:24:11,360
but there are a lot of room for improvements

413
00:24:11,360 --> 00:24:13,140
in my encoding there.

414
00:24:13,340 --> 00:24:16,440
So you can also help me in doing this

415
00:24:16,440 --> 00:24:17,740
because obviously this will be,

416
00:24:17,800 --> 00:24:19,580
everything will be open source,

417
00:24:19,640 --> 00:24:24,480
so everything will be available for modification.

418
00:24:24,480 --> 00:24:29,180
So let's go on.

419
00:24:29,300 --> 00:24:29,720
Okay.

420
00:24:30,640 --> 00:24:32,720
We said before that we may have,

421
00:24:33,600 --> 00:24:35,200
okay, we are going to use an interrupt,

422
00:24:35,400 --> 00:24:39,240
but the interrupt can be also already in use.

423
00:24:39,320 --> 00:24:41,320
We said that we are going to inject code

424
00:24:41,320 --> 00:24:43,140
in an unknown application.

425
00:24:43,880 --> 00:24:46,540
So if the interrupt itself is already used,

426
00:24:46,660 --> 00:24:48,440
we have to handle the situation.

427
00:24:49,460 --> 00:24:50,400
And the script itself,

428
00:24:50,520 --> 00:24:51,580
it's able to do it.

429
00:24:52,040 --> 00:24:53,160
Actually, it will check

430
00:24:53,160 --> 00:24:57,940
if the interrupt we choose is already in use,

431
00:24:58,080 --> 00:25:00,340
and it will prepend our code

432
00:25:01,240 --> 00:25:03,320
to the existing routing

433
00:25:03,320 --> 00:25:05,840
so that everything will be executed,

434
00:25:06,120 --> 00:25:07,760
and then there will be a jump

435
00:25:07,760 --> 00:25:09,400
to the original routing,

436
00:25:09,850 --> 00:25:13,040
leaving the original functionalities untouched.

437
00:25:16,930 --> 00:25:17,860
Important thing to say

438
00:25:17,860 --> 00:25:19,680
when you write your PyPayload here

439
00:25:19,680 --> 00:25:22,340
is that you need to leave everything

440
00:25:23,880 --> 00:25:24,360
untouched.

441
00:25:24,400 --> 00:25:25,780
So you have to push and pop

442
00:25:25,780 --> 00:25:26,840
every single variable

443
00:25:26,840 --> 00:25:28,080
you are going to use

444
00:25:28,080 --> 00:25:28,940
in your assembly language

445
00:25:28,940 --> 00:25:32,900
to the original value,

446
00:25:33,020 --> 00:25:34,540
because since you don't know

447
00:25:34,540 --> 00:25:37,400
when exactly your code will be executed,

448
00:25:37,660 --> 00:25:39,140
it can be executed

449
00:25:40,580 --> 00:25:42,540
in a time that you don't know,

450
00:25:42,600 --> 00:25:44,340
and you don't know the application

451
00:25:44,340 --> 00:25:46,040
where you are working on,

452
00:25:46,180 --> 00:25:46,940
it's very important

453
00:25:46,940 --> 00:25:48,280
that you don't touch anything

454
00:25:48,280 --> 00:25:49,740
on what is in the stack,

455
00:25:50,700 --> 00:25:52,460
and you leave it exactly

456
00:25:52,460 --> 00:25:53,440
as it was.

457
00:25:55,340 --> 00:25:56,760
Okay, so this is the push,

458
00:25:57,280 --> 00:25:58,080
that's why I told you

459
00:25:58,080 --> 00:25:59,020
that I'm not a Python programmer,

460
00:25:59,100 --> 00:25:59,700
so you will see that.

461
00:26:00,120 --> 00:26:00,520
Okay.

462
00:26:01,280 --> 00:26:02,760
It could be written probably better,

463
00:26:03,280 --> 00:26:04,940
where we can take care of

464
00:26:05,520 --> 00:26:10,380
the presence of the existing ISR,

465
00:26:10,520 --> 00:26:11,560
and the script itself

466
00:26:11,560 --> 00:26:16,720
is going to inject the code.

467
00:26:17,440 --> 00:26:19,560
Okay, we said that we are going to use

468
00:26:19,560 --> 00:26:19,960
an interrupt.

469
00:26:20,160 --> 00:26:20,600
Which one?

470
00:26:22,460 --> 00:26:23,260
We can choose,

471
00:26:23,360 --> 00:26:24,820
because the script itself

472
00:26:24,820 --> 00:26:25,400
it's not,

473
00:26:25,480 --> 00:26:26,580
it can be also modified,

474
00:26:26,820 --> 00:26:28,860
but for this presentation

475
00:26:28,860 --> 00:26:30,480
I tried to use the timer interrupt.

476
00:26:31,020 --> 00:26:33,560
There are different timer interrupts

477
00:26:33,560 --> 00:26:36,760
in the AVR architecture,

478
00:26:37,540 --> 00:26:39,540
some 8 bits, some 16 bits,

479
00:26:39,660 --> 00:26:41,840
different also depending on the boards.

480
00:26:42,100 --> 00:26:43,280
What is a timer interrupt?

481
00:26:43,520 --> 00:26:45,360
It's a specific interrupt

482
00:26:45,360 --> 00:26:46,900
that's called every now and then,

483
00:26:47,060 --> 00:26:49,020
so with a specific interval we decide.

484
00:26:49,300 --> 00:26:50,220
So we can say, okay,

485
00:26:50,280 --> 00:26:51,040
execute this interrupt

486
00:26:51,040 --> 00:26:52,620
every one second.

487
00:26:53,000 --> 00:26:53,560
Okay.

488
00:26:56,960 --> 00:26:59,440
And the number of bits

489
00:26:59,440 --> 00:27:00,860
of the interrupts

490
00:27:01,680 --> 00:27:05,040
are defining the value

491
00:27:05,700 --> 00:27:06,860
of this interval we can define.

492
00:27:06,980 --> 00:27:07,520
So the bigger,

493
00:27:07,700 --> 00:27:12,280
the greater delay we can have

494
00:27:12,280 --> 00:27:13,380
between the two executions.

495
00:27:15,060 --> 00:27:16,060
Timers are increased

496
00:27:16,060 --> 00:27:17,580
at each clock tick.

497
00:27:17,720 --> 00:27:18,860
In CTC mode,

498
00:27:18,900 --> 00:27:19,880
the interrupt is triggered

499
00:27:19,880 --> 00:27:20,760
when the timer reaches

500
00:27:21,040 --> 00:27:21,500
a specific value.

501
00:27:21,800 --> 00:27:24,300
And so this is what we have to do.

502
00:27:24,380 --> 00:27:25,260
So we have to write

503
00:27:25,260 --> 00:27:26,500
our initialization code

504
00:27:26,890 --> 00:27:28,220
in order to initialize the interrupt

505
00:27:28,220 --> 00:27:30,520
to be executed when we want.

506
00:27:30,740 --> 00:27:31,840
By choosing the matching value

507
00:27:31,840 --> 00:27:32,200
and speed,

508
00:27:32,440 --> 00:27:33,940
you can control the frequency.

509
00:27:34,140 --> 00:27:34,880
So we can control

510
00:27:34,880 --> 00:27:37,080
how often our code will be executed.

511
00:27:40,120 --> 00:27:40,580
Okay.

512
00:27:40,620 --> 00:27:41,720
So the timer speed,

513
00:27:42,700 --> 00:27:45,120
the MCU are working at 16 megahertz,

514
00:27:45,180 --> 00:27:47,460
so we have a tick every 0 comma,

515
00:27:49,260 --> 00:27:49,720
okay,

516
00:27:49,720 --> 00:27:50,580
some zero,

517
00:27:50,620 --> 00:27:51,100
then 63,

518
00:27:51,300 --> 00:27:54,960
which is every four milliseconds.

519
00:27:55,240 --> 00:27:56,660
But you can also control the speed

520
00:27:56,660 --> 00:27:57,400
with a press color,

521
00:27:57,520 --> 00:28:00,080
so you can slow down this counter.

522
00:28:02,900 --> 00:28:04,440
And so I have the execution

523
00:28:04,440 --> 00:28:06,560
not every four milliseconds,

524
00:28:06,740 --> 00:28:08,500
but maybe also with greater values.

525
00:28:09,900 --> 00:28:10,720
So, okay,

526
00:28:11,740 --> 00:28:12,620
the press color,

527
00:28:12,780 --> 00:28:13,020
okay,

528
00:28:13,100 --> 00:28:14,780
is the value that you can use

529
00:28:14,780 --> 00:28:15,980
to slow down this execution.

