start	end	text
760	8040	Let's kick it. Normally, I would like to look out and gaze into your eyes and figure out,
8040	12820	by peering into your soul, what's bothering you, what's exciting you, whether you're engaged,
12820	17820	if you're on your phone. But since I can't, I'm just going to throw pencils there and pick on
17820	31600	him. That's fine. Go ahead. Oh, in order of events here, we're going to do some dry PPC,
31600	37780	because we're gigantic nerds. We're going to talk about the kind of guts of this,
37780	46780	which is the vivisect stuff. Who cares about PowerPC?
49140	52820	Only us nerds, right? I hope not.
53260	56640	Or, you know, I suppose the people developing embedded devices care.
56900	61540	I hope that the people whose lives are in jeopardy care, but we'll get into that.
65120	74360	I'm going to insert an x86 joke here. We've been programming PowerPC for a long time.
75000	83480	We always used to pick on the x86 people. And the reverse engineers care, which is an
83480	91120	interesting topic, because the tools for doing that are not that great. Oh, and I'm pointing
91120	95100	on my screen like people can actually see me. Not like I'm pointing up at the...
97240	102380	NMFTA, they care. People running mainframes care.
102980	105700	Why would they care?
105700	106780	Why would they care?
106860	108760	Actually, Aaron, who are you?
108780	110760	Who am I? Oh, okay.
110960	113700	We skipped the intro slides here.
113700	120240	I guess so. I am Aaron, or Acorn. I'm a security researcher with Grimm.
120930	126960	For most of my career, I was doing embedded software and system development,
126960	133540	used typically on safety critical systems. I've worked on telecom and Motorola.
133540	142160	And I've worked on medical devices, industrial control, aerospace, a wide array of different
142160	146470	platforms and architectures and processors and languages and junk.
146470	150590	And now I get to do what I've always wanted to do, which is
150590	152990	pull things apart and figure out how they work.
154350	157990	Indeed. Awesome. I'm so glad to hear that you love that.
158850	167730	And I am Atlas. I've been hacking, reversing stuff for about 15 years. And I've had the
167730	173170	opportunity, the good fortune to hack with some of the most amazing people on some of the most
173170	180670	intriguing targets, including virtual machines, smart meters, all sorts of RF things, automotive
180670	191450	embedded things. And now, as of recent, space things. Please forgive me if I snore sometime
191450	197430	during the presentation. Aaron, you'll have to yell. I was up for 26 hours straight hacking
197430	203970	satellites last night. And when my kids got up and started meandering around the house at 9.30
203970	209790	this morning, I thought I should probably go to bed. So I did get about four and a half hours
209790	214970	sleep. So I didn't short you guys too much. That's what I would have normally gotten in DEF CON
214970	223750	Vegas. So a little about me. I love, just like Aaron, I love tearing things apart, figuring how
223750	232870	they work, how we can make them work better or interesting. I am a Christian, a father of three
232870	245270	and a husband of one. And I love talking to you guys. So why would anybody other than us nerds
245270	249790	care, Aaron? Where do we see power PC chips these days?
250730	266770	Well, we see them in my mouse works. Or not, whichever, you know. Oh, I'm skipping ahead.
267490	275330	I guess I think we got a word. Where we see them here today, mainframes, IBM, all of those systems
275330	283150	that, what is it called now? I, system I, I think is what they call it. Oh yeah, IBM I.
283510	292310	Those are all power PC systems, not the weird 48-bit things they used to be. Embedded controls,
292310	303330	right? Yep. IBM also, they've got their I platforms and their AIX, used to be the RS6000s.
304450	310330	And they all run on power PC. In fact, they've put them under the umbrella known as the power
311650	321550	systems. So go figure. So NXP, NXP, I've seen their name somewhere.
321650	324250	Kind of things that they get their, their chips into.
325510	332750	Oh, rhetorical questions here. Automotive, industrial systems, aerospace,
332750	342210	they're heavily favored for platforms that, I guess, prize, what, reliability, durability,
342210	348510	determinism. The littler things though. Yeah. Not the things that you carry in your backpack.
348510	354490	Well, I mean, maybe, but not your laptops and. Right. Embedded things. NXP has dominated that
354490	360830	space. Right. Yeah. They, they also have satellites and space things, but unfortunately
361730	366090	I've been working on Spark systems for the last day or so.
366470	371810	Yeah, that's a, it's a different, a different presentation talking about Leon and Spark.
372390	378610	But for power PC is very traditional, typically or radiation hardened systems. I think they call
378610	387270	it the rad 750 is a very, very common one. It's the old G3 series stuff. Assuming I remember
387270	392990	right. It's been a few years since I confirmed. But yeah, so power PC, for those of you who don't
392990	402070	know, right. Risk. Kind of. Fixed instruction words. About every, every risk process I ran
402070	410350	into actually. You know, every time you get a risk platform, you start finding very non-reduced
410350	416230	parts of it very quickly. Fixed instruction word, 32 bits, every instruction.
417450	424510	Kind of. We saw a bit of a sneak preview on that of my other work slides here. Those of you who
424510	430390	are familiar with Apple in the nineties and early two thousands will of course recognize
431050	441030	power PC from that. Power books, right? Power books. Their releases, the G3, G4,
441750	448070	G5. I think they were all actually tied into the different releases of the,
448770	456630	the power PC architecture documentation. Yep. So yeah, the things that they're used in
456630	461590	bed controls, IBM and old apples. I should have said old Apple computers there, right?
461590	467450	I guess it's the slides titled history lesson. So I thought it was kind of obvious.
467930	476290	Here's the caveat for a 32 bit thing. Freescale created a variable instruction word
477550	487970	within APU, which is what power PC companies call extensions, extra things.
