1 00:00:00,120 --> 00:00:01,110 - Walking over to this talk, 2 00:00:01,110 --> 00:00:02,177 I was thinking to myself, 3 00:00:02,177 --> 00:00:04,740 I'm a full-time job as a developer. 4 00:00:04,740 --> 00:00:06,330 And I'm thinking if there's one thing 5 00:00:06,330 --> 00:00:08,040 that developers love doing, 6 00:00:08,040 --> 00:00:09,720 and we're super competent at, 7 00:00:09,720 --> 00:00:10,833 it's string handling. 8 00:00:11,820 --> 00:00:14,280 It's not like there's an entire industry based 9 00:00:14,280 --> 00:00:18,030 on just how poorly we've mangled that up over the years. 10 00:00:18,030 --> 00:00:20,370 And if there's a second thing we really love doing 11 00:00:20,370 --> 00:00:23,760 and are great at implementing correctly, 12 00:00:23,760 --> 00:00:24,693 it's Unicode. 13 00:00:27,120 --> 00:00:29,250 So, I'm sure we're in for something exciting here 14 00:00:29,250 --> 00:00:31,590 with Unicode. or Emoji Shellcoding. 15 00:00:31,590 --> 00:00:33,873 So help me welcome Hadrian and Georges. 16 00:00:34,720 --> 00:00:37,470 (crowd applauds) 17 00:00:41,640 --> 00:00:42,630 - Hello, Defcon. 18 00:00:42,630 --> 00:00:43,530 How are you today? 19 00:00:44,515 --> 00:00:45,630 (crowd cheers) 20 00:00:45,630 --> 00:00:48,510 Great, welcome on board. 21 00:00:48,510 --> 00:00:50,250 Before we depart, 22 00:00:50,250 --> 00:00:52,380 please make sure that your seat is up, 23 00:00:52,380 --> 00:00:53,970 Your tray table is stowed, 24 00:00:53,970 --> 00:00:57,000 and your seatbelt is securely fastened. 25 00:00:57,000 --> 00:00:58,920 If you have any electronic device, 26 00:00:58,920 --> 00:01:01,353 please switch it to Defcon mode, now. 27 00:01:05,070 --> 00:01:07,830 Please be careful when opening your overhead bins 28 00:01:07,830 --> 00:01:10,200 as Emojis may fall on you. 29 00:01:10,200 --> 00:01:12,033 Thanks and enjoy your talk. 30 00:01:14,771 --> 00:01:16,830 (crowd applauds) 31 00:01:16,830 --> 00:01:18,840 So, let's present ourselves. 32 00:01:18,840 --> 00:01:20,321 So this is Hadrian. 33 00:01:20,321 --> 00:01:21,309 - [Hadrian] Hello. 34 00:01:21,309 --> 00:01:22,142 - It is first Defcon talk 35 00:01:22,142 --> 00:01:24,390 and I'm Georges, it's my second Defcon talk. 36 00:01:24,390 --> 00:01:26,310 So security researchers at 37 00:01:26,310 --> 00:01:28,792 Economic Superior in Paris, France. 38 00:01:28,792 --> 00:01:32,010 We are both French, as you may have guessed, 39 00:01:32,010 --> 00:01:33,990 and we both managed to fail at the (indistinct) test, 40 00:01:33,990 --> 00:01:35,240 but that's another issue. 41 00:01:36,870 --> 00:01:38,250 What we're gonna see today. 42 00:01:38,250 --> 00:01:40,080 So we're going to talk about some 43 00:01:40,080 --> 00:01:41,500 generic tooling and methods 44 00:01:42,750 --> 00:01:45,273 to write Shellcodes under heavy constraints. 45 00:01:46,560 --> 00:01:48,960 We'll dive into the dark art of shellcoding. 46 00:01:48,960 --> 00:01:50,490 We'll play with Emojis 47 00:01:50,490 --> 00:01:53,520 to make computers do things they definitely shouldn't do. 48 00:01:53,520 --> 00:01:54,450 By the way, 49 00:01:54,450 --> 00:01:58,500 you'll also see the first emoji Shellcode ever created. 50 00:01:58,500 --> 00:02:01,170 Brace yourselves, we're gonna turn Emojis 51 00:02:01,170 --> 00:02:02,373 into merciless payloads. 52 00:02:05,790 --> 00:02:09,120 So let's begin, who has ever returned a shellcode? 53 00:02:09,120 --> 00:02:10,170 Just raise your hand. 54 00:02:12,180 --> 00:02:13,775 Come on, just raise your hand. 55 00:02:13,775 --> 00:02:15,390 Don't be shy. 56 00:02:15,390 --> 00:02:16,490 Feds won't arrest you. 57 00:02:17,970 --> 00:02:22,170 Well, about 20%, 10 or 20%. 58 00:02:22,170 --> 00:02:23,373 So for the remaining, 59 00:02:24,240 --> 00:02:26,940 let's explain what a shellcode is from the beginning. 60 00:02:26,940 --> 00:02:30,270 So a shellcode is some code that you either 61 00:02:30,270 --> 00:02:33,270 found or managed to inject in your target. 62 00:02:33,270 --> 00:02:36,000 This code generally gives you some power. 63 00:02:36,000 --> 00:02:37,530 Usually it pops a shell. 64 00:02:37,530 --> 00:02:38,970 That's why we call it a shellcode. 65 00:02:38,970 --> 00:02:41,550 Now we can do a lot more on things 66 00:02:41,550 --> 00:02:44,070 than simply spooning a shell. 67 00:02:44,070 --> 00:02:45,030 And generally, 68 00:02:45,030 --> 00:02:47,670 what you do is after injecting it in your target, 69 00:02:47,670 --> 00:02:50,823 you jump onto it using what we call a vulnerability. 70 00:02:51,810 --> 00:02:53,854 So, you can have the buffer overflow, 71 00:02:53,854 --> 00:02:54,687 use After Fee, and so on. 72 00:02:54,687 --> 00:02:58,230 Just go to the CVEC list and you have all of them. 73 00:02:58,230 --> 00:03:00,480 And the typical scenario is 74 00:03:00,480 --> 00:03:04,140 you send a carefully crafted string to your target 75 00:03:04,140 --> 00:03:06,190 and your profit, and you have your shell. 76 00:03:07,740 --> 00:03:10,260 However, there are many issues with shellcodes. 77 00:03:10,260 --> 00:03:11,700 So the first thing, for example, 78 00:03:11,700 --> 00:03:13,830 if you have a buffer overflow using a scan F, 79 00:03:13,830 --> 00:03:16,350 so, you need to input a C string. 80 00:03:16,350 --> 00:03:17,400 And a C string, 81 00:03:17,400 --> 00:03:19,320 you can't have a new character inside 82 00:03:19,320 --> 00:03:21,270 because it breaks everything. 83 00:03:21,270 --> 00:03:22,103 Same, 84 00:03:22,103 --> 00:03:23,670 if you treat it as input, 85 00:03:23,670 --> 00:03:25,830 same, think again about scan F, 86 00:03:25,830 --> 00:03:27,120 you can't have white spaces 87 00:03:27,120 --> 00:03:29,880 because it'll just break your shellcode in half. 88 00:03:29,880 --> 00:03:31,260 You can have other constraints. 89 00:03:31,260 --> 00:03:35,400 So for example, your name can only contain letters. 90 00:03:35,400 --> 00:03:37,560 So you can't have a name with digits. 91 00:03:37,560 --> 00:03:41,130 Or it, you can also have string escaping. 92 00:03:41,130 --> 00:03:43,380 So, if you put it in a form, generally, 93 00:03:43,380 --> 00:03:44,970 you have string escaping which 94 00:03:44,970 --> 00:03:46,740 tends to break your shellcode. 95 00:03:46,740 --> 00:03:48,090 And of course, 96 00:03:48,090 --> 00:03:51,662 trying to pass your input with containing slash bin slash SH 97 00:03:51,662 --> 00:03:54,240 as your first name is not really credible. 98 00:03:54,240 --> 00:03:56,340 So, it does not look legit at all. 99 00:03:56,340 --> 00:03:57,663 So it gets deducted. 100 00:03:59,940 --> 00:04:00,773 What can we do? 101 00:04:00,773 --> 00:04:03,540 So here we go into the domain of constraint, shell coding. 102 00:04:03,540 --> 00:04:04,860 So generally, 103 00:04:04,860 --> 00:04:08,640 many hackers want to pass their shellcodes as pretty selfie. 104 00:04:08,640 --> 00:04:12,330 So the idea is, you want to reduce the set of characters 105 00:04:12,330 --> 00:04:14,580 that are used for your shellcode. 106 00:04:14,580 --> 00:04:17,820 One of the normal constraint that have been studied 107 00:04:17,820 --> 00:04:19,680 for long is alpha erection coding. 108 00:04:19,680 --> 00:04:23,490 So, your shellcode must only use letters and digits. 109 00:04:23,490 --> 00:04:26,070 Here, we're going to see on X86, 110 00:04:26,070 --> 00:04:28,680 and X86 has been solved quite a long time ago. 111 00:04:28,680 --> 00:04:31,773 So here it has been solved by rix in 2001. 112 00:04:32,640 --> 00:04:33,870 And the idea is really simple. 113 00:04:33,870 --> 00:04:36,450 So you take your letters and your digits, 114 00:04:36,450 --> 00:04:39,000 you disassemble them and you look what happens. 115 00:04:39,000 --> 00:04:40,560 So here on X86, 116 00:04:40,560 --> 00:04:41,400 it's pretty easy 117 00:04:41,400 --> 00:04:43,800 because you have single letter instructions 118 00:04:43,800 --> 00:04:47,190 for push and pop, which allow you to manipulate the stack. 119 00:04:47,190 --> 00:04:50,430 You can also increase increment and decrement registers 120 00:04:50,430 --> 00:04:52,620 with only single letter instructions. 