530
00:28:18,280 --> 00:28:19,540
And it's set

531
00:28:19,720 --> 00:28:21,940
through the specific register

532
00:28:21,940 --> 00:28:25,260
on the MCU itself,

533
00:28:26,100 --> 00:28:27,080
which is documented

534
00:28:27,080 --> 00:28:29,220
as well as all the other things

535
00:28:29,220 --> 00:28:29,980
in the data sheets.

536
00:28:30,200 --> 00:28:32,120
And so you can specify it

537
00:28:32,120 --> 00:28:33,400
by setting these bits here.

538
00:28:33,600 --> 00:28:34,540
And we will see

539
00:28:34,540 --> 00:28:35,960
that our initialization code

540
00:28:36,620 --> 00:28:38,220
is doing is actually set up

541
00:28:38,220 --> 00:28:39,540
all these bits

542
00:28:39,540 --> 00:28:42,720
to set up the interrupt timer

543
00:28:42,720 --> 00:28:43,420
to the proper values.

544
00:28:45,520 --> 00:28:46,000
Okay.

545
00:28:46,060 --> 00:28:48,300
This is a quick computation

546
00:28:48,300 --> 00:28:50,080
of how we can compute the frequency.

547
00:28:51,220 --> 00:28:52,480
So the interrupt is triggered

548
00:28:52,480 --> 00:28:54,940
when the ticks reach the value

549
00:28:54,940 --> 00:28:56,140
in the compare match register.

550
00:28:56,660 --> 00:28:57,940
And to compute the value,

551
00:28:58,000 --> 00:28:59,040
I have to do some math,

552
00:28:59,200 --> 00:29:02,940
like dividing 16 million

553
00:29:02,940 --> 00:29:06,060
by the press color value here

554
00:29:06,060 --> 00:29:07,940
and by the frequency we want.

555
00:29:08,060 --> 00:29:08,540
For example,

556
00:29:08,700 --> 00:29:10,140
if we want an execution

557
00:29:10,140 --> 00:29:11,880
of two per second,

558
00:29:11,960 --> 00:29:12,980
so every half a second,

559
00:29:13,160 --> 00:29:14,180
we have to set up

560
00:29:14,180 --> 00:29:17,820
the compare match register

561
00:29:17,820 --> 00:29:18,280
to this value.

562
00:29:18,300 --> 00:29:20,440
And this is what exactly

563
00:29:20,440 --> 00:29:21,960
we are doing here

564
00:29:23,800 --> 00:29:25,400
with this set of code.

565
00:29:25,500 --> 00:29:26,960
This is the macros used

566
00:29:26,960 --> 00:29:28,820
in the Arduino IDE.

567
00:29:29,140 --> 00:29:30,380
And this is the translation

568
00:29:30,380 --> 00:29:32,760
in assembly language.

569
00:29:33,140 --> 00:29:35,500
This will be the portion of code

570
00:29:35,500 --> 00:29:38,060
that I defined as initialization

571
00:29:38,060 --> 00:29:38,720
of the interrupt.

572
00:29:38,920 --> 00:29:40,100
So we have to put this

573
00:29:40,620 --> 00:29:41,840
at the beginning

574
00:29:41,840 --> 00:29:43,120
in some way of the sketch

575
00:29:43,120 --> 00:29:45,640
and then inject our code

576
00:29:46,280 --> 00:29:47,240
in the interrupt timer.

577
00:29:50,760 --> 00:29:51,220
So...

578
00:29:54,560 --> 00:29:55,580
Okay, we have to find

579
00:29:55,580 --> 00:29:56,760
free space obviously

580
00:29:56,760 --> 00:29:57,400
to do this

581
00:29:57,400 --> 00:29:58,840
because we need to add some code

582
00:29:58,840 --> 00:29:59,680
to the existing one.

583
00:30:00,660 --> 00:30:01,900
Okay, as we said

584
00:30:01,900 --> 00:30:02,320
at the beginning,

585
00:30:02,460 --> 00:30:03,040
we have to avoid

586
00:30:03,040 --> 00:30:04,100
the bootloader RF present

587
00:30:04,100 --> 00:30:04,760
because otherwise

588
00:30:04,760 --> 00:30:06,380
we are going to break up things.

589
00:30:06,880 --> 00:30:07,700
We have to look

590
00:30:07,700 --> 00:30:08,300
for unused space,

591
00:30:09,340 --> 00:30:10,460
which is usually marked

592
00:30:10,460 --> 00:30:12,000
as 0xff.

593
00:30:12,380 --> 00:30:13,620
And so the script itself

594
00:30:13,620 --> 00:30:15,680
tries to find

595
00:30:15,680 --> 00:30:16,820
the proper aligned space

596
00:30:17,520 --> 00:30:18,640
unused space.

597
00:30:20,680 --> 00:30:21,360
But...

598
00:30:21,360 --> 00:30:22,900
Okay, what if

599
00:30:22,900 --> 00:30:26,140
the space is not available?

600
00:30:26,560 --> 00:30:27,780
We may have to condition.

601
00:30:28,300 --> 00:30:30,300
You don't have space

602
00:30:30,300 --> 00:30:31,720
marked as 0xff

603
00:30:31,720 --> 00:30:33,540
because maybe

604
00:30:33,540 --> 00:30:34,640
a bigger program

605
00:30:34,640 --> 00:30:35,780
was loaded on the sketch

606
00:30:35,780 --> 00:30:37,080
on the MCU before

607
00:30:37,080 --> 00:30:38,400
and then replaced

608
00:30:38,400 --> 00:30:39,160
with something else.

609
00:30:39,820 --> 00:30:40,500
Or...

610
00:30:41,460 --> 00:30:42,680
Because it's actually

611
00:30:42,680 --> 00:30:44,020
everything it's used.

612
00:30:44,260 --> 00:30:45,980
If the second case

613
00:30:45,980 --> 00:30:48,320
you don't have any way

614
00:30:48,320 --> 00:30:49,460
to inject the code actually

615
00:30:49,460 --> 00:30:50,200
because, okay,

616
00:30:50,260 --> 00:30:52,080
you don't have free space

617
00:30:52,080 --> 00:30:53,260
on the flash run.

618
00:30:53,600 --> 00:30:55,060
But in the first one,

619
00:30:55,720 --> 00:30:57,180
yes, because you can

620
00:30:57,180 --> 00:30:59,160
in the script specify manually

621
00:30:59,160 --> 00:31:01,040
the address to put the code.

622
00:31:04,100 --> 00:31:05,640
Okay, and this is what

623
00:31:05,640 --> 00:31:08,020
then the script will do

624
00:31:08,020 --> 00:31:09,060
to prepare the...

625
00:31:11,180 --> 00:31:12,980
the code to be injected back.

626
00:31:13,180 --> 00:31:15,420
So it will take care of...

627
00:31:15,980 --> 00:31:18,000
all the alignment and so on

628
00:31:18,000 --> 00:31:18,840
and it will prepare

629
00:31:19,580 --> 00:31:20,600
the X file,

630
00:31:20,820 --> 00:31:21,940
as we said before,

631
00:31:22,240 --> 00:31:23,540
ready to be injected.

632
00:31:24,940 --> 00:31:25,460
Okay.

633
00:31:25,640 --> 00:31:27,060
You remember the last slide

634
00:31:27,060 --> 00:31:28,160
we saw at the beginning

635
00:31:28,160 --> 00:31:30,620
with the flash memory...

636
00:31:32,300 --> 00:31:32,820
structure.

637
00:31:33,160 --> 00:31:33,980
This is what we are going

638
00:31:33,980 --> 00:31:34,780
to modify actually.

639
00:31:35,040 --> 00:31:35,340
So...

640
00:31:36,620 --> 00:31:37,460
Intervector table,

641
00:31:37,620 --> 00:31:39,060
we will get the jump

642
00:31:39,060 --> 00:31:39,560
to the routing

643
00:31:40,200 --> 00:31:42,400
and we will modify it to...

644
00:31:42,820 --> 00:31:43,820
with a jump of our

645
00:31:43,820 --> 00:31:44,980
injected code here.

646
00:31:45,440 --> 00:31:45,960
And...

647
00:31:45,980 --> 00:31:46,720
and then we have to

648
00:31:47,360 --> 00:31:48,560
initialize the timer...

649
00:31:50,040 --> 00:31:50,480
here.