487970	492850	If evolution and Darwinism was applied to computer systems,
493590	498810	APUs would be the mechanism through which evolution occurred. And the platypus was
498810	507930	formulated. So not my favorite thing. They have fractured the, the entire power PC world and made
507930	514150	it ever so difficult to make good tooling for it, but we'll get to that. Yeah. Yeah.
515370	518870	Found this fun slide here. It's probably only interesting to me.
519430	525790	I loved it. I love the title of it though. Power architecture demystified, which is an extremely
525790	532370	bold claim for anybody who's familiar with power PC. But here they've got the, you know,
532370	538470	there's this little highlighted section here. Somebody who worked at Freescale slash NXP. I
538470	542650	think this was produced in 2000. This paper was from 2007. So this would be somebody who was at
542650	549670	Freescale at the time. With benchmarking, they said that the code is 30% smaller with only a 5%
549670	558110	reduction in performance. You know what I read that to say? What? I read that to say ARM's doing
558110	564790	it. We should probably do something like that too. Probably. That's probably exactly it.
565830	570530	Automotive especially loves their small memory footprint parts.
570530	573850	Well, you know, you save a fraction of a penny per chip.
574190	581310	Yeah. But this type of thing, the VLE stuff, it's a big, all of the, well, I shouldn't say all.
581310	590410	A great deal of the embedded components use the VLE features on embedded controls right now.
591150	597550	And it's kind of a big deal because as Alice said, it makes producing tooling very, very
597550	607270	complicated. Like making PowerPC tools is like making tools for like 20 different processors
607270	613770	for architectures. And reading the documentation for them makes it feel like you're making it,
613770	620830	you're making tools for thousands of architectures. Yeah. Because they don't coalesce well.
623540	628060	So, Vivisect. Can you tell me something about Vivisect?
628060	634800	Yeah. So, Vivisect is a binary analysis framework that was created specifically
634800	638040	for the purpose of finding and exploiting vulnerabilities.
638980	643840	Originally created by a really good friend of mine named Invisigoth.
646820	654880	It speaks my language, so to speak. It's pure Python. It allows me a ton of power
657160	663320	in many different ways, including from the command line. I'm an IPython person. I go to
663320	669840	work and I type IPython and I feel like I'm starting to do something meaningful. So, there's
669920	677100	a lot of cool, meaningful things I can do with Vivisect there. But it's been forward thinking
677100	685380	since it was originally created. And so, instead of a disassembly framework, we got every
685380	692620	architecture that you disassemble for has an emulator wrapped in with it. But not just an
692620	701040	emulator, like a QEMU, a partial emulation engine, which allows for things to have
701040	706920	taint tracking, for example. If we try to read memory that doesn't exist or if we try to access
708140	714820	uninitialized variables or whatever. So, we can focus not just on code flow from the beginning
714820	719920	of a program, but we can say, hey, this function looks interesting. Give me a feel for what it
719920	726480	does and an emulator can roll through and say, oop, that's a problem, but I've been programmed
726480	733140	to keep going and I just kind of keep track of that. Or, oop, that's ARG1. So, I know that ARG1
733140	742020	is now going to propagate through this calculation and whatnot. But then a few years later, I was
742020	749060	talking to Vizi and he said, you know, emulation is awesome and super powerful, but you really
749060	756260	need to focus on symbolic execution. And I'm like, what is that? And I looked into it and it turns
756260	761560	out the first thing that I found of interest with symbolic execution, this is way before CGC was
761560	771180	around, was NASA talking about how they were using symbolic execution to identify flaws and potential
771180	779040	problems before shipping satellites into space or the Mars rovers to Mars, since repairing those
779040	791920	things kind of sucks. So, BIVSEC also has, wraps in cross-platform debugging in a subsection that
791920	799340	we don't call out here called BDB, vulnerability debugger. And so, these things all wrap around
799340	811280	and support x86, 32 and 64-bit. MSP430, there's also 8051 in there, ARM and thumb mode,
811280	820820	v7 at the moment, we have some deltas to wrap in ARM v8, z80, hate, I love just saying that name
820820	825820	because it's also another one of those architectures that I just really love.
828420	833220	I think I love BIVSEC the most because not only is it really pretty because it's green
833220	841720	and black for most things, but the ability to easily extend it and do inspection of what's
841720	848000	going on under the hood, so I understand how to reuse the tooling and use it to the best of
848000	856300	my ability in my own external tools. So, command line stuff, just programming plugins, whatnot.
857040	860980	Okay, enough about that. I've said four and a half hours sleep.
863360	873700	So, why don't you talk about this, Aaron? Well, let me give a little backstory. A while back,
874340	879760	I was already working on wrapping PowerPC into BIVSEC, and
881760	888840	NMFTA said, we'd like to fund some of that research, just make sure that it benefits the
888840	897280	world. And so, it was already open source, so that was an easy sell. And so, they paid for us
897280	905800	for a bit of research, and Aaron donated a lot of his time as well, in addition, over and above
905800	912580	what we were paid to do, just because he's awesome and recognizes the value. So, I tapped him, and
912580	918000	it was one of the best things that I could have done for that project, because, well,
918000	924200	I'll tell you that later. Talk about this, Aaron. Sure, sure. So, adding an ISA to BIVSEC,
925580	932460	as Alex said, there's a couple different parts of it. You've got to figure out how to disassemble
932460	935600	the different instructions, right? You've got to get your documentation to figure out what the
935600	941400	instructions look like. Then you need to figure out how to emulate their behavior. You need to...
941400	946440	symbolic analysis is a bit outside of my wheelhouse there.
946820	952060	Yeah, I took most of that on. It's a different way of thinking.
953040	958580	Testing is not where I thought I would end up doing a lot of work, but apparently, it's where
958580	967360	I did a lot of work. Figuring out how to test tools to handle a new architecture is interesting.
967800	970960	You know, how do you... where do you get that information from? Obviously, you get your
970960	976760	documentation. At least, I hope you do. It's going to be a stretch. You get existing compilers and
976760	984160	object dump tool. That's useful. If you take existing disassembly tools, those can be useful.