121 00:04:52,620 --> 00:04:56,520 You also have control flow instructions, like jump and comp. 122 00:04:56,520 --> 00:04:57,750 So this is pretty easy. 123 00:04:57,750 --> 00:04:59,250 There are all alphanumeric, 124 00:04:59,250 --> 00:05:02,086 and you also have the xor operation, 125 00:05:02,086 --> 00:05:04,680 which does an exclusive or, 126 00:05:04,680 --> 00:05:07,200 with many many operands that are all alphanumeric. 127 00:05:07,200 --> 00:05:10,980 So it's pretty easy shellcoding on X86. 128 00:05:10,980 --> 00:05:14,220 And if you want to switch to X64, so it's pretty easy. 129 00:05:14,220 --> 00:05:16,260 You just put a capital H 130 00:05:16,260 --> 00:05:18,180 in front of every instruction you want, 131 00:05:18,180 --> 00:05:19,080 and it works, 132 00:05:19,080 --> 00:05:21,430 except for increasing and decreasing registers. 133 00:05:22,743 --> 00:05:24,862 All right, so X86 is pretty easy. 134 00:05:24,862 --> 00:05:27,390 Actually, it's even so easy 135 00:05:27,390 --> 00:05:31,080 that other people manage to go much further than that. 136 00:05:31,080 --> 00:05:32,850 So people tried. 137 00:05:32,850 --> 00:05:34,380 So this is not at framework anymore 138 00:05:34,380 --> 00:05:37,110 because here we add some spaces and punctuation, 139 00:05:37,110 --> 00:05:39,900 but people managed to write shellcodes entirely in English. 140 00:05:39,900 --> 00:05:41,790 So the idea is you take English words, 141 00:05:41,790 --> 00:05:43,170 punctuation signs, and so on, 142 00:05:43,170 --> 00:05:45,870 and you want to make a shellcode that looks like English. 143 00:05:45,870 --> 00:05:47,553 So this will be our first demo. 144 00:05:51,870 --> 00:05:56,870 So in this scenario, what we'll be doing on X86 computer, 145 00:05:57,480 --> 00:06:00,270 so we will do a set user ID exploit. 146 00:06:00,270 --> 00:06:03,660 So this happens on lot of computers. 147 00:06:03,660 --> 00:06:06,480 So take, for instance, changing your password. 148 00:06:06,480 --> 00:06:07,470 To change your password, 149 00:06:07,470 --> 00:06:09,540 so any user can change his own password. 150 00:06:09,540 --> 00:06:11,970 For this, you have to modify the password file, 151 00:06:11,970 --> 00:06:15,240 which is the on Lenox, on ITC shadow. 152 00:06:15,240 --> 00:06:18,570 And for this, you do not have the right permission to do so. 153 00:06:18,570 --> 00:06:21,360 So someone has to change the password for you. 154 00:06:21,360 --> 00:06:23,340 For this we have especially program, 155 00:06:23,340 --> 00:06:24,930 which is called a Set User ID Program. 156 00:06:24,930 --> 00:06:26,670 So it's a program with have a special permission 157 00:06:26,670 --> 00:06:28,410 that a user can execute 158 00:06:28,410 --> 00:06:31,230 that performs actions at the administrator level, 159 00:06:31,230 --> 00:06:32,700 which is root on Lenox. 160 00:06:32,700 --> 00:06:34,680 So here we can check for this program here. 161 00:06:34,680 --> 00:06:37,140 We can see it's called main, it's in red, 162 00:06:37,140 --> 00:06:39,450 and we have the S bit in the permission 163 00:06:39,450 --> 00:06:42,600 that describes that it is a set user ID program. 164 00:06:42,600 --> 00:06:44,970 So, if this program has a vulnerability, 165 00:06:44,970 --> 00:06:46,710 instead of changing just your password, 166 00:06:46,710 --> 00:06:49,770 what you can do is send a shellcode to have other actions. 167 00:06:49,770 --> 00:06:53,220 So here we want a wood shell from this vulnerable program. 168 00:06:53,220 --> 00:06:55,620 So it's completely vulnerable here. 169 00:06:55,620 --> 00:06:58,350 So I just take my shellcode so you can see indeed 170 00:06:58,350 --> 00:07:00,330 that it looks like English. 171 00:07:00,330 --> 00:07:01,290 If you try to understand it, 172 00:07:01,290 --> 00:07:03,040 actually it does not mean anything. 173 00:07:04,320 --> 00:07:07,143 And then when I paste it, I press enter. 174 00:07:08,066 --> 00:07:09,480 And here I have my codeshell that just wants, 175 00:07:09,480 --> 00:07:10,653 so I can check indeed, 176 00:07:11,921 --> 00:07:13,313 I have UID zero, which is what. 177 00:07:14,524 --> 00:07:17,274 (crowd applauds) 178 00:07:23,370 --> 00:07:24,456 - Thank you, George. 179 00:07:24,456 --> 00:07:28,148 So, we have seen that doing alphanumeric shellcoding 180 00:07:28,148 --> 00:07:30,570 on X86 works fine. 181 00:07:30,570 --> 00:07:32,730 What about other architectures? 182 00:07:32,730 --> 00:07:35,580 Well, let's focus typically at RISC architectures, 183 00:07:35,580 --> 00:07:38,490 AKA Reduced Institutions Set. 184 00:07:38,490 --> 00:07:42,630 Well, then we don't have single characters solution anymore. 185 00:07:42,630 --> 00:07:45,060 And we also have very few addressing modes. 186 00:07:45,060 --> 00:07:47,883 So no way to do instruction from memory to memory. 187 00:07:48,810 --> 00:07:49,890 And however, 188 00:07:49,890 --> 00:07:51,480 we have very heavy constraints 189 00:07:51,480 --> 00:07:54,870 on the operating side of instruction. 190 00:07:54,870 --> 00:07:58,062 So basically this means that the previous technique 191 00:07:58,062 --> 00:07:58,895 doesn't work anymore. 192 00:07:58,895 --> 00:08:01,860 So let me present you three ways to get a hundred. 193 00:08:01,860 --> 00:08:04,893 Mainly compilation, emulation, and unpacking. 194 00:08:06,420 --> 00:08:08,820 So, the first one is compilation. 195 00:08:08,820 --> 00:08:11,130 And the idea is that you want to hide a compiler, 196 00:08:11,130 --> 00:08:14,133 which instead of targeting your usual architecture, 197 00:08:15,015 --> 00:08:17,460 will target the constrained architecture. 198 00:08:17,460 --> 00:08:20,460 It has been done in the past for slightly different thing, 199 00:08:20,460 --> 00:08:23,400 which is called a single inspection set computer. 200 00:08:23,400 --> 00:08:26,555 Typically the Movfuscator, is a compiler, 201 00:08:26,555 --> 00:08:29,880 which takes any orbital C code 202 00:08:29,880 --> 00:08:34,020 and compiles it for only the move inspection on X86 203 00:08:34,020 --> 00:08:37,050 because this inspection happens to be during complete. 204 00:08:37,050 --> 00:08:40,980 So, it works quite fine for once instruction set computers 205 00:08:40,980 --> 00:08:45,733 much less when it comes to our risk setup, 206 00:08:45,733 --> 00:08:49,030 because then the constraints are on the operands, 207 00:08:49,030 --> 00:08:49,920 not on the opcode. 208 00:08:49,920 --> 00:08:53,280 So writing a compiler is much more difficult 209 00:08:53,280 --> 00:08:56,340 and nobody really know how to do that. 210 00:08:56,340 --> 00:08:59,673 So this approach is a bit dead force. 211 00:09:00,870 --> 00:09:02,970 Second one is a emulation way. 212 00:09:02,970 --> 00:09:06,180 And this time the idea is to spend quite some time 213 00:09:06,180 --> 00:09:09,840 to hide too small interpreter for some language. 214 00:09:09,840 --> 00:09:12,180 This interpreter will pass the filter, 215 00:09:12,180 --> 00:09:14,850 typically, would be alphanumeric. 216 00:09:14,850 --> 00:09:16,620 And then since you have interpreter, 217 00:09:16,620 --> 00:09:19,290 you can encode any payload, 218 00:09:19,290 --> 00:09:23,850 arbitrary payload in your target language and interpret it. 219 00:09:23,850 --> 00:09:28,200 This is typically what Younan (indistinct) did in 2009. 220 00:09:28,200 --> 00:09:32,910 So they did it for ARMv7 Brainfuck interpreter. 221 00:09:32,910 --> 00:09:36,720 So it works fine, but there's an issue with this approach. 222 00:09:36,720 --> 00:09:39,510 They need it's that the harmfulness 223 00:09:39,510 --> 00:09:42,090 relies on what you can do with an interpreter. 224 00:09:42,090 --> 00:09:44,610 So, like if you want to use it on actual exploit, 225 00:09:44,610 --> 00:09:46,890 it means that you need to escape the interpreter 226 00:09:46,890 --> 00:09:48,240 or that your interpreter 227 00:09:48,240 --> 00:09:51,600 has to be able to write outside of its sandbox. 228 00:09:51,600 --> 00:09:54,930 And typically in Younan case, it's not the case. 229 00:09:54,930 --> 00:09:57,423 So we are a bit stuck here too. 230 00:09:58,860 --> 00:10:00,720 Third one is unpacking. 