650
00:31:51,320 --> 00:31:52,780
We have to find the free space

651
00:31:53,440 --> 00:31:54,820
and allocate our...

652
00:31:54,820 --> 00:31:55,640
our code.

653
00:31:58,020 --> 00:31:59,060
So, as you can see,

654
00:31:59,080 --> 00:32:00,200
you need a bit of space

655
00:32:00,920 --> 00:32:02,220
to inject these two portions

656
00:32:02,220 --> 00:32:02,800
of codes here.

657
00:32:05,180 --> 00:32:06,000
Okay, what...

658
00:32:06,000 --> 00:32:07,520
what R-Disployed can do

659
00:32:07,520 --> 00:32:07,980
automatically?

660
00:32:08,140 --> 00:32:08,520
Because, okay,

661
00:32:08,560 --> 00:32:09,500
we now...

662
00:32:10,060 --> 00:32:10,860
spoke about

663
00:32:11,480 --> 00:32:12,300
what has...

664
00:32:12,300 --> 00:32:12,900
should be done,

665
00:32:13,020 --> 00:32:14,060
but, okay,

666
00:32:14,160 --> 00:32:15,220
what the script itself

667
00:32:15,220 --> 00:32:15,740
is doing?

668
00:32:16,240 --> 00:32:17,540
So, it gives you

669
00:32:17,540 --> 00:32:18,660
some example payloads

670
00:32:18,660 --> 00:32:19,340
ready to be modified.

671
00:32:19,540 --> 00:32:20,460
Okay, it's blinking light,

672
00:32:20,600 --> 00:32:21,360
but it could be also

673
00:32:21,360 --> 00:32:21,980
something different.

674
00:32:22,340 --> 00:32:24,020
It has a radiant usable

675
00:32:24,020 --> 00:32:25,620
interrupt initialization routing,

676
00:32:26,220 --> 00:32:27,280
which will be injected

677
00:32:27,280 --> 00:32:28,220
in the proper place.

678
00:32:28,820 --> 00:32:29,900
It finds free space

679
00:32:29,900 --> 00:32:30,420
in the flash

680
00:32:30,420 --> 00:32:31,460
to place the payload

681
00:32:32,480 --> 00:32:33,400
and the interrupt

682
00:32:33,400 --> 00:32:34,340
initialization routing.

683
00:32:35,340 --> 00:32:36,280
It plays the code

684
00:32:36,280 --> 00:32:36,860
and takes care

685
00:32:36,860 --> 00:32:37,680
of the replaced code

686
00:32:37,680 --> 00:32:38,760
because, obviously,

687
00:32:38,840 --> 00:32:40,760
we are going to modify

688
00:32:40,760 --> 00:32:41,680
the existing flash.

689
00:32:41,760 --> 00:32:42,280
So, everything

690
00:32:42,280 --> 00:32:43,240
that is already existing

691
00:32:43,240 --> 00:32:43,920
we are going to

692
00:32:43,920 --> 00:32:44,160
override

693
00:32:44,160 --> 00:32:45,280
and it needs to be

694
00:32:45,280 --> 00:32:45,860
executed again.

695
00:32:45,940 --> 00:32:45,960
So, we are going to

696
00:32:45,960 --> 00:32:46,520
do that again

697
00:32:46,520 --> 00:32:47,660
at the end

698
00:32:47,660 --> 00:32:48,640
of our code.

699
00:32:48,780 --> 00:32:49,640
So, it will take

700
00:32:49,640 --> 00:32:50,200
care of this

701
00:32:50,840 --> 00:32:51,600
and it will

702
00:32:52,480 --> 00:32:52,920
automatically

703
00:32:52,920 --> 00:32:53,740
manage also

704
00:32:53,740 --> 00:32:54,380
the presence

705
00:32:54,380 --> 00:32:55,100
of an existing

706
00:32:55,100 --> 00:32:56,240
interrupt service routing.

707
00:32:57,220 --> 00:32:58,020
Managing and placing

708
00:32:58,020 --> 00:32:58,620
all the needed

709
00:32:58,620 --> 00:32:59,020
opcodes.

710
00:32:59,180 --> 00:33:00,160
So, everything

711
00:33:00,160 --> 00:33:00,620
will be done

712
00:33:00,620 --> 00:33:01,060
automatically

713
00:33:01,060 --> 00:33:01,600
by the script.

714
00:33:03,280 --> 00:33:04,400
And then it generates

715
00:33:04,400 --> 00:33:05,660
an output

716
00:33:05,660 --> 00:33:06,320
which will be

717
00:33:07,220 --> 00:33:08,000
X file

718
00:33:08,000 --> 00:33:08,740
ready to be

719
00:33:08,740 --> 00:33:09,160
written back

720
00:33:09,160 --> 00:33:09,580
on the flash.

721
00:33:11,520 --> 00:33:12,340
As I said,

722
00:33:12,420 --> 00:33:12,780
it's independent

723
00:33:12,780 --> 00:33:13,500
on the way

724
00:33:13,500 --> 00:33:14,180
we are using.

725
00:33:14,380 --> 00:33:15,320
We can use a VRDU,

726
00:33:15,960 --> 00:33:16,040
we can use

727
00:33:16,040 --> 00:33:17,820
an external programmer

728
00:33:17,820 --> 00:33:19,260
or something like that.

729
00:33:19,360 --> 00:33:19,440
So,

730
00:33:19,500 --> 00:33:20,540
this is

731
00:33:20,540 --> 00:33:21,300
external

732
00:33:21,300 --> 00:33:22,060
to the script itself.

733
00:33:22,680 --> 00:33:23,580
So, this is

734
00:33:23,580 --> 00:33:24,040
what exactly

735
00:33:25,000 --> 00:33:25,980
what the script

736
00:33:25,980 --> 00:33:26,340
is doing.

737
00:33:26,760 --> 00:33:27,600
Okay, there are

738
00:33:27,600 --> 00:33:28,080
a few options

739
00:33:28,080 --> 00:33:28,460
available

740
00:33:28,460 --> 00:33:29,420
on the script.

741
00:33:31,860 --> 00:33:32,380
Okay,

742
00:33:32,480 --> 00:33:33,380
verbose out

743
00:33:33,380 --> 00:33:33,960
with dry run

744
00:33:33,960 --> 00:33:34,740
we will see

745
00:33:34,740 --> 00:33:34,920
maybe

746
00:33:34,920 --> 00:33:36,000
the live demo.

747
00:33:37,060 --> 00:33:38,040
The possibility

748
00:33:38,040 --> 00:33:39,080
to specify

749
00:33:40,300 --> 00:33:41,380
where to place

750
00:33:41,380 --> 00:33:42,180
the payload

751
00:33:42,180 --> 00:33:42,900
and the

752
00:33:42,900 --> 00:33:43,160
initialization

753
00:33:43,800 --> 00:33:44,140
payload.

754
00:33:44,420 --> 00:33:44,900
Otherwise,

755
00:33:45,040 --> 00:33:45,600
it will be

756
00:33:45,960 --> 00:33:46,360
automatically

757
00:33:46,840 --> 00:33:47,100
computed.

758
00:33:47,960 --> 00:33:48,480
And,

759
00:33:48,640 --> 00:33:49,140
okay,

760
00:33:49,380 --> 00:33:49,900
they specify

761
00:33:49,900 --> 00:33:50,360
the MCU

762
00:33:50,360 --> 00:33:51,500
to work with

763
00:33:51,500 --> 00:33:52,660
because every MCU

764
00:33:52,660 --> 00:33:53,520
has different

765
00:33:54,640 --> 00:33:55,160
behaviors.

766
00:33:57,620 --> 00:33:58,140
Okay,

767
00:33:58,320 --> 00:33:59,140
we can also automate

768
00:33:59,140 --> 00:33:59,580
the process.

769
00:33:59,820 --> 00:34:00,660
We will see it

770
00:34:00,660 --> 00:34:01,560
during the live demo

771
00:34:01,560 --> 00:34:03,520
with a $13 device

772
00:34:03,520 --> 00:34:04,240
which is

773
00:34:04,240 --> 00:34:04,940
LinkySmart

774
00:34:04,940 --> 00:34:05,440
or similar.

775
00:34:05,660 --> 00:34:06,300
The importance

776
00:34:06,300 --> 00:34:06,640
is to have

777
00:34:06,640 --> 00:34:07,220
the Python support.