984160	990040	Those will give you a certain view of the results that may or may not match the object dump.
990140	995820	You can just make gigantic lists of instructions to parse from your documentation. Don't forget,
995820	1002160	you also have to figure out how to do the behavior of that. No matter which one of these paths you
1002160	1009020	take. Oh, and also option D, which I forgot to put down there, which is get the hardware
1009020	1018080	and run it. For PowerPC, that would really mean get, like, what, 20, 30, 40 different pieces of
1018080	1023620	hardware. It's not going to be challenging to do it for everything, but it is useful.
1024080	1028440	We got our hands on a couple different architectures for it. A couple different
1028440	1034100	platforms. One embedded and one more server-esque.
1035820	1045080	So we were able to have all that at our disposal. So, Aaron, this sounds a lot like magic.
1045400	1046480	It does.
1048860	1056220	But what's it really mean? What's it look like to write disassembly code or an emulation
1057040	1059300	instruction? How do you emulate an instruction?
1060680	1062680	How do you emulate an instruction?
1063220	1069840	Mostly the disassembly part. I feel most people think that is more magic than it really is.
1069840	1070460	It is.
1070460	1075480	The magic really is about finding the documentation and understanding what they meant.
1075820	1082520	Sure. Well, you know, once you... I guess it's basically about the numbers, right? Everything
1083200	1089280	at its base form in computers is a number. Hexadecimal, decimal, whichever way you prefer
1089280	1095740	to read it. Everything is numbers. If it's data, if it's code, whatever it is, it's just a number.
1095840	1101700	So you just read in byte by byte or four bytes by four bytes or however many bytes by however
1101700	1107140	many bytes for your architecture. And then you just start taking a look. This particular pattern
1107140	1111820	here means that it's this instruction. This particular pattern here means it's this instruction.
1112440	1117420	This right here is a fun list of test inputs.
1118160	1121780	Wish we could have gotten your scrolling version going. That would have been...
1121780	1127180	Yeah, I don't know. For some reason, I just can't... media, you know...
1127740	1134720	Aaron wrote a list of about 30... he took a list of about 30 times this length
1134720	1139500	and had it just scrolling in video and somehow Google Docs didn't like it.
1140180	1145680	About like 30 megabyte GIFs did not play nice.
1148080	1155180	Yeah, so in this particular case, what I started doing was I took a PowerPC Linux kernel
1155760	1162240	and I disassembled it, which I figured that that would have a fantastic variety of instructions of
1162240	1167440	different encodings and forms. And then what you do after you do that is you go through and you
1167440	1172860	fix all the bugs. Because every single one of those four things I talked about, the documentation,
1172860	1178500	the disassembler, the object dump, the compiler, the hardware, every one of those, of course,
1178500	1182700	for anybody who's done embedded development or tool development knows, every single one of those
1182700	1188080	has bugs. So you go through and you fix your bugs and then you find other bugs that are not your
1188080	1194960	bugs but are actually bugs in other tools. So that's kind of the process there. You go through
1194960	1204060	and you just fix the bugs. But yeah, so it's not magic. You just start with the data.
1204280	1210840	You go through and then in Python, you make the function. When you match this pattern,
1210840	1219120	then you use this function to emulate it, right? So Aaron, he really ended up taking
1219120	1227660	charge of the testing and it was incredible. He wrote the most versatile testing or
1229460	1235300	instruction analysis framework I've seen. He basically rewrote an entire disassembler.
1235380	1240880	But instead of spitting out Python objects, he spit out this metadata that he could then bend
1240880	1247520	to his will going, oh, you want it represented this way? And boom, the unit tests started just
1247520	1253460	looking a different way. Oh, that's how that is. Yeah, that's a weird thing. Nobody really agrees
1253460	1260080	on how that works. So that's how Vivisect wants to do it. Okay, I gotcha. So this all goes back
1260080	1267560	to the fact that it's all just bits. When you type a letter to your mom, when you write your report,
1267560	1275980	when you download a video or a picture, that's all just bits. The computer system decides what
1275980	1280900	to do with them. And our disassembler is doing the same thing. It takes in just a
1280900	1286680	string of bytes because bytes are the easiest way for us to deal with the world.
1286680	1295020	And then it looks at a combination of the bits and says, based on these things,
1295020	1299860	that's this instruction. And every architecture kind of has its own nuance and its own flow
1299860	1307500	for Intel. It goes byte by byte going, hey, this first byte puts us into this table of
1308200	1313100	options for instructions. And oh, we hit the second byte here. That falls into another table
1313100	1320980	of instruction options. ARM, it's kind of like a bunch of bit masks and comparisons.
1321200	1326900	Take the thing, mask it with this, and compare it against this. Oh, it's not that? Okay,
1327300	1331960	and it moves down the list until it finds the escape hatch. And then it goes down the escape
1331960	1337820	hatch route when there's a match and says, okay, now pull in these bits and put them as this and
1337820	1344420	that and spits out an op code with operands. It's pretty close to how the PowerPC stuff
1344420	1353300	in VitaSec ended up. Lots of bit masking. Yes. With all these different instructions here,
1353300	1359780	the fun thing with the VLE parts is that they've got different modes. They can run
1359780	1368740	variable instruction mode or full 32-bit instruction mode. But the full 32-bit
1368740	1375020	instructions don't necessarily match the real PowerPC instruction encodings either.
1375020	1380520	So there's just a ton of different ways to do things.
1383300	1387440	Hmm? Can I just look? Yep. Oh, okay.