231 00:10:00,720 --> 00:10:03,510 So this time we want to encode 232 00:10:03,510 --> 00:10:06,000 our payload in a consigned competent way. 233 00:10:06,000 --> 00:10:07,290 Typically, I want to find a way 234 00:10:07,290 --> 00:10:09,810 to encode my payload in alphanumeric, 235 00:10:09,810 --> 00:10:11,883 base64 would be almost good for that. 236 00:10:13,257 --> 00:10:16,170 And then identify like high level constraint 237 00:10:16,170 --> 00:10:20,853 and try to write some alphanumeric unpacker from that, 238 00:10:21,750 --> 00:10:24,900 which will be able to unpack my payload, 239 00:10:24,900 --> 00:10:26,880 then jump on it and execute it. 240 00:10:26,880 --> 00:10:30,540 So you spend some time writing this unpacker, 241 00:10:30,540 --> 00:10:32,010 which is alphanumeric. 242 00:10:32,010 --> 00:10:34,967 You have your payload which is encoded in alphanumeric way. 243 00:10:34,967 --> 00:10:36,870 Unpack it, jump on it. 244 00:10:36,870 --> 00:10:39,983 And then you can write arbitrary payload. 245 00:10:39,983 --> 00:10:43,470 So this is what George, me, and some of our colleagues 246 00:10:43,470 --> 00:10:45,667 did previously from ARMv8. 247 00:10:46,519 --> 00:10:48,593 So we are going to show you a small demo of that. 248 00:11:02,155 --> 00:11:02,999 - Thanks. 249 00:11:02,999 --> 00:11:07,999 - Good, so in this setup, we have a small account manager, 250 00:11:08,310 --> 00:11:09,930 which is very badly written 251 00:11:09,930 --> 00:11:12,990 and has an obvious before overflow vulnerability in it. 252 00:11:12,990 --> 00:11:15,510 So it's asking for your username. 253 00:11:15,510 --> 00:11:20,021 And obviously before getting to other floor, 254 00:11:20,021 --> 00:11:22,020 there is some check 255 00:11:22,020 --> 00:11:25,350 to make sure that the username looks like a valid username. 256 00:11:25,350 --> 00:11:28,620 So alphanumeric works fine here because username 257 00:11:28,620 --> 00:11:31,170 cause which consists only of letters and digits 258 00:11:31,170 --> 00:11:32,103 is quite legit. 259 00:11:33,510 --> 00:11:37,559 So, we are going to use our payload here. 260 00:11:37,559 --> 00:11:38,544 As we can see, 261 00:11:38,544 --> 00:11:41,563 it is only made of letter and digit. 262 00:11:41,563 --> 00:11:45,060 And we're going to use that as our username and take control 263 00:11:45,060 --> 00:11:46,950 of this account manager. 264 00:11:46,950 --> 00:11:51,150 Here, the idea is to dump the ETC shadow file, 265 00:11:51,150 --> 00:11:53,730 which is a Lenox machine, the file, 266 00:11:53,730 --> 00:11:57,483 which contains the hash of all user icon passwords. 267 00:11:58,560 --> 00:12:01,310 Takes a bit of time because the terminal is a bit slow. 268 00:12:05,250 --> 00:12:08,190 Good, almost finish and then we have a win. 269 00:12:08,190 --> 00:12:11,520 Our payload just don't, the slash ETC slash shadow file. 270 00:12:11,520 --> 00:12:13,773 And we have the hashes of all passwords. 271 00:12:16,196 --> 00:12:18,946 (crowd applauds) 272 00:12:26,731 --> 00:12:28,440 So in sense, we can, I think, 273 00:12:28,440 --> 00:12:31,680 almost say that alphanumeric, shellcoding is sold. 274 00:12:31,680 --> 00:12:33,957 It even works for at least five architectures. 275 00:12:33,957 --> 00:12:37,530 And this is what some colleague Georges and I presented 276 00:12:37,530 --> 00:12:39,060 in Defcon 27. 277 00:12:39,060 --> 00:12:41,797 So, don't hesitate to jump back in time 278 00:12:41,797 --> 00:12:42,947 and see our talk again. 279 00:12:45,810 --> 00:12:47,730 Back to Emojis. 280 00:12:47,730 --> 00:12:49,290 A few months ago, 281 00:12:49,290 --> 00:12:51,870 Buddhist and Jaina, which is a security of architecture 282 00:12:51,870 --> 00:12:53,010 ask Georges and I, 283 00:12:53,010 --> 00:12:55,650 well, you have done alphanumeric shellcoding. 284 00:12:55,650 --> 00:12:58,200 Could you maybe do emoji shellcoding? 285 00:12:58,200 --> 00:12:59,370 I didn't think about it 286 00:12:59,370 --> 00:13:02,430 and found a very good reason why it was impossible. 287 00:13:02,430 --> 00:13:05,163 So just gave him this reason and I was happy with it. 288 00:13:06,015 --> 00:13:07,890 Then 2:00 AM, next morning, 289 00:13:07,890 --> 00:13:11,853 I just wake up and realized that my reason is totally wrong. 290 00:13:12,779 --> 00:13:15,300 Like I did a mistake. 291 00:13:15,300 --> 00:13:17,730 And so I tried to fix it. 292 00:13:17,730 --> 00:13:21,180 And after few hours I realized that, well, I can't fix it. 293 00:13:21,180 --> 00:13:24,308 So I'm only left with one possibility. 294 00:13:24,308 --> 00:13:27,573 That is to prove that doing emoji shellcoding is possible. 295 00:13:28,650 --> 00:13:31,800 - Well, and then I woke up at 8:00 AM. 296 00:13:31,800 --> 00:13:36,800 I open my mailbox and what I found a hoard of wild Emojis 297 00:13:37,590 --> 00:13:41,220 that were just saying, hello world to me in Kimmy. 298 00:13:41,220 --> 00:13:43,140 So when you see that in your mailbox, 299 00:13:43,140 --> 00:13:46,097 the first thing you say is what the fuck is this? 300 00:13:46,097 --> 00:13:46,930 (chuckles) 301 00:13:46,930 --> 00:13:48,120 And then you look into it, 302 00:13:48,120 --> 00:13:49,830 then you ask for the source code. 303 00:13:49,830 --> 00:13:53,040 Then you look more into details and you find bugs. 304 00:13:53,040 --> 00:13:55,170 And with all the bugs are found I said, 305 00:13:55,170 --> 00:13:57,660 how the fuck does it even work? 306 00:13:57,660 --> 00:13:58,920 There are bug everywhere. 307 00:13:58,920 --> 00:14:02,520 And then I just went and saw Hadrian, 308 00:14:02,520 --> 00:14:04,890 and we sat together on the table 309 00:14:04,890 --> 00:14:06,210 and we said, let's clean this shit 310 00:14:06,210 --> 00:14:08,110 and send it to Defcon and here we are. 311 00:14:11,580 --> 00:14:15,219 - Good, so we want to execute Emojis 312 00:14:15,219 --> 00:14:20,190 on some inspector architecture to execute emoji code. 313 00:14:20,190 --> 00:14:23,370 For that, we first need to look at Emojis and try to define 314 00:14:23,370 --> 00:14:24,483 a bit what Emojis are. 315 00:14:25,590 --> 00:14:28,380 Well, let's say I wanted 10 years ago 316 00:14:28,380 --> 00:14:30,600 to send a nice text to my girlfriend. 317 00:14:30,600 --> 00:14:33,150 So I type my nice, I love you, 318 00:14:33,150 --> 00:14:35,220 so probability that she would get 319 00:14:35,220 --> 00:14:38,760 this instead was unfortunately quite high. 320 00:14:38,760 --> 00:14:41,403 And while this is not exactly the same meaning. 321 00:14:42,540 --> 00:14:44,580 So we needed to do better. 322 00:14:44,580 --> 00:14:46,440 And fortunately we have Unicode, 323 00:14:46,440 --> 00:14:49,530 which is now quite a all center to the rescue. 324 00:14:49,530 --> 00:14:51,840 We can take the Wikipedia definition 325 00:14:51,840 --> 00:14:54,690 which is that Unicode is a standard for the consistent 326 00:14:54,690 --> 00:14:58,200 encoding, representation, and handling of text expressed 327 00:14:58,200 --> 00:15:00,750 in most of the world writing systems. 328 00:15:00,750 --> 00:15:04,350 Namely that we want that everything displays quite the same 329 00:15:04,350 --> 00:15:07,953 and in a consistent way for everyone on any system. 330 00:15:09,750 --> 00:15:12,030 So, what do we have in Unicode? 331 00:15:12,030 --> 00:15:13,050 Well, over today, 332 00:15:13,050 --> 00:15:16,290 we have Latin letters such as this capital A 333 00:15:16,290 --> 00:15:20,400 and on this part, Unicode is actually compatible with ASCII. 334 00:15:20,400 --> 00:15:22,200 Then you can find many of those scripts 335 00:15:22,200 --> 00:15:25,170 such as Japanese Hiraganas. 336 00:15:25,170 --> 00:15:28,710 More obscure stuff such as the whole set 337 00:15:28,710 --> 00:15:31,350 of alchemical symbols. 338 00:15:31,350 --> 00:15:32,643 Yes, its in Unicode. 339 00:15:33,660 --> 00:15:36,603 You have also the whole set of playing cards, smilies, 340 00:15:38,340 --> 00:15:41,044 and some odd character such as cuneiform form. 341 00:15:41,044 --> 00:15:43,350 So this is a single Unicode component. 342 00:15:43,350 --> 00:15:46,773 So this very wild character is a single Unicode character. 343 00:15:47,880 --> 00:15:51,420 And then most of such as the Holy Hand Grenade of Antioch, 344 00:15:51,420 --> 00:15:52,413 or Kim Kardashian. 345 00:15:54,228 --> 00:15:55,214 (laughter) 346 00:15:55,214 --> 00:15:57,030 Well, actually not the last two ones, 347 00:15:57,030 --> 00:15:58,623 at least well, not yet. 348 00:16:00,450 --> 00:16:04,209 So, we have very small sample of Unicode characters. 