778
00:34:08,320 --> 00:34:09,400
A hot plug

779
00:34:09,400 --> 00:34:09,980
to the script

780
00:34:09,980 --> 00:34:10,760
which is just

781
00:34:10,760 --> 00:34:11,240
a demo

782
00:34:11,240 --> 00:34:11,740
that recognizes

783
00:34:11,740 --> 00:34:12,240
that something

784
00:34:12,240 --> 00:34:12,660
has been

785
00:34:13,760 --> 00:34:14,580
plugged into

786
00:34:14,580 --> 00:34:14,940
the

787
00:34:16,180 --> 00:34:16,700
USB.

788
00:34:17,700 --> 00:34:18,340
They are

789
00:34:18,340 --> 00:34:18,520
displayed

790
00:34:18,520 --> 00:34:20,240
in 30 seconds.

791
00:34:20,300 --> 00:34:20,540
You can

792
00:34:20,540 --> 00:34:21,420
inject the code

793
00:34:21,420 --> 00:34:22,520
without tapping

794
00:34:22,520 --> 00:34:23,140
any command.

795
00:34:23,400 --> 00:34:23,720
We will

796
00:34:23,720 --> 00:34:24,820
see also

797
00:34:24,820 --> 00:34:25,340
this during

798
00:34:25,340 --> 00:34:25,580
the

799
00:34:27,040 --> 00:34:27,560
presentation.

800
00:34:27,900 --> 00:34:27,960
So,

801
00:34:28,020 --> 00:34:28,360
this is the

802
00:34:28,360 --> 00:34:28,800
hardware needed

803
00:34:28,800 --> 00:34:29,100
for,

804
00:34:29,160 --> 00:34:29,640
for example,

805
00:34:29,640 --> 00:34:30,140
doing this

806
00:34:30,140 --> 00:34:30,500
automatic

807
00:34:31,260 --> 00:34:31,780
injection.

808
00:34:32,120 --> 00:34:32,340
So,

809
00:34:32,380 --> 00:34:32,820
it's just

810
00:34:32,820 --> 00:34:33,380
okay,

811
00:34:34,200 --> 00:34:34,440
this

812
00:34:34,440 --> 00:34:35,160
is

813
00:34:35,160 --> 00:34:35,920
this board here.

814
00:34:36,000 --> 00:34:36,920
This is an unusual

815
00:34:36,920 --> 00:34:37,380
Arduino

816
00:34:39,360 --> 00:34:39,660
device.

817
00:34:40,140 --> 00:34:40,660
In the software,

818
00:34:40,780 --> 00:34:41,400
it's just

819
00:34:41,400 --> 00:34:42,660
a few configurations

820
00:34:42,660 --> 00:34:43,100
here

821
00:34:43,100 --> 00:34:44,080
just to recognize

822
00:34:44,080 --> 00:34:45,340
that an Arduino

823
00:34:45,340 --> 00:34:46,100
device has been

824
00:34:46,100 --> 00:34:46,400
put,

825
00:34:46,600 --> 00:34:47,700
has been plugged

826
00:34:47,700 --> 00:34:48,860
in with this one

827
00:34:48,860 --> 00:34:49,840
and then just

828
00:34:49,840 --> 00:34:50,600
the execution

829
00:34:51,440 --> 00:34:51,980
of the

830
00:34:52,800 --> 00:34:53,400
AVR

831
00:34:53,400 --> 00:34:54,580
display

832
00:34:54,580 --> 00:34:55,220
the script

833
00:34:55,220 --> 00:34:55,500
itself.

834
00:34:56,180 --> 00:34:56,480
So,

835
00:34:56,500 --> 00:34:56,840
this is

836
00:34:56,840 --> 00:34:57,120
what

837
00:34:57,120 --> 00:34:58,240
exactly

838
00:34:58,900 --> 00:34:59,840
doing the

839
00:34:59,840 --> 00:35:00,480
injection.

840
00:35:01,600 --> 00:35:02,200
Okay,

841
00:35:02,260 --> 00:35:02,660
so,

842
00:35:04,440 --> 00:35:04,660
the live

843
00:35:04,660 --> 00:35:04,900
demo.

844
00:35:05,300 --> 00:35:05,820
Okay,

845
00:35:05,900 --> 00:35:06,240
let me

846
00:35:07,140 --> 00:35:08,120
now have a

847
00:35:08,120 --> 00:35:08,320
look.

848
00:35:09,100 --> 00:35:09,620
Okay.

849
00:35:11,100 --> 00:35:11,620
So,

850
00:35:11,620 --> 00:35:12,460
you see,

851
00:35:12,620 --> 00:35:12,940
okay.

852
00:35:14,420 --> 00:35:14,940
Okay,

853
00:35:15,160 --> 00:35:15,380
so,

854
00:35:16,340 --> 00:35:16,860
let's

855
00:35:16,860 --> 00:35:16,980
move.

856
00:35:21,920 --> 00:35:22,440
Okay,

857
00:35:22,580 --> 00:35:22,820
this is

858
00:35:22,820 --> 00:35:22,900
in

859
00:35:22,900 --> 00:35:23,140
temporary

860
00:35:23,140 --> 00:35:23,560
directory

861
00:35:23,560 --> 00:35:24,080
and here.

862
00:35:26,780 --> 00:35:27,300
Okay.

863
00:35:27,500 --> 00:35:28,020
So,

864
00:35:28,100 --> 00:35:28,920
let's

865
00:35:28,920 --> 00:35:29,020
get

866
00:35:29,020 --> 00:35:29,360
our,

867
00:35:31,860 --> 00:35:32,380
our

868
00:35:32,380 --> 00:35:32,840
device

869
00:35:32,840 --> 00:35:33,200
here

870
00:35:33,200 --> 00:35:34,400
and let's

871
00:35:34,440 --> 00:35:35,200
try to

872
00:35:36,340 --> 00:35:37,180
load a

873
00:35:37,180 --> 00:35:37,620
standard

874
00:35:38,800 --> 00:35:39,440
sketch.

875
00:35:41,280 --> 00:35:41,920
Okay,

876
00:35:42,060 --> 00:35:42,400
I'm

877
00:35:42,400 --> 00:35:42,660
using

878
00:35:42,660 --> 00:35:42,920
here

879
00:35:42,920 --> 00:35:43,180
this

880
00:35:43,180 --> 00:35:43,500
analog

881
00:35:43,500 --> 00:35:43,860
serial

882
00:35:43,860 --> 00:35:44,380
sample.

883
00:35:44,960 --> 00:35:45,600
Okay,

884
00:35:45,680 --> 00:35:45,900
I'm

885
00:35:45,900 --> 00:35:46,220
uploading

886
00:35:46,220 --> 00:35:46,640
it

887
00:35:48,500 --> 00:35:49,140
on

888
00:35:49,140 --> 00:35:49,320
the

889
00:35:49,320 --> 00:35:49,620
board.

890
00:35:52,580 --> 00:35:53,220
Not

891
00:35:53,220 --> 00:35:53,560
really.

892
00:35:54,060 --> 00:35:54,700
Let

893
00:35:54,700 --> 00:35:54,840
me

894
00:35:54,840 --> 00:35:55,100
see.

895
00:35:58,600 --> 00:35:59,240
Okay.

896
00:36:01,400 --> 00:36:02,040
So,

897
00:36:04,420 --> 00:36:05,260
okay.

898
00:36:05,420 --> 00:36:05,820
Let's

899
00:36:05,820 --> 00:36:06,040
change the

900
00:36:06,040 --> 00:36:06,380
port.

901
00:36:08,180 --> 00:36:08,620
Okay.

902
00:36:09,020 --> 00:36:09,460
Okay.

903
00:36:12,520 --> 00:36:12,960
Okay.

904
00:36:13,120 --> 00:36:13,240
So,

905
00:36:13,360 --> 00:36:13,680
now we're

906
00:36:13,680 --> 00:36:14,080
uploading the

907
00:36:14,080 --> 00:36:14,300
code.

908
00:36:14,460 --> 00:36:14,820
This is

909
00:36:14,820 --> 00:36:15,360
just writing

910
00:36:15,360 --> 00:36:16,100
a value

911
00:36:17,200 --> 00:36:18,060
like a

912
00:36:18,060 --> 00:36:18,600
value of

913
00:36:18,600 --> 00:36:19,220
an analog

914
00:36:19,220 --> 00:36:19,540
port.