1391240	1399100	So ARM, if anybody's watched, if anybody's paid attention or done reversing on ARM instructions,
1399840	1411500	ARM breaks things down into different modes of operation by basically jumping,
1412140	1418880	address, to go from ARM to thumb mode. It's a simplistic way of viewing it,
1418880	1423440	but basically that's it. So you can have ARM instructions right next to,
1424300	1430580	grouped right next to a bunch of thumb instructions. In PowerPC with VLE,
1430580	1438860	with variable length encoding, they're not the same. PPC and PowerPC decided to
1438860	1446720	mark individual memory pages as being either VLE or straight PowerPC.
1447720	1452940	So that was actually a push for me to wrap that into Vivisect where I'm going,
1452940	1457600	this is the first time I've ever had that, where it depends on the memory page.
1457600	1465140	We have to configure the memory pages to be either VLE or not so that when the disassembler,
1465140	1472960	that's kind of dumb for all intents and purposes, it jumps to, you give it an address and it's got
1472960	1482300	to spit out an instruction at you. It needs to know which way to decode. So that's just how
1482300	1488400	PowerPC chose to do it. Sure. So if you, and not every single PowerPC processor supports
1488400	1497160	full PowerPC, or the very VLE, maybe they do both. Some of them do only one or the other.
1497520	1502160	Embedded parts, they don't have Altebec for those. Oh, here's another, yeah, no doubt.
1502160	1509360	Altebec, the vector math instructions. Another thing is in most architectures,
1509360	1517200	most embedded architectures in particular, you start out with an interrupt vector table
1517200	1522440	with a reset vector in it. So when you power up the reset vector, however that architecture
1522440	1528280	implements it, the reset vector points to an interrupt service routine or interrupt handler
1528880	1536020	that starts up the processor and boots. And many architectures, that's like address zero.
1538340	1546400	Not PowerPC. PowerPC, there's weird ways of figuring out where code should start. In fact,
1546960	1552760	there's a boot assist module in a lot of the architectures. And the boot assist module is
1552760	1558540	the thing that gets code execution first. And it just starts scouring through specific areas of
1558540	1566080	the flash or hard drive or whatever you're running as your storage. And it looks for a signature.
1566900	1576520	And if the signature is on the right boundary, and it knows then that somewhere a little bit
1576520	1584620	later is a pointer to where instructions should start executing at power up. So weird things,
1584620	1590620	just like all sorts of weirdness. For a long time, PowerPCs had the ability to change which
1590620	1599800	page of memory is big-ending or little-ending. They call it the TLB, just a slightly more
1599800	1606600	granular MMU, I guess. I don't know. Hey, at least it's not a 27-bit middle-ending
1606600	1614640	architecture. I will give it that much. It could be worse. Yeah, I don't know. The
1614640	1622880	documentation, boy, that was really annoying. What was it? The registers. It took me forever
1622880	1627780	because the documentation said the registers are 64 bits. It's interesting for an embedded
1627780	1635020	processor. Oh, except for when you're in VLE mode, you can't access the upper 32 bits of those
1635020	1643800	registers. Okay. Fine. Whatever. Oh, by the way, they're numbered 0 to 31 as the highest,
1643800	1652220	most significant bits. When you're talking about 32-bit mode, you're talking about 32 through 63.
1652220	1658220	Everything is 32 through 63. The architecture isn't the problem. The people writing the freaking
1658220	1662780	documentation are. And it's always been that way. You can't blame the newer stuff for that. It's
1662780	1668940	always been that way. I blame IBM for that one. I'm betting it was them. I don't know. It reads
1668940	1675400	very much like a bunch of companies in the early 90s kind of got together and eventually agreed on
1675400	1680820	stuff. And they agreed by doing it in weird ways. By bringing their weird way to the table and
1680820	1689080	saying you must do it this way because we did it already. Right, right. So let's do something fun
1689080	1698680	here. Okay. So PowerPC is a little different. We're here. We're at DEF CON. We're talking about
1698680	1706800	security things, right? How do you exploit PowerPC? Or no, no. Sorry. Damn it. I did it wrong.
1708240	1713320	Go back a few seconds. Pretend I didn't say that. PowerPC is secure, right? Nobody knows
1713320	1719760	the number. You can hack it. Absolutely. It's in Big Iron. Those are unhackable. Right, right.
1722320	1730800	So obviously, I mean, it's not. It's not impossible to hack. You just need to do it differently.
1732180	1739020	Every processor, it reads in data, spits out data, interprets data as instructions, as I said
1739020	1745480	earlier. You just need to figure out the way you can tell it what's what. So there's no jump ESP
1745480	1755620	instruction in PowerPC, unfortunately, as there's no way to branch directly to a general purpose
1755620	1767000	register. And as the previous slide here pointed out, the stack is a general purpose register,
1767000	1772840	but the link register, very much like ARM, link register, though, is a special register. If you
1772840	1777940	go and look at the documentation for the special purpose registers in PowerPC, I mean, I don't
1777940	1784140	know. Alice, do you remember how many? There's like thousands. Only a couple thousand. I don't
1784140	1789800	even know what you do with all of them. We have a table with a lot of them in the decoder.
1790620	1796960	There's a lot of them. So move to link register is actually not even an instruction. It's actually
1796960	1812640	move to SPR with LR as an operand. That's true. Move MTSPR 1, LR. MTLR is a mnemonic that some
1812640	1820860	assemblers allow. Now, we like that. It's intuitively pleasing. But I'm just saying that's
1820860	1827460	how the architecture breaks down. Yep. Yeah. So move to link register. Link register is, of
1827460	1834260	course, where you return to. Again, like ARM, you store the value place you came from on the link
1834260	1840560	register. And when you need to return to it, it loads an address back into the link register.
1840580	1846400	Well, if you can make some, whatever that was stored on the stack, if you can modify that
1846400	1850840	address on the stack, you can jump back to where you want it to go to, not where it's supposed to
1850840	1856580	go. Account register is a weird one. Account register in PowerPC is used for a lot of jump
1856580	1864300	tables and function pointers. So that's another one. You could just modify that and get hold of
1864400	1872620	a switch statement. So nice little rock gadgets here. Yeah. I wanted to put some fun in here,
1872620	1882300	you know? I love that you consider that fun. Right. Right. This was not as fun. This is not
1882300	1892380	so fun. If you go and look at, I'd say, I don't know, probably two thirds or so,
1893080	1898380	66% of all bugs in all PowerPC tools are related to this instruction.