349 00:16:04,209 --> 00:16:07,623 And those question is, well, what's an emoji in this? 350 00:16:08,503 --> 00:16:10,980 Capital A, well, clearly not an emoji. 351 00:16:10,980 --> 00:16:13,320 Smiley, clearly an emoji. 352 00:16:13,320 --> 00:16:16,380 But maybe what about the Jack of Spades? 353 00:16:16,380 --> 00:16:18,852 Well, you look into the Unicode standards. 354 00:16:18,852 --> 00:16:20,850 Well, it's not an emoji. 355 00:16:20,850 --> 00:16:25,440 But let's replace the Jack of Spade with the Black Joker. 356 00:16:25,440 --> 00:16:28,560 Then, Unicode standard says that it is an emoji. 357 00:16:28,560 --> 00:16:30,160 Starting to get a bit confusing. 358 00:16:31,110 --> 00:16:34,260 And let's switch it again with from the Black Joker 359 00:16:34,260 --> 00:16:35,700 to the White Joker, 360 00:16:35,700 --> 00:16:38,520 then Unicode says, this is not an emoji. 361 00:16:38,520 --> 00:16:39,543 Even more confusing. 362 00:16:40,440 --> 00:16:43,290 So we are going to settle for a very simple 363 00:16:43,290 --> 00:16:45,240 yet, a bit subtle definition, 364 00:16:45,240 --> 00:16:48,900 which is that if Unicode says it is a qualified emoji, 365 00:16:48,900 --> 00:16:50,583 then it is an emoji valued. 366 00:16:53,070 --> 00:16:54,480 And in UTF-8, 367 00:16:54,480 --> 00:16:58,710 which is a way to represent Unicode code point in bytes. 368 00:16:58,710 --> 00:17:00,510 Emojis are at least three bytes 369 00:17:00,510 --> 00:17:04,773 such as this nice smiley face and at most 35 bytes, 370 00:17:05,910 --> 00:17:08,460 Moreover, they add new Emojis every year. 371 00:17:08,460 --> 00:17:11,430 And we are currently at Unicode version 14. 372 00:17:11,430 --> 00:17:12,540 So for today, 373 00:17:12,540 --> 00:17:16,620 we're going to consider doing shellcoding with UTF-8 374 00:17:16,620 --> 00:17:18,753 Emojis on Unicode version 14. 375 00:17:20,820 --> 00:17:23,228 Good, so we have Emojis here and 376 00:17:23,228 --> 00:17:26,133 then we need to hand Emojis on something. 377 00:17:27,420 --> 00:17:29,223 So we are going to use RISC-V. 378 00:17:30,090 --> 00:17:30,923 What's RISC-V.? 379 00:17:30,923 --> 00:17:33,810 Well, RISC-V is the architecture of the future. 380 00:17:33,810 --> 00:17:38,250 Oh, well this is what we said three years ago at Unicode 27. 381 00:17:38,250 --> 00:17:39,570 I think though, we can even say that 382 00:17:39,570 --> 00:17:42,270 RISC-V is the architecture of the present. 383 00:17:42,270 --> 00:17:44,040 Well, since 2021, 384 00:17:44,040 --> 00:17:46,110 you have some real RISC-V products 385 00:17:46,110 --> 00:17:47,790 that you can buy as a customer. 386 00:17:47,790 --> 00:17:50,163 So maybe you already have RISC-V CPUs at home. 387 00:17:51,600 --> 00:17:53,310 And in more technical terms, 388 00:17:53,310 --> 00:17:55,410 let's see what we have in RISC-V. 389 00:17:55,410 --> 00:17:58,860 Well, this is a simple risk architecture. 390 00:17:58,860 --> 00:18:02,250 They push a lot to have Open Source ISAs, 391 00:18:02,250 --> 00:18:05,130 and also they push a lot for Open Hardware. 392 00:18:05,130 --> 00:18:06,210 And in RISC-V, 393 00:18:06,210 --> 00:18:08,310 you have two and four byte instructions 394 00:18:08,310 --> 00:18:10,152 and it is little endian. 395 00:18:10,152 --> 00:18:12,223 Remember those four letter. 396 00:18:14,880 --> 00:18:19,290 Well, so now I need to execute my Emojis on the RISC-V. 397 00:18:19,290 --> 00:18:21,210 Let's try to look back at the method 398 00:18:21,210 --> 00:18:23,720 we saw previously the previous work 399 00:18:23,720 --> 00:18:25,140 and see if it still works. 400 00:18:25,140 --> 00:18:27,384 So, alphanumeric X86. 401 00:18:27,384 --> 00:18:30,893 You had to take the whole set of single letters. 402 00:18:30,893 --> 00:18:33,420 It gave you a set of instruction. 403 00:18:33,420 --> 00:18:35,910 You realize it was talking complete. 404 00:18:35,910 --> 00:18:37,283 So then you could shellcode in that. 405 00:18:38,730 --> 00:18:40,990 Alphanumeric over RISC architecture 406 00:18:41,840 --> 00:18:43,410 such as ARMv7, V-8, or RISC-V. 407 00:18:43,410 --> 00:18:48,410 You took the set of quadruplets of letters and digit. 408 00:18:48,630 --> 00:18:50,130 It gave you a set of instructions. 409 00:18:50,130 --> 00:18:52,590 Again, you figure out it was turning complete. 410 00:18:52,590 --> 00:18:54,000 So we were good. 411 00:18:54,000 --> 00:18:56,130 What about Emoji RISC-V? 412 00:18:56,130 --> 00:18:57,810 Well, let's use the first method. 413 00:18:57,810 --> 00:19:00,240 I take my list of all Emojis. 414 00:19:00,240 --> 00:19:03,840 See how many of them can be executable as RISC-V, 415 00:19:03,840 --> 00:19:05,850 too bad, only 10 of them are. 416 00:19:05,850 --> 00:19:07,750 So that's not turning complete at all. 417 00:19:08,820 --> 00:19:10,454 Let's hide the second method 418 00:19:10,454 --> 00:19:12,900 like pairs of Emojis. 419 00:19:12,900 --> 00:19:15,840 We still have very very few pairs of Emoji, 420 00:19:15,840 --> 00:19:18,270 which are valid RISC-V code. 421 00:19:18,270 --> 00:19:21,420 And if I go along and take triplets and quadruplets, 422 00:19:21,420 --> 00:19:23,580 it's still not getting better at all. 423 00:19:23,580 --> 00:19:26,613 So we are stuck and the previous method will not work here. 424 00:19:28,920 --> 00:19:31,773 So I'm going to try to kind choose the way it was, 425 00:19:33,411 --> 00:19:36,510 how we were able to fix this issue with an example. 426 00:19:36,510 --> 00:19:37,710 So on the bottom of the screen, 427 00:19:37,710 --> 00:19:41,430 you have this AUIPC instruction, which is in RISC-V, 428 00:19:41,430 --> 00:19:46,110 a way to load the PC positive offset into the AF register. 429 00:19:46,110 --> 00:19:49,208 And if you look at how it is at exactly 430 00:19:49,208 --> 00:19:51,982 decimal representation, 431 00:19:51,982 --> 00:19:56,982 it is 97 F0 9F 97, and this is not valid Emoji. 432 00:19:58,590 --> 00:20:01,440 This UTF-8 is not valid Emoji. 433 00:20:01,440 --> 00:20:04,920 So we're going to split it into two like this. 434 00:20:04,920 --> 00:20:08,583 Left 97, and right to other parts. 435 00:20:09,450 --> 00:20:11,640 So let's try to take over the left part. 436 00:20:11,640 --> 00:20:14,880 I want an emoji which ends with 97. 437 00:20:14,880 --> 00:20:17,790 So I look into my big bag of Emojis. 438 00:20:17,790 --> 00:20:18,623 Find one. 439 00:20:18,623 --> 00:20:20,640 This is the okay emoji, 440 00:20:20,640 --> 00:20:25,172 which start with F0 9F 86 and too bad, 441 00:20:25,172 --> 00:20:27,772 This three first bytes are not, 442 00:20:27,772 --> 00:20:31,110 this five are not his five code. 443 00:20:31,110 --> 00:20:32,972 Typically, this is three bytes. 444 00:20:32,972 --> 00:20:34,012 And as I told you, 445 00:20:34,012 --> 00:20:35,820 there are no three bytes inspection in this five. 446 00:20:35,820 --> 00:20:40,560 But maybe we have a (indistinct) jet which can do jumps. 447 00:20:40,560 --> 00:20:44,086 And then we can jump directly on the 97 and execute 448 00:20:44,086 --> 00:20:44,919 our auipc. 449 00:20:47,250 --> 00:20:49,677 Let's work a bit more into our bag of Emojis. 450 00:20:49,677 --> 00:20:52,410 And this time we find the bang emoji, 451 00:20:52,410 --> 00:20:54,453 which ends with 97 and start with E2 9D. 452 00:20:56,100 --> 00:20:57,810 This time, it's quite nice 453 00:20:57,810 --> 00:21:01,230 because E2 9D is risk five image, 454 00:21:01,230 --> 00:21:03,180 add S11, S8. 455 00:21:03,180 --> 00:21:07,018 So at the expense of trashing the S11 register, 456 00:21:07,018 --> 00:21:09,240 I can then start directly this gadget 457 00:21:09,240 --> 00:21:11,580 execute by add then by auipc, 458 00:21:11,580 --> 00:21:12,530 which is my target. 459 00:21:14,970 --> 00:21:16,500 Good. We have two ways to do that. 460 00:21:16,500 --> 00:21:19,230 And on the right side, it's going to be quite similar. 461 00:21:19,230 --> 00:21:20,520 So this time I want enable, 462 00:21:20,520 --> 00:21:23,451 we start with F0, 9F, 97. 463 00:21:23,451 --> 00:21:26,310 Look again into my back of Emojis. 464 00:21:26,310 --> 00:21:29,430 And I find the calendar emoji. 