915
00:36:19,640 --> 00:36:19,720
So,

916
00:36:19,740 --> 00:36:19,900
you can

917
00:36:19,900 --> 00:36:20,560
see that

918
00:36:21,220 --> 00:36:21,660
just,

919
00:36:21,780 --> 00:36:22,480
okay,

920
00:36:23,080 --> 00:36:23,520
dumping

921
00:36:23,520 --> 00:36:23,980
these values

922
00:36:23,980 --> 00:36:24,200
here.

923
00:36:25,660 --> 00:36:26,100
Okay.

924
00:36:26,700 --> 00:36:27,140
So,

925
00:36:28,220 --> 00:36:28,660
now,

926
00:36:28,660 --> 00:36:29,000
let's

927
00:36:29,000 --> 00:36:29,360
go back

928
00:36:31,340 --> 00:36:31,740
and

929
00:36:31,740 --> 00:36:32,160
let's

930
00:36:32,160 --> 00:36:32,540
start to

931
00:36:32,540 --> 00:36:32,900
do the

932
00:36:32,900 --> 00:36:33,260
first thing

933
00:36:33,260 --> 00:36:33,500
we need

934
00:36:33,500 --> 00:36:33,780
to do

935
00:36:33,780 --> 00:36:33,900
is

936
00:36:33,900 --> 00:36:34,320
dumping

937
00:36:34,320 --> 00:36:34,680
the

938
00:36:36,180 --> 00:36:36,580
code

939
00:36:36,580 --> 00:36:36,880
from

940
00:36:36,880 --> 00:36:37,040
the

941
00:36:37,040 --> 00:36:37,760
AVR.

942
00:36:37,820 --> 00:36:37,920
So,

943
00:36:40,640 --> 00:36:41,040
okay.

944
00:36:45,500 --> 00:36:45,900
Okay.

945
00:36:46,020 --> 00:36:46,220
This

946
00:36:46,220 --> 00:36:46,420
is

947
00:36:46,420 --> 00:36:46,480
the

948
00:36:46,480 --> 00:36:46,840
syntax

949
00:36:46,840 --> 00:36:47,040
we

950
00:36:47,040 --> 00:36:47,100
need

951
00:36:47,100 --> 00:36:47,280
to

952
00:36:47,280 --> 00:36:47,520
use.

953
00:36:47,720 --> 00:36:48,120
We

954
00:36:48,120 --> 00:36:48,360
saw

955
00:36:48,360 --> 00:36:48,480
it

956
00:36:58,900 --> 00:36:59,020
So,

957
00:36:59,080 --> 00:36:59,380
let's

958
00:36:59,380 --> 00:36:59,700
go on.

959
00:37:05,780 --> 00:37:06,380
Okay.

960
00:37:06,580 --> 00:37:07,180
Now,

961
00:37:08,300 --> 00:37:08,900
let's

962
00:37:08,900 --> 00:37:09,260
go into

963
00:37:09,260 --> 00:37:09,560
the

964
00:37:09,560 --> 00:37:09,740
hard

965
00:37:09,740 --> 00:37:09,860
exploit

966
00:37:09,860 --> 00:37:10,180
directory

967
00:37:10,180 --> 00:37:11,620
here and

968
00:37:11,620 --> 00:37:12,060
let's

969
00:37:12,060 --> 00:37:12,300
copy

970
00:37:12,300 --> 00:37:13,020
the

971
00:37:13,020 --> 00:37:13,460
dumped

972
00:37:13,460 --> 00:37:13,880
content

973
00:37:17,300 --> 00:37:17,900
here.

974
00:37:19,040 --> 00:37:19,640
And

975
00:37:19,640 --> 00:37:19,900
then,

976
00:37:19,960 --> 00:37:20,420
let's

977
00:37:20,420 --> 00:37:20,640
run

978
00:37:20,640 --> 00:37:21,160
the

979
00:37:21,160 --> 00:37:21,500
hard

980
00:37:21,500 --> 00:37:21,720
exploit

981
00:37:21,720 --> 00:37:22,040
script

982
00:37:22,860 --> 00:37:23,460
specifying

983
00:37:23,460 --> 00:37:23,740
the

984
00:37:29,020 --> 00:37:29,460
hard

985
00:37:31,260 --> 00:37:31,700
exploit.

986
00:37:31,700 --> 00:37:32,020
So,

987
00:37:32,020 --> 00:37:32,220
you see

988
00:37:32,220 --> 00:37:32,360
that,

989
00:37:32,440 --> 00:37:32,700
okay,

990
00:37:32,860 --> 00:37:33,120
it is

991
00:37:33,120 --> 00:37:33,640
running for

992
00:37:33,640 --> 00:37:33,940
the 80

993
00:37:33,940 --> 00:37:34,100
mega

994
00:37:34,800 --> 00:37:35,240
328p,

995
00:37:35,360 --> 00:37:35,700
which is

996
00:37:35,700 --> 00:37:36,740
the MCU

997
00:37:36,740 --> 00:37:37,340
used by

998
00:37:37,340 --> 00:37:37,920
the Arduino Uno.

999
00:37:38,100 --> 00:37:38,620
And the

1000
00:37:38,620 --> 00:37:39,340
insert flag

1001
00:37:39,340 --> 00:37:39,740
is the

1002
00:37:40,620 --> 00:37:41,060
position

1003
00:37:41,060 --> 00:37:41,800
where he

1004
00:37:41,800 --> 00:37:42,540
needs to

1005
00:37:42,540 --> 00:37:43,120
put our

1006
00:37:43,120 --> 00:37:43,640
initialization

1007
00:37:43,640 --> 00:37:43,900
routing.

1008
00:37:44,620 --> 00:37:45,060
Okay.

1009
00:37:45,120 --> 00:37:45,500
It's finding

1010
00:37:45,500 --> 00:37:45,800
the entry

1011
00:37:45,800 --> 00:37:46,060
point.

1012
00:37:46,240 --> 00:37:46,780
It says

1013
00:37:46,780 --> 00:37:47,280
that the timer

1014
00:37:47,280 --> 00:37:48,080
vector is not used.

1015
00:37:48,260 --> 00:37:48,820
And so,

1016
00:37:48,840 --> 00:37:49,420
it's inserting

1017
00:37:49,420 --> 00:37:50,200
payload and saving

1018
00:37:50,200 --> 00:37:50,740
the injected file.

1019
00:37:50,940 --> 00:37:51,760
Consider that the

1020
00:37:52,320 --> 00:37:53,480
script will not modify

1021
00:37:53,480 --> 00:37:54,140
the original one.

1022
00:37:54,260 --> 00:37:54,780
It will create

1023
00:37:54,780 --> 00:37:55,340
a new

1024
00:37:56,460 --> 00:37:57,340
file named

1025
00:37:57,960 --> 00:37:58,400
.injected,

1026
00:37:58,420 --> 00:37:59,200
which

1027
00:37:59,740 --> 00:38:00,440
we are now

1028
00:38:00,440 --> 00:38:01,160
going to

1029
00:38:01,160 --> 00:38:01,800
copy

1030
00:38:01,800 --> 00:38:02,120
back.

1031
00:38:04,760 --> 00:38:05,200
So,

1032
00:38:05,320 --> 00:38:05,900
let's

1033
00:38:05,900 --> 00:38:06,140
copy

1034
00:38:06,140 --> 00:38:06,640
the result

1035
00:38:07,600 --> 00:38:08,040
in

1036
00:38:08,040 --> 00:38:08,720
file

1037
00:38:08,720 --> 00:38:09,280
here,

1038
00:38:09,440 --> 00:38:10,000
which

1039
00:38:12,660 --> 00:38:13,100
is

1040
00:38:13,100 --> 00:38:13,420
this one.

1041
00:38:13,500 --> 00:38:13,600
Okay,

1042
00:38:13,640 --> 00:38:14,060
let's have a look

1043
00:38:16,780 --> 00:38:17,520
at this one.

1044
00:38:19,100 --> 00:38:19,580
Okay.

1045
00:38:19,700 --> 00:38:20,000
This is

1046
00:38:20,000 --> 00:38:20,220
the

1047
00:38:21,480 --> 00:38:22,260
hex file

1048
00:38:22,260 --> 00:38:22,820
rewritten

1049
00:38:22,820 --> 00:38:23,340
by the

1050
00:38:24,000 --> 00:38:24,820
program itself.

1051
00:38:25,120 --> 00:38:25,600
Copy.

1052
00:38:26,280 --> 00:38:26,760
So,

1053
00:38:26,860 --> 00:38:27,500
flash

1054
00:38:27,500 --> 00:38:27,800
text

1055
00:38:28,640 --> 00:38:29,120
.injected

1056
00:38:29,120 --> 00:38:29,860
in tmp.