1899140	1905160	Wait, that's one instruction? Yeah, it's one instruction, right? Actually, no,
1905160	1911180	this isn't one instruction. It's only a couple. Two or three, whatever. It doesn't matter.
1911180	1918900	There's these rotate instructions. Rotate left with bullshit. That's what I read there.
1918900	1924940	Rotate left. Word. Immediate. Thing. This one. This one, right?
1928020	1932480	Unfortunately, this Twitter account didn't tweet for very long.
1934620	1939720	But it's really interesting to, as you say, nerds like me.
1940700	1945500	We don't need to make it up, though. I mean, they included the EIEIO instruction.
1945500	1953560	Yes. I mean, that's dropping the mic for instruction lunacy. Right. So,
1954120	1958580	I don't have much time left in the talk, unfortunately. A little bit.
1959340	1964440	Go ahead. Should move, probably move it along instead of making jokes about PowerPC instructions,
1964440	1973040	as much fun as that is for me, anyway. Yep. Oh, hey, we're to story time.
1973040	1983180	Story time with Atlas. So, we do a lot of work with a lot of people that we care very deeply for.
1983240	1991020	And so, there's stuff that we have, but we can't use it for a talk. So, we were scouring the
1991020	1997760	internet for something that we could show and not have to make anybody uncomfortable.
1997760	2003970	We ended up finding a repository of a whole bunch of automotive code on some
2005240	2012220	sketchy website. So, downloaded a bunch of things that I could identify as something
2012220	2023960	potentially PowerPC. And thankfully, I threw one in Vivisect. And it's just a blob at this point.
2023960	2034500	So, this is a VBF. VBF is basically a file package, almost a file format. Not really.
2034500	2041480	It starts off with a couple headers and then goes to binary code. So, I slapped in a VBF
2043440	2046900	into Vivisect, and I just started scouring around
2046900	2054900	what things were. And thankfully, the very first one I loaded in,
2054900	2063820	I guessed well. And I hit decode, or I hit C for make code. And I got a branch instruction
2064420	2069440	followed by three NOPs, another branch instruction, followed by three NOPs, and
2071080	2076960	a repeating pattern. There are like a thousand of these in this firmware.
2079060	2085300	But it could have been just a weird repeating pattern. So, I wasn't going to bank on that.
2085980	2089420	So, I started looking through. What's that, Aaron?
2089420	2096460	Oh, I just wanted to interject here. For those of us who have been done PowerPC programming,
2096460	2104120	this type of pattern is extremely common. PowerPC lines up every interrupt handler, every...
2105180	2113260	what's that? 64 bytes? No. 148 bytes? Whatever. And that's very common. Of course, you'll need
2113260	2119000	this many instructions to handle your interrupts. So, the thing that made me queasy and, well,
2119000	2124780	it made me uncertain was that this is not a full firmware image. This is something that
2126840	2135320	an ECU would basically have its own base image because if you have a firmware upgrade go bad,
2135320	2141020	you don't want to lose your CAN interface, for example, because that's how you flash firmware.
2141020	2148460	So, they have a core bootloader base image that gets the device on the CAN network and
2148460	2156100	accesses, you know, allows access through the various tooling and protocols. And so,
2156100	2161200	I knew that that was going to own the interrupt service routines and the interrupt vector table
2161200	2166260	and anything that would be normally things I would go looking for in a piece of firmware.
2166860	2174460	That wasn't in this. This was going to be something else. So, I saw this and I thought,
2174460	2183940	it could be PowerPC and this could be a branch table that is indexed so that the base firmware
2183940	2190920	knows, hey, this index at this address just go, boom, there's the thing and the rest of the
2190920	2197980	firmware handles it, the new firmware that we've just installed. Or it could be some crazy other
2197980	2203940	architecture that has nothing to do with PowerPC. You can never be certain unless you actually know
2203940	2209680	and the VBF file in its text comment didn't have anything about what architecture. Plus,
2209680	2213280	there's this architecture I keep running into that I don't know much about. Aaron,
2213280	2221320	you know more about it, TriCore, that I haven't done enough reversing on to actually know if I
2221320	2228460	would identify it. So, I was still kind of skeptical. So, next slide, Aaron.
2228460	2240220	Yep. So, I right-click on the first address that it's being branched to and I send the target,
2240220	2246220	the 4250C address, over to another analysis window. So, this is the VIV window. I've created
2246220	2263540	another memory viewer called foo. Why? Because foob are best. So, anyway, I think I threw this
2263540	2272200	in out of order. Sorry. So, here's like you can see that backup one. One slide. So, we start at
2272200	2280640	40,000 hex. So, that's a lot bigger than 40,000. But anyway, 40,000 hex. Scroll forward one.
2281640	2296160	And we're still doing this table thing. 1,300 hex into this firmware. And that is 130 hex
2296160	2308840	options. So, far, just 130 hex different branch options. Okay. Now, next. So, we follow the
2308840	2319160	location. And here's what they point at. Another table of branches that some of them point to the
2319160	2326060	same thing. And as you can see, so, they're branching to location 43228. And you'll notice
2326060	2333220	that the bytes that make up those instructions are not the same. It's not like boom, boom, boom,
2333220	2338200	boom, boom, a table of all the same thing repeated. It's all the same thing, but these are
2338200	2344620	relative branches. So, the numbers decrease as they go higher. So, the fact that each of those
2344620	2351900	points at 43228 gives me a clue that this might actually it's getting more likely that this is
2352600	2358880	PowerPC firmware. I mean, it's easy to just look at this. You'll start looking at those values
2358880	2365880	that make up those instructions. It almost looks like this is just, you know, a bunch of, you
2365880	2373260	know, sequential memory addresses or something like that. It's very weird. Yep. Okay. Next.