465 00:21:29,430 --> 00:21:33,690 It ends with 97, EF, B8, 8F, 466 00:21:33,690 --> 00:21:36,060 which is a valid five instruction. 467 00:21:36,060 --> 00:21:39,333 So this time at the expense of touching T6 register, 468 00:21:40,260 --> 00:21:41,553 I can finish my gadget. 469 00:21:43,290 --> 00:21:44,310 Again, last time, 470 00:21:44,310 --> 00:21:46,350 let's look into our bag of Emojis 471 00:21:46,350 --> 00:21:48,213 and we find the bin Emoji. 472 00:21:49,290 --> 00:21:53,310 This time last four bytes are not valued at five, 473 00:21:53,310 --> 00:21:57,513 but 91 EF is a small forward jump. 474 00:21:58,440 --> 00:22:01,473 So again, I can end like a jet by jumping out of it. 475 00:22:03,470 --> 00:22:05,280 In the end, this is quite good 476 00:22:05,280 --> 00:22:07,410 because I can use any combination of, 477 00:22:07,410 --> 00:22:10,380 okay, bin, okay, calendar, bang bin, 478 00:22:10,380 --> 00:22:12,693 or bang calendar, and executive things. 479 00:22:13,749 --> 00:22:16,410 And I have quite a trade off between the gadget size 480 00:22:16,410 --> 00:22:18,303 and cashing registers or not. 481 00:22:21,120 --> 00:22:22,080 Good. 482 00:22:22,080 --> 00:22:23,190 So the question is, well, 483 00:22:23,190 --> 00:22:25,740 I could do it first one specific section, 484 00:22:25,740 --> 00:22:27,210 how can I do that? 485 00:22:27,210 --> 00:22:30,150 How could I find a way to generate all possible gadgets 486 00:22:30,150 --> 00:22:34,050 and a whole list of emoji compatible list five instructions? 487 00:22:34,050 --> 00:22:34,883 - Well. 488 00:22:36,253 --> 00:22:38,910 For this, we have to take a little step back. 489 00:22:38,910 --> 00:22:42,600 So we'll be talking about code-reuse attacks. 490 00:22:42,600 --> 00:22:44,940 So for the people who know it already think about 491 00:22:44,940 --> 00:22:46,290 later oriented programming, 492 00:22:47,163 --> 00:22:48,840 or just in time spraying, 493 00:22:48,840 --> 00:22:51,420 but here we let's present for those who do not know it. 494 00:22:51,420 --> 00:22:53,940 So return oriented programming has been published 495 00:22:53,940 --> 00:22:57,180 originally by Shacham and others in 2007. 496 00:22:57,180 --> 00:22:58,440 And the idea is really simple. 497 00:22:58,440 --> 00:23:01,830 So you take a huge binary, 498 00:23:01,830 --> 00:23:04,260 typically the system or library, 499 00:23:04,260 --> 00:23:05,850 and then you just scan it 500 00:23:05,850 --> 00:23:09,630 and you find small little reusable cut snippets. 501 00:23:09,630 --> 00:23:13,200 So those little cut snippets are called gadgets. 502 00:23:13,200 --> 00:23:16,500 And the idea is once you have a whole collection of gadgets, 503 00:23:16,500 --> 00:23:20,220 what you do is you try to assemble them together. 504 00:23:20,220 --> 00:23:21,540 You chain them, 505 00:23:21,540 --> 00:23:23,280 in order to have your shell code. 506 00:23:23,280 --> 00:23:24,600 So you just reveal the shell code 507 00:23:24,600 --> 00:23:26,790 in the form of what we call a hub chain. 508 00:23:26,790 --> 00:23:29,790 Then you send this hub chain as input 509 00:23:29,790 --> 00:23:31,320 in the vulnerable, 510 00:23:31,320 --> 00:23:34,383 and you still have your shell that pops. 511 00:23:36,180 --> 00:23:37,410 There is a variant of it, 512 00:23:37,410 --> 00:23:38,700 which is called JIT spraying 513 00:23:38,700 --> 00:23:41,730 that has been published by Blazakis in 2010. 514 00:23:41,730 --> 00:23:42,563 And the idea is, 515 00:23:42,563 --> 00:23:45,600 instead of scanning your binary to find gadgets, 516 00:23:45,600 --> 00:23:48,780 what you do is you just create them 517 00:23:48,780 --> 00:23:51,480 by controlling some code that then 518 00:23:51,480 --> 00:23:56,190 is compiled using a JIT sprayer just in time compiler. 519 00:23:56,190 --> 00:23:57,720 So here, the attacker, for instance, 520 00:23:57,720 --> 00:23:59,700 has on, you can see it on the left side, 521 00:23:59,700 --> 00:24:01,260 on the right side of the screen, 522 00:24:01,260 --> 00:24:02,093 on the top part, 523 00:24:02,093 --> 00:24:05,111 the attacker can control and write any code he wants. 524 00:24:05,111 --> 00:24:06,780 So this is typically JavaScript, for instance. 525 00:24:06,780 --> 00:24:08,160 So what the attacker does, 526 00:24:08,160 --> 00:24:10,830 he assigns to the variable wire, 527 00:24:10,830 --> 00:24:13,770 some immediate that are absorbed together. 528 00:24:13,770 --> 00:24:15,090 If you send it to Firefox, 529 00:24:15,090 --> 00:24:17,610 this goes through the just in time compiler 530 00:24:17,610 --> 00:24:21,900 and is then compiled as the binary code that you see below. 531 00:24:21,900 --> 00:24:23,310 And in this case, 532 00:24:23,310 --> 00:24:24,210 it's pretty easy 533 00:24:24,210 --> 00:24:25,950 because the attacker manages to control 534 00:24:25,950 --> 00:24:30,000 four out of five bytes of the final problem. 535 00:24:30,000 --> 00:24:32,400 So here you can generate gadget as you want, 536 00:24:32,400 --> 00:24:36,030 and you can just do your return onto programming as before. 537 00:24:36,030 --> 00:24:37,230 So this is JIT spraying. 538 00:24:38,790 --> 00:24:40,860 So here we have to do the same with Emojis. 539 00:24:40,860 --> 00:24:42,870 So we can control Emojis 540 00:24:42,870 --> 00:24:46,740 and we need to build gadgets from it. 541 00:24:46,740 --> 00:24:49,440 So how do I create gadgets from Emoji stream? 542 00:24:49,440 --> 00:24:50,910 Here, it's a little bit complex 543 00:24:50,910 --> 00:24:53,883 because do remember the infinite monkey tail theorem. 544 00:24:54,900 --> 00:24:56,670 It states that if you take a monkey, 545 00:24:56,670 --> 00:24:58,140 you give it a cable. 546 00:24:58,140 --> 00:25:00,360 And if the monkey types on the keyboard 547 00:25:00,360 --> 00:25:02,130 for an infinite amount of time, 548 00:25:02,130 --> 00:25:05,820 then almost surely he will type any given sequence. 549 00:25:05,820 --> 00:25:08,730 So here, we do the same and we take a monkey 550 00:25:08,730 --> 00:25:10,430 and we give him an emoji keyboard. 551 00:25:12,420 --> 00:25:14,880 Only problem is that there is no algorithm 552 00:25:14,880 --> 00:25:17,190 to look for gadgets in an infinite stream. 553 00:25:17,190 --> 00:25:21,060 So, previous methods were only scanning binaries, 554 00:25:21,060 --> 00:25:22,230 but not infinite streams. 555 00:25:22,230 --> 00:25:25,173 So we need to scan the output of a monkey here. 556 00:25:26,130 --> 00:25:27,390 We need to invent a new algorithm. 557 00:25:27,390 --> 00:25:30,060 So let me explain this algorithm. 558 00:25:30,060 --> 00:25:32,910 So here we have three lines. 559 00:25:32,910 --> 00:25:36,510 So on the first line, what we have is the emoji stream. 560 00:25:36,510 --> 00:25:38,190 So this will be a stream of Emojis. 561 00:25:38,190 --> 00:25:40,890 This will be what our monkey will type. 562 00:25:40,890 --> 00:25:44,310 Then this emoji stream will have AXA decimal representation 563 00:25:44,310 --> 00:25:45,510 that is on the middle, 564 00:25:45,510 --> 00:25:49,710 and we must synchronize it with some executable stream. 565 00:25:49,710 --> 00:25:52,020 So this is RISC-V instructions 566 00:25:52,020 --> 00:25:56,100 and Wolf should coincide on their representation. 567 00:25:56,100 --> 00:25:57,570 So let's start with an instruction. 568 00:25:57,570 --> 00:25:58,770 So let's take for instance, 569 00:25:58,770 --> 00:26:02,100 add S7, S7, S7, S8. 570 00:26:02,100 --> 00:26:06,660 So here, I have an excess of my instruction stream. 571 00:26:06,660 --> 00:26:08,971 So what I must do is find 572 00:26:08,971 --> 00:26:12,690 an emoji which starts with E2, 90. 573 00:26:12,690 --> 00:26:15,745 So let's take our bag of Emojis and take for instance, 574 00:26:15,745 --> 00:26:17,700 the chain emoji here. 575 00:26:17,700 --> 00:26:19,830 So here I go on the opposite side. 576 00:26:19,830 --> 00:26:22,050 So I have an excess of Emojis. 577 00:26:22,050 --> 00:26:24,660 So I must find some acceptable instructions 578 00:26:24,660 --> 00:26:27,660 that fits the exact (indistinct) presentation here. 579 00:26:27,660 --> 00:26:29,910 So let's look what is inside. 