1057
00:38:30,400 --> 00:38:30,880
So,

1058
00:38:32,120 --> 00:38:32,600
let's

1059
00:38:32,600 --> 00:38:32,780
move

1060
00:38:32,780 --> 00:38:33,200
the

1061
00:38:36,780 --> 00:38:37,260
text.

1062
00:38:37,360 --> 00:38:37,480
So,

1063
00:38:37,500 --> 00:38:37,700
let's

1064
00:38:37,700 --> 00:38:38,200
rename it.

1065
00:38:38,340 --> 00:38:38,820
And then,

1066
00:38:38,900 --> 00:38:39,820
I'm just running

1067
00:38:39,820 --> 00:38:40,240
the same

1068
00:38:40,240 --> 00:38:40,680
utility as

1069
00:38:40,680 --> 00:38:40,920
before,

1070
00:38:41,020 --> 00:38:41,600
but modifying

1071
00:38:42,740 --> 00:38:43,440
the read

1072
00:38:43,440 --> 00:38:43,880
to write

1073
00:38:48,020 --> 00:38:48,380
Okay.

1074
00:38:48,520 --> 00:38:48,800
The code

1075
00:38:48,800 --> 00:38:48,980
is

1076
00:38:50,380 --> 00:38:50,740
loading.

1077
00:38:56,560 --> 00:38:56,920
And,

1078
00:38:57,080 --> 00:38:57,340
okay,

1079
00:38:57,460 --> 00:38:57,860
probably

1080
00:38:57,860 --> 00:38:58,140
it's

1081
00:38:58,140 --> 00:38:58,440
.

1082
00:38:59,280 --> 00:38:59,860
You see

1083
00:38:59,860 --> 00:39:00,100
that there

1084
00:39:00,100 --> 00:39:00,440
is a blinking

1085
00:39:00,440 --> 00:39:00,920
light now.

1086
00:39:01,240 --> 00:39:01,600
Okay.

1087
00:39:02,200 --> 00:39:02,760
Let's see if

1088
00:39:02,760 --> 00:39:03,220
the original

1089
00:39:03,680 --> 00:39:04,040
function

1090
00:39:04,040 --> 00:39:04,520
are already

1091
00:39:04,520 --> 00:39:04,720
there,

1092
00:39:04,840 --> 00:39:05,040
because,

1093
00:39:05,100 --> 00:39:05,280
okay,

1094
00:39:05,380 --> 00:39:06,040
we just

1095
00:39:06,960 --> 00:39:07,460
inserted the

1096
00:39:07,460 --> 00:39:07,640
code,

1097
00:39:07,740 --> 00:39:08,240
but we don't know

1098
00:39:08,240 --> 00:39:08,860
if it's

1099
00:39:08,860 --> 00:39:09,340
still working

1100
00:39:09,340 --> 00:39:09,740
as before.

1101
00:39:09,740 --> 00:39:10,480
So,

1102
00:39:10,660 --> 00:39:11,160
let's

1103
00:39:11,160 --> 00:39:15,200
go back

1104
00:39:15,200 --> 00:39:15,400
here.

1105
00:39:15,560 --> 00:39:15,700
Okay.

1106
00:39:15,860 --> 00:39:16,280
And so,

1107
00:39:16,340 --> 00:39:16,660
it looks

1108
00:39:16,660 --> 00:39:16,860
like,

1109
00:39:16,920 --> 00:39:17,120
yes,

1110
00:39:17,240 --> 00:39:17,580
okay,

1111
00:39:17,760 --> 00:39:18,360
it's

1112
00:39:18,360 --> 00:39:19,040
still dumping

1113
00:39:19,040 --> 00:39:19,540
the content

1114
00:39:19,540 --> 00:39:20,120
of the

1115
00:39:21,020 --> 00:39:21,420
analog

1116
00:39:21,420 --> 00:39:21,740
port,

1117
00:39:21,920 --> 00:39:22,800
but now it

1118
00:39:22,800 --> 00:39:23,220
also has

1119
00:39:23,220 --> 00:39:23,920
the blinking

1120
00:39:23,920 --> 00:39:24,220
light.

1121
00:39:25,200 --> 00:39:25,600
Okay.

1122
00:39:26,140 --> 00:39:26,780
The blinking

1123
00:39:26,780 --> 00:39:27,140
light here.

1124
00:39:27,280 --> 00:39:27,420
So,

1125
00:39:28,340 --> 00:39:28,880
we can

1126
00:39:28,880 --> 00:39:29,040
do

1127
00:39:29,040 --> 00:39:29,740
another quick

1128
00:39:29,740 --> 00:39:30,540
example by

1129
00:39:30,540 --> 00:39:31,340
using a

1130
00:39:31,810 --> 00:39:32,360
sketch that

1131
00:39:32,360 --> 00:39:32,880
is using

1132
00:39:32,880 --> 00:39:34,060
the ISR.

1133
00:39:34,200 --> 00:39:34,400
So,

1134
00:39:37,810 --> 00:39:38,440
let me

1135
00:39:39,030 --> 00:39:39,780
just open

1136
00:39:39,780 --> 00:39:40,100
it.

1137
00:39:43,830 --> 00:39:44,160
Okay.

1138
00:39:46,020 --> 00:39:46,680
Yeah.

1139
00:39:50,760 --> 00:39:51,420
Okay.

1140
00:39:54,640 --> 00:39:55,300
So,

1141
00:39:55,380 --> 00:39:55,700
let's

1142
00:39:55,700 --> 00:39:56,200
upload

1143
00:39:56,200 --> 00:39:56,660
this one.

1144
00:39:59,960 --> 00:40:00,480
Okay.

1145
00:40:00,580 --> 00:40:00,900
This is

1146
00:40:00,900 --> 00:40:01,120
very

1147
00:40:01,120 --> 00:40:01,980
easy

1148
00:40:04,620 --> 00:40:05,140
program

1149
00:40:05,140 --> 00:40:05,460
that

1150
00:40:05,460 --> 00:40:05,740
just

1151
00:40:07,300 --> 00:40:07,820
use

1152
00:40:07,820 --> 00:40:08,060
an

1153
00:40:08,060 --> 00:40:08,440
interrupt

1154
00:40:09,240 --> 00:40:09,760
timer

1155
00:40:09,760 --> 00:40:10,340
to print

1156
00:40:10,340 --> 00:40:10,640
an A

1157
00:40:10,640 --> 00:40:10,980
here.

1158
00:40:11,220 --> 00:40:11,520
Okay.

1159
00:40:11,640 --> 00:40:12,880
Not really

1160
00:40:14,100 --> 00:40:14,980
a real

1161
00:40:14,980 --> 00:40:15,300
example,

1162
00:40:15,440 --> 00:40:15,980
but in

1163
00:40:15,980 --> 00:40:16,720
case for

1164
00:40:16,720 --> 00:40:17,340
the purpose

1165
00:40:17,340 --> 00:40:17,640
of the

1166
00:40:17,640 --> 00:40:17,900
test,

1167
00:40:18,040 --> 00:40:18,280
it's

1168
00:40:18,280 --> 00:40:19,000
enough.

1169
00:40:19,260 --> 00:40:19,560
So,

1170
00:40:19,620 --> 00:40:20,380
it's printing

1171
00:40:20,380 --> 00:40:20,840
an A.

1172
00:40:23,860 --> 00:40:24,380
So,

1173
00:40:24,380 --> 00:40:25,280
let's go back

1174
00:40:25,280 --> 00:40:26,020
and do the same

1175
00:40:26,020 --> 00:40:26,500
things here.

1176
00:40:26,600 --> 00:40:26,720
So,

1177
00:40:26,820 --> 00:40:27,300
let's dump

1178
00:40:27,300 --> 00:40:28,480
the content

1179
00:40:28,480 --> 00:40:29,040
again by

1180
00:40:29,040 --> 00:40:29,500
reading the

1181
00:40:29,500 --> 00:40:29,740
flash.

1182
00:40:37,680 --> 00:40:38,200
Okay.

1183
00:40:38,700 --> 00:40:39,220
Let's

1184
00:40:40,020 --> 00:40:40,540
copy

1185
00:40:40,540 --> 00:40:40,960
again

1186
00:40:40,960 --> 00:40:41,620
the

1187
00:40:41,620 --> 00:40:42,080
slash

1188
00:40:42,080 --> 00:40:42,500
TMP

1189
00:40:42,500 --> 00:40:42,840
slash

1190
00:40:44,100 --> 00:40:44,620
in.