2374020	2381200	Until we run into hex 43,000. And at hex 43,000, we start to see real
2382340	2387800	instructions. Now, many architectures, you give them four bytes, they can spit out an instruction.
2387800	2395400	So, this does not mean that it's PowerPC. But we see these things peppered throughout a little
2395400	2402680	bit of the previous table where everything was pointing to one location. And then after a bunch
2402680	2413240	of them, we run into move to SPR, SPR G0, and we move from R3 into that. Okay. And then we move
2413240	2423100	from SPR counter, the counter register, into R3. So, we've stored R3 and then we put the counter
2423100	2431800	into the counter register value into R3. And then we move to the SPR G1 from R3. Okay.
2432680	2442720	Could be logical. Okay. Load immediate shifted zero into R3. So, we're not overwriting anything
2442720	2448300	that we've just put into R3 without storing R3. So, okay. Sanity still exists.
2449300	2455440	Load word zero extended. I think that's what that means. Although, I've been having to look up a lot
2455440	2468440	of words. Okay. So, we take R3 and yeah, anyway, you're seeing the pattern. Things are actually
2468440	2473440	starting to make sense. And after doing things with R3, we then move it into the counter register.
2474400	2482080	We load immediate zero into register three. So, we wipe out, we clear R3 again, and then we branch
2482080	2489640	to counter. Okay. That makes sense. That actually is a chunk of code that makes sense to me.
2491600	2495280	After that, so branch with counter, that's the end of a code block.
2495800	2499900	Because there's no branch with a link. There's no return. No nothing. It just goes somewhere.
2500540	2505520	After that, though, we see STWU. No, that's not shut the what up.
2507840	2514200	And this, man, I captured the pointer right in front of that. Right in front of that. Anyway,
2514200	2521140	that's actually part of a function prologue. A very standard function prologue for RPC.
2521220	2530020	So, R1. R1 is a stack pointer, right? So, this is moving the stack pointer.
2530540	2541580	Yep. Basically storing the stack pointer and storing register 0, 2, 4, 5, 6, 7, 8, 9, 10,
2541580	2549000	11, 12 into the stack. So, we create stack space and then we write registers into it. Okay. That
2549000	2555040	sounds legit. The PowerPC calling convention includes handing arguments as registers.
2556060	2561440	And you got to clean up after yourself when you're done. So, storing the registers
2562100	2570360	that aren't arguments totally makes sense. Move from SPR, the link register into R0.
2570360	2578240	Okay. So, our link register now, the return address now lives in R0. And then, okay. I'm
2578240	2584760	convinced. This is PowerPC. So, next? Well, from the point of view of somebody
2584760	2591720	who's written RPC for embedded systems, SR0, SR1 down at the bottom there, those are special
2591720	2596360	purpose registers that are the system state, system control registers, telling you, like,
2596360	2601660	what your current state is. The stuff up at the top of this, this was taking a look at
2604400	2610000	SPRG0 and G1, I believe are... oh, boy. It's been too long. I probably shouldn't say
2610000	2616700	anything. Anyway, what it looks like to me is it looks like it's saying what address caused
2616700	2623760	the particular interrupt. Why are we here? Right? And then, it's looking up, it's doing a
2623760	2631100	calculation based on R3, which is, I guess, zero, right? So, it's jumping. For some reason,
2631100	2637840	doing a jump calculation to one specific address. This LIS... I keep pointing my screen,
2637840	2641960	like people can see what I'm pointing at. I can't help it. Make sure you're pointing at the camera.
2641960	2648440	At the camera? Right. So, LIS, LW, those are very common for PowerPC. It's also something that a
2648440	2656180	lot of first engineering tools have issues with, because this is PowerPC fixed instruction work.
2656180	2659760	You can't have a 32-bit address in one instruction. You've got to have two,
2659760	2666120	so it's lower 16, and then low, the upper 16 bits. Right.
2667140	2673720	Which is very common in any fixed width instruction architecture, because,
2673720	2680200	turns out, the register size typically is the same as the instruction size. So,
2680200	2684900	try loading the full value into a register in one instruction. It's impossible,
2684900	2691020	unless you store the value and somehow dereference some other address to load it
2691020	2698560	into a register, which ARM does, actually, all the time. Okay. So, I wanted to throw in
2698560	2706480	an interesting thing. There's so many different details that make Vivisective fun and exciting
2706480	2713820	reversing platform. Part of it is that there are many things that are not hidden from you.
2714380	2721520	So, one of the things that Vivisect does for branch analysis, for switch case analysis,
2721520	2729100	for example, most often, a switch case turns into one or more dynamic branches.
2729740	2737940	So, if you've got, let's say, switch on this variable being 1, 2, 3, 4, and 5. Okay. Those
2737940	2744280	are, those different options are going to be stored as pointers to the code that handles
2744280	2753400	each of those options. And then indexing into a table to grab the address to then branch right
2753400	2757980	into that. That's a dynamic branch. You cannot figure out where that branch is supposed to go
2757980	2765540	without an emulator. Or a lot of emulation written down into code that's not an emulator.
2766340	2777720	There's also a lot of things like C++ method invocation. When you've got multiple inheritance
2777720	2788400	with virtual function tables, you basically have a table that lists each type of call. So,
2788400	2798320	an object called ball, and I have a method, get color, bounce, throw in the trash,
2798320	2805080	throw at my sister. These are all method calls that go into a virtual function table.
2805080	2812700	And so, when executing any of those, actually, the code goes, okay, grab my virtual function
2812700	2820660	table and index into that virtual function table and then call, make the desired call.