580 00:26:29,910 --> 00:26:33,360 So I find an or immediate, which fits. 581 00:26:33,360 --> 00:26:35,400 And here is something very interesting 582 00:26:35,400 --> 00:26:38,340 because here I managed to end my emoji stream 583 00:26:38,340 --> 00:26:40,950 and my instruction stream at the same point. 584 00:26:40,950 --> 00:26:42,750 So both are synchronized here. 585 00:26:45,399 --> 00:26:46,232 Here. 586 00:26:46,232 --> 00:26:48,060 Both are synchronized here. 587 00:26:48,060 --> 00:26:50,550 And what I can do is I can just stop here 588 00:26:50,550 --> 00:26:52,200 and consider that this is a gadget 589 00:26:52,200 --> 00:26:54,900 because I can reuse the chain emoji 590 00:26:54,900 --> 00:26:56,700 independently without taking care of 591 00:26:56,700 --> 00:26:58,877 what comes before or after. 592 00:26:58,877 --> 00:27:00,450 So this is a gadget. 593 00:27:00,450 --> 00:27:01,380 Let's go to a second case. 594 00:27:01,380 --> 00:27:03,330 If I take the basketball player emoji. 595 00:27:03,330 --> 00:27:05,400 So again, I have an excess of Emojis here, 596 00:27:05,400 --> 00:27:07,200 so I must find an instruction. 597 00:27:07,200 --> 00:27:11,850 So this benign EF is a branch branching instruction. 598 00:27:11,850 --> 00:27:13,800 So it's a small branch forward. 599 00:27:13,800 --> 00:27:15,720 So this is another very interesting case 600 00:27:15,720 --> 00:27:19,590 because now I can escape up of my gadget 601 00:27:19,590 --> 00:27:22,410 and I do not need to end my basketball player 602 00:27:22,410 --> 00:27:24,030 with other prescribed instructions. 603 00:27:24,030 --> 00:27:25,350 So this is another gadget. 604 00:27:25,350 --> 00:27:26,730 So we can see here, 605 00:27:26,730 --> 00:27:29,190 the second gadget that we made manage to generate, 606 00:27:29,190 --> 00:27:31,740 and we can reuse it as it is. 607 00:27:31,740 --> 00:27:32,580 Let's go to the third case. 608 00:27:32,580 --> 00:27:35,190 So let's take the snowman emoji. 609 00:27:35,190 --> 00:27:38,160 So again, I look for an instruction that starts with 84. 610 00:27:38,160 --> 00:27:40,751 So let's take for instance, Starward. 611 00:27:40,751 --> 00:27:42,990 And then here I come back to the beginning 612 00:27:42,990 --> 00:27:45,090 where I have an excess of instructions 613 00:27:45,090 --> 00:27:48,480 and I complete it with an emoji. 614 00:27:48,480 --> 00:27:50,220 So the copyright emoji here. 615 00:27:50,220 --> 00:27:52,440 And again, I can do the same as before 616 00:27:52,440 --> 00:27:55,560 and here I have a branch, which ends my gadget again. 617 00:27:55,560 --> 00:27:58,590 So I do this for every possibility. 618 00:27:58,590 --> 00:27:59,430 And in the end, 619 00:27:59,430 --> 00:28:01,170 I have a whole list of gadgets 620 00:28:01,170 --> 00:28:02,823 that are usable for shellcoding. 621 00:28:04,530 --> 00:28:05,933 And so on. 622 00:28:05,933 --> 00:28:07,230 And so on. 623 00:28:07,230 --> 00:28:08,610 Just a side note for people 624 00:28:08,610 --> 00:28:10,260 who know a little bit about grammars. 625 00:28:10,260 --> 00:28:13,705 So the method we use actually is really generic. 626 00:28:13,705 --> 00:28:15,150 As you may have guessed, 627 00:28:15,150 --> 00:28:19,590 the algorithm follows derivations of a grammar in the form. 628 00:28:19,590 --> 00:28:21,840 We have a non terminal, that what you see is a terminal 629 00:28:21,840 --> 00:28:23,130 followed by a non-terminal. 630 00:28:23,130 --> 00:28:25,890 Here, our terminal is Emojis. 631 00:28:25,890 --> 00:28:28,020 So, for people who know about it, 632 00:28:28,020 --> 00:28:31,000 this exactly describes what we call a right-linear grammar. 633 00:28:31,000 --> 00:28:34,440 And there has been a very interesting property 634 00:28:34,440 --> 00:28:37,020 detailed by Patel in 1971, 635 00:28:37,020 --> 00:28:39,540 who says that any regular expression, 636 00:28:39,540 --> 00:28:41,460 which is typically for computer scientist, 637 00:28:41,460 --> 00:28:43,050 what we call a hagget, 638 00:28:43,050 --> 00:28:45,540 can be converted to a right-linear grammar. 639 00:28:45,540 --> 00:28:46,373 Of course, 640 00:28:46,373 --> 00:28:48,800 adapting the tool is left to the reader as an exercise. 641 00:28:49,980 --> 00:28:52,650 Well, let's get back to emoji now. 642 00:28:52,650 --> 00:28:54,570 So I manage to generate all gadgets 643 00:28:54,570 --> 00:28:56,850 that can be implemented using Emojis. 644 00:28:56,850 --> 00:28:58,450 Now we just have to change them. 645 00:28:59,524 --> 00:29:00,810 - Good. 646 00:29:00,810 --> 00:29:03,303 So let's try to write our emoji chain. 647 00:29:04,440 --> 00:29:07,272 Using the output of our previous algorithm, 648 00:29:07,272 --> 00:29:10,110 we want to look at which instructions 649 00:29:10,110 --> 00:29:12,420 are indeed emerging compatible. 650 00:29:12,420 --> 00:29:14,820 And one at the beginning, looks quite fine 651 00:29:14,820 --> 00:29:16,515 because we have a bit more 652 00:29:16,515 --> 00:29:18,450 than 4,000 (indistinct) instructions, 653 00:29:18,450 --> 00:29:21,333 which I can find in at least one of the gadgets. 654 00:29:22,350 --> 00:29:25,200 And if you look at what kind of instructions we have, 655 00:29:25,200 --> 00:29:27,240 first, we have some logic instructions 656 00:29:27,240 --> 00:29:29,700 like add, and, sub, and more. 657 00:29:29,700 --> 00:29:31,320 So that's quite good. 658 00:29:31,320 --> 00:29:32,580 We have branches, 659 00:29:32,580 --> 00:29:34,980 both conditional and unconditional 660 00:29:34,980 --> 00:29:36,660 both forward and backward. 661 00:29:36,660 --> 00:29:39,356 That's very good because for control flow, 662 00:29:39,356 --> 00:29:40,189 that's very useful. 663 00:29:40,189 --> 00:29:41,730 We can address many registers. 664 00:29:41,730 --> 00:29:44,490 So here we can see we can address 14 registers, 665 00:29:44,490 --> 00:29:46,320 but not the stack pointer. 666 00:29:46,320 --> 00:29:48,690 Don't worry, Even if we cannot touch the stack pointer, 667 00:29:48,690 --> 00:29:51,210 we can still find ways around and it practice. 668 00:29:51,210 --> 00:29:52,983 It's not that much of an issue. 669 00:29:54,090 --> 00:29:56,160 However, we have very few Emojis, 670 00:29:56,160 --> 00:29:59,190 so very difficult to load constants. 671 00:29:59,190 --> 00:30:02,160 And it actually in this for instruction, 672 00:30:02,160 --> 00:30:05,160 we have quite a lot of floating point instructions, 673 00:30:05,160 --> 00:30:06,723 which we don't want to use. 674 00:30:08,010 --> 00:30:09,780 To give you more idea of what we have 675 00:30:09,780 --> 00:30:13,127 for some families of instruction, 676 00:30:13,127 --> 00:30:15,270 such as the CSR family. 677 00:30:15,270 --> 00:30:17,190 We only have a single one of them. 678 00:30:17,190 --> 00:30:19,303 So this is the one displayed here. 679 00:30:19,303 --> 00:30:20,220 And in the end, 680 00:30:20,220 --> 00:30:23,250 what we see that we have a tiny bit of everything. 681 00:30:23,250 --> 00:30:27,443 So the set of RISC-V compatible RISC-V 682 00:30:27,443 --> 00:30:31,560 is very diverse and very difficult to work with 683 00:30:31,560 --> 00:30:33,721 because it's very difficult to combine 684 00:30:33,721 --> 00:30:35,130 one instruction with the other. 685 00:30:35,130 --> 00:30:37,271 Yet, we do manage to do it to this. 686 00:30:37,271 --> 00:30:40,933 I'm going to show you the overall view of what our 687 00:30:40,933 --> 00:30:42,420 (indistinct) looks like. 688 00:30:42,420 --> 00:30:43,833 So we use the unpacking metals 689 00:30:43,833 --> 00:30:45,453 that we showed you previously. 690 00:30:46,440 --> 00:30:48,839 And basically we have a small initialization part, 691 00:30:48,839 --> 00:30:53,839 then our unpacker, which embeds the included payload. 692 00:30:54,720 --> 00:30:58,950 So the unpacker will impact this payload in memory 693 00:30:58,950 --> 00:31:00,390 then generate. 694 00:31:00,390 --> 00:31:03,780 And it means that it's very easy to change the payload 695 00:31:03,780 --> 00:31:06,693 because we can generate unpacker easily from the payload. 696 00:31:07,920 --> 00:31:09,933 Let's focus on the unpacker. 