1191
00:40:48,900 --> 00:40:49,420
Okay.

1192
00:40:49,580 --> 00:40:49,760
And

1193
00:40:49,760 --> 00:40:50,080
let's

1194
00:40:50,080 --> 00:40:50,160
run

1195
00:40:50,160 --> 00:40:50,480
again

1196
00:40:50,480 --> 00:40:50,920
the

1197
00:40:50,920 --> 00:40:51,060
hard

1198
00:40:51,060 --> 00:40:51,260
exploit.

1199
00:40:52,460 --> 00:40:52,980
Okay.

1200
00:40:53,460 --> 00:40:53,980
Consider

1201
00:40:53,980 --> 00:40:54,300
exactly

1202
00:40:54,300 --> 00:40:54,600
see,

1203
00:40:54,700 --> 00:40:55,220
not this

1204
00:40:55,220 --> 00:40:55,400
one.

1205
00:40:55,700 --> 00:40:56,120
So,

1206
00:40:56,220 --> 00:40:56,620
the

1207
00:40:56,620 --> 00:40:57,100
realize

1208
00:40:57,100 --> 00:40:57,640
that

1209
00:40:57,640 --> 00:40:57,860
the

1210
00:40:57,860 --> 00:40:58,140
timer

1211
00:40:58,140 --> 00:40:58,320
vector

1212
00:40:58,320 --> 00:40:58,560
is

1213
00:40:58,560 --> 00:40:58,700
there.

1214
00:40:58,820 --> 00:40:59,020
So,

1215
00:40:59,100 --> 00:40:59,660
it

1216
00:40:59,660 --> 00:40:59,860
tries

1217
00:40:59,860 --> 00:41:00,000
to

1218
00:41:00,000 --> 00:41:00,120
open.

1219
00:41:01,120 --> 00:41:01,600
So,

1220
00:41:01,620 --> 00:41:01,780
now,

1221
00:41:01,780 --> 00:41:01,900
we

1222
00:41:01,900 --> 00:41:02,080
have

1223
00:41:02,080 --> 00:41:02,280
the

1224
00:41:02,280 --> 00:41:02,620
injected

1225
00:41:02,620 --> 00:41:02,940
code.

1226
00:41:06,400 --> 00:41:06,880
Let's

1227
00:41:06,880 --> 00:41:07,120
copy

1228
00:41:07,120 --> 00:41:07,260
it

1229
00:41:07,260 --> 00:41:07,460
back.

1230
00:41:23,800 --> 00:41:24,280
And

1231
00:41:26,360 --> 00:41:26,880
let's

1232
00:41:26,880 --> 00:41:27,000
it

1233
00:41:27,000 --> 00:41:27,600
works.

1234
00:41:31,060 --> 00:41:31,580
Okay.

1235
00:41:31,720 --> 00:41:31,940
So,

1236
00:41:32,060 --> 00:41:32,220
you can

1237
00:41:32,220 --> 00:41:32,420
see

1238
00:41:32,420 --> 00:41:32,680
again

1239
00:41:32,680 --> 00:41:33,080
the

1240
00:41:33,080 --> 00:41:33,340
blinking

1241
00:41:33,340 --> 00:41:33,560
light

1242
00:41:33,560 --> 00:41:33,780
here.

1243
00:41:35,080 --> 00:41:35,600
And

1244
00:41:35,600 --> 00:41:36,020
let's

1245
00:41:36,020 --> 00:41:36,160
see

1246
00:41:36,160 --> 00:41:36,280
if

1247
00:41:36,280 --> 00:41:36,780
it

1248
00:41:36,780 --> 00:41:37,120
still

1249
00:41:37,120 --> 00:41:37,340
runs

1250
00:41:37,340 --> 00:41:37,640
the

1251
00:41:37,640 --> 00:41:37,960
interrupt

1252
00:41:37,960 --> 00:41:38,140
as

1253
00:41:38,140 --> 00:41:38,480
before.

1254
00:41:43,940 --> 00:41:44,460
Okay.

1255
00:41:44,600 --> 00:41:45,020
Yep.

1256
00:41:45,600 --> 00:41:46,120
So,

1257
00:41:46,200 --> 00:41:46,760
also

1258
00:41:46,760 --> 00:41:46,960
in

1259
00:41:54,300 --> 00:41:54,400
working

1260
00:41:54,400 --> 00:41:54,780
here.

1261
00:41:55,780 --> 00:41:56,260
Okay.

1262
00:41:56,400 --> 00:41:56,880
So,

1263
00:41:59,100 --> 00:41:59,580
this

1264
00:41:59,580 --> 00:41:59,960
is more

1265
00:41:59,960 --> 00:42:00,260
or less

1266
00:42:00,260 --> 00:42:00,580
I think

1267
00:42:00,580 --> 00:42:00,800
that we

1268
00:42:00,800 --> 00:42:01,420
also

1269
00:42:01,420 --> 00:42:02,360
running

1270
00:42:02,880 --> 00:42:03,680
out of

1271
00:42:03,680 --> 00:42:03,940
time.

1272
00:42:04,580 --> 00:42:05,540
Maybe I

1273
00:42:05,540 --> 00:42:06,080
have still

1274
00:42:06,560 --> 00:42:07,040
some

1275
00:42:07,040 --> 00:42:07,240
minutes

1276
00:42:07,980 --> 00:42:08,660
to do

1277
00:42:08,660 --> 00:42:08,820
an

1278
00:42:08,820 --> 00:42:09,200
additional

1279
00:42:10,000 --> 00:42:10,480
test,

1280
00:42:10,680 --> 00:42:10,980
which will

1281
00:42:10,980 --> 00:42:11,220
be

1282
00:42:11,220 --> 00:42:12,140
the

1283
00:42:12,140 --> 00:42:12,520
automation

1284
00:42:13,660 --> 00:42:14,140
of

1285
00:42:14,140 --> 00:42:14,300
the

1286
00:42:15,060 --> 00:42:15,540
process

1287
00:42:15,540 --> 00:42:15,960
here.

1288
00:42:17,440 --> 00:42:17,960
So,

1289
00:42:18,320 --> 00:42:18,700
let me

1290
00:42:18,700 --> 00:42:18,960
show

1291
00:42:18,960 --> 00:42:19,200
you.

1292
00:42:23,760 --> 00:42:24,280
So,

1293
00:42:24,320 --> 00:42:24,460
this

1294
00:42:24,460 --> 00:42:24,660
can

1295
00:42:24,660 --> 00:42:24,900
be.

1296
00:42:26,320 --> 00:42:26,840
Okay.

1297
00:42:35,500 --> 00:42:36,020
So,

1298
00:42:37,140 --> 00:42:37,420
this

1299
00:42:37,420 --> 00:42:37,660
is a

1300
00:42:37,660 --> 00:42:38,000
starting

1301
00:42:38,000 --> 00:42:38,320
point,

1302
00:42:38,360 --> 00:42:38,640
obviously.

1303
00:42:40,440 --> 00:42:40,960
It

1304
00:42:40,960 --> 00:42:41,060
will

1305
00:42:41,060 --> 00:42:41,200
be

1306
00:42:41,200 --> 00:42:41,500
interesting

1307
00:42:41,500 --> 00:42:41,760
to

1308
00:42:41,760 --> 00:42:41,960
also

1309
00:42:41,960 --> 00:42:42,220
know

1310
00:42:42,220 --> 00:42:42,440
your

1311
00:42:42,440 --> 00:42:42,720
opinion

1312
00:42:42,720 --> 00:42:43,020
about

1313
00:42:43,020 --> 00:42:43,780
this and

1314
00:42:43,780 --> 00:42:44,040
to

1315
00:42:44,760 --> 00:42:45,280
also

1316
00:42:45,280 --> 00:42:45,440
have

1317
00:42:45,440 --> 00:42:45,620
your

1318
00:42:45,960 --> 00:42:46,020
for

1319
00:42:46,020 --> 00:42:46,520
developing

1320
00:42:46,520 --> 00:42:46,840
and

1321
00:42:47,800 --> 00:42:48,200
do

1322
00:42:48,200 --> 00:42:48,600
additional

1323
00:42:48,600 --> 00:42:48,900
things

1324
00:42:48,900 --> 00:42:49,340
about

1325
00:42:50,580 --> 00:42:50,980
this

1326
00:42:52,900 --> 00:42:53,300
way,

1327
00:42:53,400 --> 00:42:53,980
also changing

1328
00:42:53,980 --> 00:42:54,380
maybe the

1329
00:42:54,380 --> 00:42:54,780
way we

1330
00:42:54,780 --> 00:42:55,240
are using

1331
00:42:55,820 --> 00:42:56,420
to inject

1332
00:42:56,420 --> 00:42:56,740
the code,

1333
00:42:56,820 --> 00:42:57,020
actually.