2820980	2827880	And since all of this is done on heap, typically heap objects that just have a pointer to a virtual
2827880	2834140	function table, there's no way that the code can just say, this is a foo call that goes to this
2834140	2841460	address location. At least not when virtual function tables are involved. So, we get,
2841460	2847480	as part of the process, Vivisect stores all dynamic branches in what's called a VA set,
2847480	2854300	or a virtual address set. And virtual address sets are nothing more than analysis tools. It
2854300	2859620	just happens to be an analysis tool that Vivisect then makes use of, but I get to make use of it as
2859620	2866980	well, where I can just list all the dynamic branches through that has been updated as
2866980	2875240	code flow analysis happens. And then, turns out, dynamic branches are very, very interesting
2875240	2886100	things. They tell a ton about what's going on with the code. Typically, making sense of
2886100	2895300	assembly instructions is not typically terribly hard. Spark notwithstanding.
2896220	2906080	Just kidding. However, finding in this massive, maybe four megabytes of firmware, what things are
2906080	2912920	interesting, that can be hard. And I love doing this. I could do this all day long, and I could
2912920	2917820	work myself right out of a marriage, and right out of my kids' lives, and right out of a job.
2918460	2924020	But if I want to do the things that I love, including being a dad, being a husband, riding
2924120	2931220	a motorcycle, and hacking, then I need to be able to focus in very easily, quickly on interesting
2931220	2936380	things. And so that's why I threw this in there. Dynamic branch handling is very interesting. And
2936380	2943340	of course, these are a bunch of branch to control, or I'm sorry, branch to the counter register
2943960	2953520	with link, which means it's a call, not a straight branch. So things are expected to,
2953520	2963400	this instruction. So that's very likely, that could very well be C++ stuff, or it could be
2963860	2970560	function pointers, or whatnot. So either way, it's very interesting. I'm done if you...
2971620	2985710	Okay. So I was just poking through this, one of the firmwares that I was looking at for this
2985710	2994130	presentation. And of course, I was looking at the dynamic branches. And here's one. This was an
2994130	3002090	oddity. I mean, it actually wasn't an oddity. It struck me weird. But I'm just looking at it. And
3002090	3009050	in this code block, if you're not familiar, this is a code flow graph. It's a great way to display
3009690	3018590	assembly language code for humans that don't want to sit with a linear look and draw arrows to where
3018590	3027090	code flow happens. It just kind of flows naturally. So in the code block in the middle,
3027090	3038510	there's a discrete code block. And it looks like we are loading values into the R12 register.
3039650	3044270	And then we're moving the R12 register data into the counter register. And then we're branching to
3044270	3049530	the counter register with link. We're calling whatever is at this thing that we're loading into
3049530	3060970	R12. So I'm going, hmm, how's that work? And I'm wanting to make sure that I understand what's
3060970	3067390	going on. So I walk through and I'm like, okay, load immediate shift. That loads
3070790	3084230	basically 40000 into R12. So the shift means shifted 16 bits. And then load word. Word is 16
3084230	3095190	bits with zero extension. That 4 with parentheses around R12. Now, when I first thought it,
3095190	3103230	I'm going, that's not, I didn't actually, I got it wrong. I'll just say it. And I said, okay,
3103230	3117490	that's going to say 40000 plus 4 is going to be 4004. Okay. That's not what ends up in R12.
3117590	3126370	But that's what I thought. Next. So I went there. And I thought, okay, let's see what that's doing.
3127970	3137970	40004, it has, let's look at the first four bytes. 000D5C20. VimSec has a preview instruction
3138710	3147610	option. It's control P from the keyboard to use the already selected architecture. But I wanted
3147610	3152990	to show you, so I right clicked and the context menu said preview instruction, because it's not
3152990	3162090	anything right now. That only shows up if it's not decoded as anything. And then I get to pick
3162090	3168730	the platform, and I chose PPC embedded, PowerPC embedded. I don't know if you can hear the
3168730	3176190	lightning. Okay. So I click on that, and I did it three times, because, you know, once isn't
3176190	3182110	enough. And each time I got a decode exception, I'm going, uh-oh, crap, I've got a bug. I've got
3182110	3194870	to go figure out why this is not working. And so next, remember, 40004. So I loaded up a tool
3194870	3203250	that I built a long time ago, and it has only become more dear to me. I used this tooling to
3203250	3210670	reverse engineer a lot of different things with VimSec, and actually it found its way into a
3210670	3218610	Deliverable one time. But this is part of the Atlas Utils tool belt, which I think I started as
3218790	3229970	a Perl, a library of Perl, way back in 2006, 2005, 2006. It was crazy. Made the switch to Python,
3229970	3237570	and just kept adding to it. Basically, I'll make no bones. It's a pile of steaming shit code that
3237570	3244710	you may not want to read. But I found it to be exceedingly useful. So I share it. Please don't
3244710	3255050	hate me for it. So I created a thing called an MUtils package, which was based around originally
3255050	3266370	VDB and VTrace, the tracing library underneath that makes VDB work. But I really ended up using
3266370	3272590	it a lot for emulators. So VimSec makes emulators available. In fact, I'm using right here what's
3272590	3280110	called a workstation emulator. And workstation emulators come with some special sauce. For
3281070	3288810	example... all right, I'm unplugging the laptop now. Special sauce here, you'll see weird entries
3288810	3295910	for R0, R2, R3, R4, R5, R6, blah, blah, blah, blah. And basically what that is, workspace
3295910	3303750	emulator, when it first wraps in the concepts of memory, registrar, and instruction emulation,
3304250	3310150	the workspace emulator goes a little further and it says, I'm going to do taint tracking on all the
3310150	3319890	argument or all the registers that could possibly be arguments. So it just takes and puts specialized
3319890	3326150	numbers into each of those locations that will then trace through code. And we'll be able to see
3327030	3338050	if any uninitialized registers are accessed before assigning values to them. Because that
3338050	3344570	could mean either an uninitialized variable, or it could mean that that's an argument.