697 00:31:10,770 --> 00:31:12,995 So in our last talk, 698 00:31:12,995 --> 00:31:15,400 we went very far into finding ways 699 00:31:15,400 --> 00:31:18,150 to do very efficient unpackers 700 00:31:18,150 --> 00:31:20,460 and with many gadgets to do that. 701 00:31:20,460 --> 00:31:22,355 For this time, 702 00:31:22,355 --> 00:31:25,050 we're going to go the very opposite 703 00:31:25,050 --> 00:31:27,450 and write a very simple unpacker. 704 00:31:27,450 --> 00:31:30,090 So for that, we will only use three gadgets. 705 00:31:30,090 --> 00:31:33,180 One is increment, the A1 register. 706 00:31:33,180 --> 00:31:36,510 Second one is set is like write the value 707 00:31:36,510 --> 00:31:38,400 of A1 in the pointer. 708 00:31:38,400 --> 00:31:40,108 Point A2 by A3. 709 00:31:40,108 --> 00:31:43,290 And the last one, is implementing the A3 register. 710 00:31:43,290 --> 00:31:45,420 So with that, we can write an unpacker. 711 00:31:45,420 --> 00:31:46,420 I will show you how. 712 00:31:48,090 --> 00:31:50,553 So, for this, we take an initial payload. 713 00:31:50,553 --> 00:31:53,437 It's very mini payload of only three bytes, 714 00:31:53,437 --> 00:31:54,933 three, 20, and 10. 715 00:31:56,010 --> 00:31:58,040 And if we go back to initialization, 716 00:31:58,040 --> 00:31:59,760 well, what we do here 717 00:31:59,760 --> 00:32:01,890 is that we make sure that A1 is zero 718 00:32:01,890 --> 00:32:05,550 and then A3 is set to the first address 719 00:32:05,550 --> 00:32:07,923 of where we want the payload to be decoded at. 720 00:32:09,660 --> 00:32:10,947 So let back to it. 721 00:32:10,947 --> 00:32:13,110 We have A1 equal to zero, 722 00:32:13,110 --> 00:32:17,580 but lets output three times increment, A1 gadget. 723 00:32:17,580 --> 00:32:19,260 So then A1 to three, 724 00:32:19,260 --> 00:32:22,984 and we can store A1 in A3 increment, A3. 725 00:32:22,984 --> 00:32:25,020 From three to 20, 726 00:32:25,020 --> 00:32:26,573 it's, 1D. 727 00:32:26,573 --> 00:32:29,539 So we output 1D times implement A1 gadget. 728 00:32:29,539 --> 00:32:30,690 A1 is now 20. 729 00:32:30,690 --> 00:32:31,740 You can write it. 730 00:32:31,740 --> 00:32:33,256 We are good. 731 00:32:33,256 --> 00:32:34,170 And from 20 to 10, 732 00:32:34,170 --> 00:32:37,020 while we have to output A1 plus plus gadget, 733 00:32:37,020 --> 00:32:40,560 add zero times, so we can write it in memory. 734 00:32:40,560 --> 00:32:43,743 So this is the way that we generate our included payload. 735 00:32:45,420 --> 00:32:47,253 If we execute this well, 736 00:32:47,253 --> 00:32:50,097 then we start from A1 equals zero, 737 00:32:50,097 --> 00:32:52,443 A1 plus plus three times, A1 equal three, 738 00:32:52,443 --> 00:32:54,720 we write three to memory. 739 00:32:54,720 --> 00:32:57,953 Then we add 1D to three, it's 20. 740 00:32:57,953 --> 00:33:01,140 If I20 to memory and add A zero one. 741 00:33:01,140 --> 00:33:03,390 So A1 is 10, 742 00:33:03,390 --> 00:33:04,590 write it to memory. 743 00:33:04,590 --> 00:33:06,000 It means that the initial payload 744 00:33:06,000 --> 00:33:07,770 is equal to the decoded payload. 745 00:33:07,770 --> 00:33:09,720 And we have found a way to encode 746 00:33:09,720 --> 00:33:13,620 any payload into our encoded payload, 747 00:33:13,620 --> 00:33:16,220 which will decode at the exact same initial payload. 748 00:33:17,100 --> 00:33:19,127 And since all of these gadget, 749 00:33:19,127 --> 00:33:21,837 A1plus plus FK plus plus install, 750 00:33:21,837 --> 00:33:24,390 A1 is A3 are emoji compatible. 751 00:33:24,390 --> 00:33:26,520 It means that the whole included payload 752 00:33:26,520 --> 00:33:28,710 is only made of Emojis. 753 00:33:28,710 --> 00:33:31,110 Let's present you like a bit in details, 754 00:33:31,110 --> 00:33:35,130 how we do this A1 plus plus FK plus plus gadgets. 755 00:33:35,130 --> 00:33:36,570 - Okay. 756 00:33:36,570 --> 00:33:38,370 Time to switch to GDB over beamer. 757 00:33:38,370 --> 00:33:42,450 So, here let me represent you what we have. 758 00:33:42,450 --> 00:33:46,440 So on the first line, we have the emoji streamer as before, 759 00:33:46,440 --> 00:33:49,560 and we have it original representation on the bottom. 760 00:33:49,560 --> 00:33:53,760 So here, let me spill my binary code. 761 00:33:53,760 --> 00:33:56,700 You have the two gadgets on the left part of the streamer. 762 00:33:56,700 --> 00:33:58,710 You have the holdisters on the right part of the stream, 763 00:33:58,710 --> 00:34:01,410 and you have the memory where we want to store our payload 764 00:34:01,410 --> 00:34:03,460 on the bottom, right, part of the screen. 765 00:34:04,620 --> 00:34:06,630 So let's start with an not like operation 766 00:34:06,630 --> 00:34:07,463 for the first gadget. 767 00:34:07,463 --> 00:34:10,080 So this will just trash the value of S3. 768 00:34:10,080 --> 00:34:11,430 If you go to the next one, 769 00:34:11,430 --> 00:34:15,600 we store A1 which has been initialized to AB before 770 00:34:15,600 --> 00:34:19,713 to the address 22 by A3, which is 8,000. 771 00:34:20,730 --> 00:34:22,770 Then we just take our branch, 772 00:34:22,770 --> 00:34:24,520 which will jump to the next gadget. 773 00:34:25,410 --> 00:34:28,740 And we start with another, not like instruction. 774 00:34:28,740 --> 00:34:30,960 Same, we have a branch to the next two bytes, 775 00:34:30,960 --> 00:34:33,000 which is also in the blank instruction. 776 00:34:33,000 --> 00:34:35,930 And in the end we add the value, oh... 777 00:34:36,870 --> 00:34:39,390 In the end, we add the value of C2, 778 00:34:39,390 --> 00:34:41,490 which is one to A3, 779 00:34:41,490 --> 00:34:43,503 which will increment A3. 780 00:34:44,610 --> 00:34:46,470 And we can continue as we want. 781 00:34:46,470 --> 00:34:50,070 Here, I have a small gap between the two gadgets 782 00:34:50,070 --> 00:34:52,140 and I can fill it with whatever I like. 783 00:34:52,140 --> 00:34:54,515 So here I can fill it for instance, 784 00:34:54,515 --> 00:34:56,283 with three England flag Emojis. 785 00:34:57,271 --> 00:35:00,213 Well, let's switch to the demo. 786 00:35:01,050 --> 00:35:03,310 So here I will present you a demo on 787 00:35:04,230 --> 00:35:05,430 high five unleashed board. 788 00:35:05,430 --> 00:35:09,202 So this is quite core RISC-V, 64 bits board. 789 00:35:09,202 --> 00:35:11,280 So now it has been discontinued, 790 00:35:11,280 --> 00:35:13,470 so you can't buy it anymore, unfortunately. 791 00:35:13,470 --> 00:35:15,303 And it manages to run a Lenox. 792 00:35:16,675 --> 00:35:18,420 So if it has a Lenox, 793 00:35:18,420 --> 00:35:19,370 let's play with it. 794 00:35:21,205 --> 00:35:22,544 So in this case, 795 00:35:22,544 --> 00:35:24,210 what I made is a small network interface 796 00:35:24,210 --> 00:35:26,511 that is really hard to shellcode. 797 00:35:26,511 --> 00:35:29,250 And here I can check that I have my shellcode, 798 00:35:29,250 --> 00:35:30,810 which is all Emojis. 799 00:35:30,810 --> 00:35:32,460 So let's see. 800 00:35:32,460 --> 00:35:35,250 So you can see my emoji shell code here. 801 00:35:35,250 --> 00:35:38,070 And what I will do is I will just send it 802 00:35:38,070 --> 00:35:40,920 through the network to my HifiveU board 803 00:35:40,920 --> 00:35:42,720 on its vulnerable interface. 804 00:35:42,720 --> 00:35:45,450 So let's send the shellcode to the HifiveU list. 805 00:35:45,450 --> 00:35:47,193 So I just cut it through net cat, 806 00:35:48,030 --> 00:35:51,540 I press enter and here I manage to get my shell. 807 00:35:51,540 --> 00:35:53,550 So let me check if the CPU is correct. 808 00:35:53,550 --> 00:35:54,810 So let's see. 809 00:35:54,810 --> 00:35:58,530 I can see that indeed, I have a RISC-V CPU from C5. 810 00:35:58,530 --> 00:36:00,540 And if I just check who am I, 811 00:36:00,540 --> 00:36:01,470 I'm root. 812 00:36:01,470 --> 00:36:03,070 So I manage to get my old check. 813 00:36:04,066 --> 00:36:06,816 (audience claps) 814 00:36:12,240 --> 00:36:13,140 Well. 815 00:36:13,140 --> 00:36:15,090 I went a little bit quickly over one thing. 816 00:36:15,090 --> 00:36:18,000 So I have my gap between my two Emojis. 817 00:36:18,000 --> 00:36:21,130 So what I can do instead of just putting England Emojis 818 00:36:22,020 --> 00:36:24,030 so I can put whatever I want. 819 00:36:24,030 --> 00:36:26,220 I just need to find Emojis 820 00:36:26,220 --> 00:36:28,560 whose size is compatible with the gap. 821 00:36:28,560 --> 00:36:31,200 So this is just a variant of the subset sum problem. 