1334
00:42:57,420 --> 00:42:58,100
Because this is

1335
00:42:58,100 --> 00:42:58,420
a solution

1336
00:42:58,420 --> 00:42:59,000
I found.

1337
00:42:59,180 --> 00:42:59,560
It's

1338
00:42:59,560 --> 00:42:59,820
not the

1339
00:42:59,820 --> 00:43:00,240
only one

1340
00:43:00,240 --> 00:43:00,680
for sure.

1341
00:43:02,360 --> 00:43:02,760
Okay.

1342
00:43:03,240 --> 00:43:03,640
So,

1343
00:43:04,720 --> 00:43:05,120
let

1344
00:43:05,120 --> 00:43:05,420
me

1345
00:43:07,520 --> 00:43:07,920
upload

1346
00:43:07,920 --> 00:43:08,100
again

1347
00:43:08,100 --> 00:43:08,680
the

1348
00:43:14,160 --> 00:43:14,600
analog

1349
00:43:14,600 --> 00:43:14,940
read.

1350
00:43:18,500 --> 00:43:18,940
So,

1351
00:43:21,400 --> 00:43:21,840
I'm

1352
00:43:21,840 --> 00:43:22,000
going

1353
00:43:22,000 --> 00:43:22,180
to

1354
00:43:22,180 --> 00:43:22,500
get

1355
00:43:23,640 --> 00:43:24,080
rid

1356
00:43:24,080 --> 00:43:24,300
of

1357
00:43:24,300 --> 00:43:24,480
the

1358
00:43:24,480 --> 00:43:24,700
blinking

1359
00:43:24,700 --> 00:43:24,960
light

1360
00:43:24,960 --> 00:43:25,240
here.

1361
00:43:27,800 --> 00:43:28,240
Okay.

1362
00:43:29,860 --> 00:43:30,300
Uploading

1363
00:43:30,300 --> 00:43:30,520
down.

1364
00:43:30,680 --> 00:43:30,800
So,

1365
00:43:30,900 --> 00:43:31,120
okay.

1366
00:43:31,120 --> 00:43:32,660
As you can

1367
00:43:32,660 --> 00:43:32,840
see,

1368
00:43:32,900 --> 00:43:33,300
as I said,

1369
00:43:33,300 --> 00:43:33,820
we can

1370
00:43:34,400 --> 00:43:35,140
automate the

1371
00:43:35,140 --> 00:43:35,380
process.

1372
00:43:35,540 --> 00:43:35,680
This

1373
00:43:36,220 --> 00:43:36,940
board here

1374
00:43:36,940 --> 00:43:37,540
has a

1375
00:43:37,540 --> 00:43:38,260
Python support

1376
00:43:38,260 --> 00:43:39,020
with the

1377
00:43:39,020 --> 00:43:39,480
script

1378
00:43:39,480 --> 00:43:40,300
on board.

1379
00:43:40,740 --> 00:43:41,260
So,

1380
00:43:41,360 --> 00:43:42,320
if I'm

1381
00:43:42,320 --> 00:43:42,760
going to

1382
00:43:42,760 --> 00:43:43,320
plug

1383
00:43:43,320 --> 00:43:43,720
the

1384
00:43:45,820 --> 00:43:46,340
board

1385
00:43:46,340 --> 00:43:46,600
now,

1386
00:43:49,240 --> 00:43:49,760
we

1387
00:43:49,760 --> 00:43:50,260
should wait

1388
00:43:50,260 --> 00:43:50,940
30 seconds

1389
00:43:50,940 --> 00:43:51,520
and we

1390
00:43:51,520 --> 00:43:52,040
should see

1391
00:43:53,200 --> 00:43:53,720
the

1392
00:43:53,720 --> 00:43:54,680
LED

1393
00:43:54,680 --> 00:43:55,580
start

1394
00:43:55,580 --> 00:43:55,840
blinking

1395
00:43:55,840 --> 00:43:56,020
again.

1396
00:43:57,780 --> 00:43:58,560
What it's

1397
00:43:58,560 --> 00:43:58,800
doing right

1398
00:43:58,800 --> 00:43:59,260
now is just

1399
00:43:59,260 --> 00:43:59,640
automating

1400
00:43:59,640 --> 00:44:00,600
the process

1401
00:44:00,600 --> 00:44:01,400
we did

1402
00:44:02,300 --> 00:44:02,740
just

1403
00:44:03,980 --> 00:44:04,600
10 minutes

1404
00:44:04,600 --> 00:44:04,800
ago.

1405
00:44:05,080 --> 00:44:05,520
So,

1406
00:44:05,560 --> 00:44:05,880
now it's

1407
00:44:05,880 --> 00:44:06,120
uploading

1408
00:44:06,120 --> 00:44:06,500
the code

1409
00:44:06,500 --> 00:44:06,720
again.

1410
00:44:15,740 --> 00:44:16,180
And,

1411
00:44:16,280 --> 00:44:16,580
okay.

1412
00:44:16,960 --> 00:44:17,400
Okay.

1413
00:44:17,480 --> 00:44:17,720
As you

1414
00:44:17,720 --> 00:44:17,860
can

1415
00:44:17,860 --> 00:44:18,120
see,

1416
00:44:18,640 --> 00:44:19,080
there

1417
00:44:19,080 --> 00:44:19,240
is

1418
00:44:19,700 --> 00:44:20,180
the blinking

1419
00:44:20,180 --> 00:44:20,400
LED.

1420
00:44:22,440 --> 00:44:22,880
Okay.

1421
00:44:23,480 --> 00:44:23,920
So,

1422
00:44:23,980 --> 00:44:24,240
that's

1423
00:44:24,240 --> 00:44:24,420
all.

1424
00:44:26,100 --> 00:44:27,060
I hope,

1425
00:44:27,120 --> 00:44:27,300
okay,

1426
00:44:27,340 --> 00:44:27,800
everything will

1427
00:44:27,800 --> 00:44:28,280
be available

1428
00:44:28,860 --> 00:44:29,600
on GitHub

1429
00:44:30,540 --> 00:44:31,020
in a

1430
00:44:32,660 --> 00:44:33,400
few days,

1431
00:44:33,420 --> 00:44:33,920
just after

1432
00:44:33,920 --> 00:44:34,240
the

1433
00:44:34,900 --> 00:44:35,380
conference.

1434
00:44:35,760 --> 00:44:36,120
So,

1435
00:44:36,180 --> 00:44:36,560
these are

1436
00:44:36,560 --> 00:44:37,180
the references

1437
00:44:37,180 --> 00:44:38,280
I use

1438
00:44:38,280 --> 00:44:38,680
to write

1439
00:44:38,680 --> 00:44:39,040
everything.

1440
00:44:40,560 --> 00:44:41,520
If you

1441
00:44:41,520 --> 00:44:41,880
have any

1442
00:44:41,880 --> 00:44:42,280
comment

1443
00:44:42,280 --> 00:44:43,160
or something,

1444
00:44:43,240 --> 00:44:43,400
I'm

1445
00:44:43,400 --> 00:44:44,180
here to

1446
00:44:45,140 --> 00:44:45,620
speak

1447
00:44:45,620 --> 00:44:45,980
with you.

1448
00:44:46,060 --> 00:44:46,400
And also,

1449
00:44:46,440 --> 00:44:46,740
I would like

1450
00:44:46,740 --> 00:44:47,380
to know

1451
00:44:54,240 --> 00:44:54,480
if you

1452
00:44:54,480 --> 00:44:54,980
do additional

1453
00:44:54,980 --> 00:44:55,380
things on

1454
00:44:55,380 --> 00:44:55,500
that.

1455
00:44:56,080 --> 00:44:56,380
Okay.

1456
00:44:56,420 --> 00:44:57,040
Thank you very

1457
00:44:57,040 --> 00:44:57,340
much for

1458
00:44:57,340 --> 00:44:57,640
being here.

1459
00:44:58,220 --> 00:44:58,720
Thank you so

1460
00:44:58,720 --> 00:44:58,920
much.