3344570	3353250	So we use this to identify calling convention and to do other various analysis. So the first
3353250	3362890	instruction is a load immediate shift of 4 into R12. So 4, 0, 0, 0, 0. You can see that at the
3362890	3369830	bottom. In fact, hold on, back up, Aaron. One of the things I love, again, it's really ugly code
3371570	3376610	that I take no pride in, but I take pride in the results. You'll see that I print out a whole
3376610	3381310	bunch of interesting registers for each instruction. And that's kind of how I am with GDB,
3381310	3385250	too. I like dump all the things, and this is actually a lot better than doing info register
3385250	3395170	after every instruction. But then the Emutils throws in anything that could be a dereference.
3395170	3405290	It prints out some context around that data. So let's see. We're looking at memory location
3405290	3414530	address 4, and I think that's because I don't actually... oh, because we have the number 4.
3414530	3419030	So it says, oh, okay, there's an immediate 4 here. That could be an address. So let's kind of look at
3419030	3428090	that, because memory address 4 is valid in this case. Okay. So next... so the next instruction is,
3428090	3433990	oh, we see highlighted here, R12, and I'm moving my mouse pointer around R12 right now.
3433990	3443450	Thanks, Aaron. So R12 shows up. Okay. 4, 0, 0, 0, 0. Cool. But one of the things that I love about
3443450	3449730	emulators and disassembler, or in debuggers, is that they teach me so much about an architecture,
3449730	3459190	and they correct me all the time. So the next instruction is that LWZ R12 4 with parentheses
3459190	3467590	wrapped around R12. Okay. What's that do? I think that should create an address 4, 0, 0, 0, 4.
3469330	3477430	Yep. And by the way, as you can see, it registers, and then it prints out the value of what's at 4,
3477430	3490130	0, 0, 0, 0, 0. It then prints out some context data around D5C20. No idea why. Okay. I do.
3490130	3500290	Spoiler alert, though. 4, 0, 0, 0, 4. Okay. Oh, that's it. I must... this must add 4 to 440,000
3500290	3512330	hex. And so it's printing off... oh, wait. 4,000... 40,004 starts off with D5C20. Huh. So hit enter.
3514780	3522280	Okay. So that instruction updated R12, and it put D5C20. See, the thing that I was forgetting is
3522280	3530980	that the integer followed by parentheses and a register in it isn't the addition of the two
3530980	3536780	things together. It is actually adding them together and using that as a memory dereference
3536780	3544820	point. So it went to 40,004, and it grabbed a pointer there, and it put it into the register
3546840	3553080	because D5C20 is actually the location of code. So if I go to D5C20, I'm going to be able to
3553080	3561340	decode code, or it may already be decoded. So we move R12 into counter, and then we branch. Okay.
3561340	3568420	And we don't have time to really talk much about... actually, we are out of time.
3568420	3574120	I don't have time to talk about Symbolics much today, but that's coming. But I did want to throw
3574120	3580780	this at you. Right-clicking, I have a Symbolics window up, and so I send that address to Symbolic
3580780	3590760	zero. That's the window. And this is probably a lot to digest, and the idea is to reduce things
3590760	3598020	down to make programmatic analysis easier, but this view is a way for making Symbolics
3599160	3607380	valuable to the reverse engineer that's using the GUI. And as you can see, at 24,104, that address
3607380	3614540	that you'll see highlighted on the left in yellow, because when we get into Symbolics view,
3614540	3620760	we have to pick a path through code. And we can direct it some, but we have to pick a particular
3620760	3629160	path to make sense. And so for that path, it then highlights all the instructions in yellow
3629160	3636740	that are in that path. So as I scroll through the different paths, those yellow backgrounded
3636740	3642640	things will change. But as you see highlighted down here, I've shown that it's the memory
3642640	3653620	dereference of 40,004, four bytes long, that is used as a pointer to call a function. And then
3653620	3660320	the arguments are listed here. And you'll notice some of these, the cascades. So up above, you've
3660320	3667240	got 23C60 as a call. The results of that are then used in various different things throughout the
3667240	3671480	analysis. And with that, I think we're about done.
3671840	3676040	Yeah, we're kind of out of time here, but we can probably leave it up on that for a bit.
3676400	3680120	Yeah, well, let's let's take a second and talk about future, just for future.
3682340	3688940	So PowerPC is huge in a lot of areas that are kind of not getting a lot of attention by
3688940	3695380	security researchers, at least not publicly. So we're using this as a launching point to do
3695380	3708700	reversing and analysis of IBM and embedded things. So the IBMI and the P-series, the power stuff.
3711140	3716100	And this is going to make its way into some emulation projects that are very,
3716100	3719500	very interesting that we'll talk about more later. And
3721900	3730520	I intend to make the symbolic analysis engine in PowerPC push forward the art of reverse
3730520	3738420	engineering and exploitation. So that's all for that slide. And I intend to make Aaron
3739440	3744100	the lead on a lot of stuff, but his wife doesn't know it yet.
3745140	3747400	You have to teach me some math, I guess.
3748520	3751360	Okay, so we want to throw in some resources.
3751560	3760220	Yeah, so DevSec. I honestly for the PowerPC resources themselves, you could probably go
3760220	3766560	back and read a large number of documents. But these are some of the more useful ones,
3766560	3771420	at least for embedded. We didn't even touch on it. SPE is kind of the
3774020	3782680	PSP stuff for embedded NXP processors. You can see this is the NXP files.
3784900	3786080	They're subtle.
3788820	3792560	I think the weather is telling us it's time to move on, isn't it?
3792560	3798300	Yeah, no doubt. All right. No time for Q&A, but you can hit us in...
3798900	3800320	We'll be in Discord.
3801420	3804580	All right. Thank you all. Thank you, Aaron.
3804740	3805760	No, thank you.