822 00:36:31,200 --> 00:36:33,870 So you can look in Wikipedia how we solve it. 823 00:36:33,870 --> 00:36:35,160 And in our case, 824 00:36:35,160 --> 00:36:38,970 it's very easy because we have three and four bytes Emojis. 825 00:36:38,970 --> 00:36:40,230 And as we know, 826 00:36:40,230 --> 00:36:42,210 every number above six can be written 827 00:36:42,210 --> 00:36:43,770 as a sum of three and fours. 828 00:36:43,770 --> 00:36:45,370 So it's really easy to solve it. 829 00:36:46,230 --> 00:36:48,120 If we want to have a little bit further. 830 00:36:48,120 --> 00:36:49,650 So we can, instead, for example, 831 00:36:49,650 --> 00:36:51,750 try to look at how I can fill this gap 832 00:36:51,750 --> 00:36:53,580 with the minimal number of Emojis. 833 00:36:53,580 --> 00:36:55,830 And this is standard dynamic programming. 834 00:36:55,830 --> 00:36:58,740 It took me exactly four minutes and 13 seconds to solve it 835 00:36:58,740 --> 00:36:59,673 and implement it. 836 00:37:00,654 --> 00:37:02,604 So you can try it and it's pretty easy. 837 00:37:03,600 --> 00:37:07,200 Well, and now I can fit with whatever I want. 838 00:37:07,200 --> 00:37:09,796 And this gives me very something very interesting, 839 00:37:09,796 --> 00:37:10,629 which is called polymorphism. 840 00:37:10,629 --> 00:37:12,780 And this is almost trivial to have polymorphism. 841 00:37:12,780 --> 00:37:14,900 What is the purpose of polymorphism 842 00:37:14,900 --> 00:37:17,640 is to generate many variant of the same shellcode 843 00:37:17,640 --> 00:37:19,020 that all behave the same. 844 00:37:19,020 --> 00:37:20,340 And this is very useful 845 00:37:20,340 --> 00:37:23,340 because now you can pass antiviruses 846 00:37:23,340 --> 00:37:25,470 that generally use the notion of signature. 847 00:37:25,470 --> 00:37:27,360 So they compute the hash of your shellcode 848 00:37:27,360 --> 00:37:29,700 and check in the database if it's already known. 849 00:37:29,700 --> 00:37:33,690 So now I can generate as many shellcodes as I want, 850 00:37:33,690 --> 00:37:35,160 whose hashes are all different. 851 00:37:35,160 --> 00:37:37,320 So for example, I can put five Emojis here. 852 00:37:37,320 --> 00:37:39,780 I can also put these 10 Emojis 853 00:37:39,780 --> 00:37:42,333 or more Emojis as much as I like. 854 00:37:47,190 --> 00:37:49,800 - Oh, when you do shellcoding for real, 855 00:37:49,800 --> 00:37:53,670 sometime it happens at point (indistinct) is a bit flawed 856 00:37:53,670 --> 00:37:55,360 and you don't know exactly where 857 00:37:56,198 --> 00:37:58,830 the (indistinct) problem program will jump on your payload. 858 00:37:58,830 --> 00:38:00,120 So to make a profit, 859 00:38:00,120 --> 00:38:04,320 you start your payload with a long list of nops, 860 00:38:04,320 --> 00:38:05,460 which makes that 861 00:38:05,460 --> 00:38:08,100 even if it doesn't just exactly where you want, 862 00:38:08,100 --> 00:38:10,030 it'll just follow the list of nops 863 00:38:10,915 --> 00:38:12,660 until it get to the start of the meaningful part 864 00:38:12,660 --> 00:38:13,560 of your payload. 865 00:38:13,560 --> 00:38:15,570 So this is what we call a nop-sled. 866 00:38:15,570 --> 00:38:17,250 And in Unicode, 867 00:38:17,250 --> 00:38:19,200 we have something which is called... 868 00:38:19,200 --> 00:38:21,330 We have a sled Emoji. 869 00:38:21,330 --> 00:38:24,540 So obviously as hackers, our first question was, well, 870 00:38:24,540 --> 00:38:27,363 can we do our nop-sled using the sled Emoji? 871 00:38:28,770 --> 00:38:29,603 Well. 872 00:38:29,603 --> 00:38:30,750 Answer is yes, we can. 873 00:38:30,750 --> 00:38:32,760 So we have to provide it, 874 00:38:32,760 --> 00:38:37,320 but a few nops and as many sleds as you want. 875 00:38:37,320 --> 00:38:38,220 So believe it or not 876 00:38:38,220 --> 00:38:43,220 that this is perfectly executable, RISC-V code. 877 00:38:43,347 --> 00:38:46,347 (audience applauds) 878 00:38:51,450 --> 00:38:54,030 And with that, we can do another demo. 879 00:38:54,030 --> 00:38:58,380 So this time, this is on the RISC-V factory bits. 880 00:38:58,380 --> 00:39:01,855 So we have it this time. 881 00:39:01,855 --> 00:39:03,301 We have the board with me. 882 00:39:03,301 --> 00:39:05,790 So this is a nice Espressif ESP32 C3 board, 883 00:39:05,790 --> 00:39:07,650 if it is too small for you to see, well, 884 00:39:07,650 --> 00:39:10,620 just look at the slides is you have picture and much bigger. 885 00:39:10,620 --> 00:39:12,660 And a nice thing about this one is, 886 00:39:12,660 --> 00:39:13,493 it cost nothing. 887 00:39:13,493 --> 00:39:15,150 You can get it for less than $10 888 00:39:15,150 --> 00:39:16,740 from your family distributor. 889 00:39:16,740 --> 00:39:18,783 So it's really nice to hack with. 890 00:39:27,060 --> 00:39:27,893 Good. 891 00:39:27,893 --> 00:39:29,280 So for this demo, 892 00:39:29,280 --> 00:39:33,240 we have decided to use a very bad coin wallet. 893 00:39:33,240 --> 00:39:34,530 So this one is again, 894 00:39:34,530 --> 00:39:37,350 relatable to an obvious buffer overflow 895 00:39:37,350 --> 00:39:40,797 and is going to ask for the passphrase to just access it. 896 00:39:40,797 --> 00:39:43,653 And so obviously we want to use our emoji shellcode 897 00:39:44,760 --> 00:39:49,383 to well get the private of the wallet. 898 00:39:49,383 --> 00:39:52,120 And if we can get that the private key we are hitch 899 00:39:53,104 --> 00:39:53,993 because we get outgoings. 900 00:39:56,040 --> 00:39:59,190 So let's get that. 901 00:39:59,190 --> 00:40:02,040 This will be a bit slow because don't get that. 902 00:40:02,040 --> 00:40:03,152 Good. 903 00:40:03,152 --> 00:40:06,630 So you have here, you have the end of our emoji shellcode. 904 00:40:06,630 --> 00:40:08,220 We have used polymorphism here, 905 00:40:08,220 --> 00:40:10,980 which is why it looks a bit like (indistinct). 906 00:40:10,980 --> 00:40:13,740 And at the end, you can see that it works. 907 00:40:13,740 --> 00:40:16,933 So we have done the private key of the wallet. 908 00:40:16,933 --> 00:40:18,600 And so now we are hitch, 909 00:40:18,600 --> 00:40:20,280 unless you manage to get the private key 910 00:40:20,280 --> 00:40:23,405 and extract the money before the end of the talk. 911 00:40:23,405 --> 00:40:25,279 So it won't. 912 00:40:25,279 --> 00:40:28,279 (audience applauds) 913 00:40:33,676 --> 00:40:34,540 Good. 914 00:40:34,540 --> 00:40:36,870 So as a conclusion, while option you, 915 00:40:36,870 --> 00:40:40,980 that we are able to do RISC-V emoji shellcoding 916 00:40:40,980 --> 00:40:43,590 on both 42 bits, 64 bits. 917 00:40:43,590 --> 00:40:46,704 Nice. And that's the method that we presented you, 918 00:40:46,704 --> 00:40:48,030 even if it was a bit technical 919 00:40:48,030 --> 00:40:50,850 could be used for over kind of filters, 920 00:40:50,850 --> 00:40:52,150 over kinds of constraints. 921 00:40:53,220 --> 00:40:56,340 And we have to talk a bit about what happened 922 00:40:56,340 --> 00:40:58,740 during the making of this project. 923 00:40:58,740 --> 00:41:01,980 So it's might not be easy to see, 924 00:41:01,980 --> 00:41:05,070 but all of these slides are made with LauLatex. 925 00:41:05,070 --> 00:41:06,900 So we had many issue with lauLatex, 926 00:41:06,900 --> 00:41:09,060 and typically we did cash texted you, 927 00:41:09,060 --> 00:41:10,773 we did cash tex latex and more. 928 00:41:11,880 --> 00:41:15,510 Most PDF filters cannot display our slide correctly. 929 00:41:15,510 --> 00:41:17,940 Acrobat Reader is the worst. 930 00:41:17,940 --> 00:41:20,125 And all our KFS have literatures. 931 00:41:20,125 --> 00:41:21,384 We even had issue with VLC. 932 00:41:21,384 --> 00:41:26,384 Like we found that recording the demos would not play on VC. 933 00:41:27,440 --> 00:41:32,440 So they had to convert, help them all from MDB to MP four. 934 00:41:33,720 --> 00:41:35,820 And we find the way to break FireFox. 935 00:41:35,820 --> 00:41:37,920 So like, this is FireFox explaining this.. 936 00:41:40,118 --> 00:41:42,496 (mumbles) 937 00:41:42,496 --> 00:41:43,444 Yes. Good. 938 00:41:43,444 --> 00:41:46,080 And if you press F5 with a PDF in full screen, 939 00:41:46,080 --> 00:41:47,915 then you lose calling in the tub. 940 00:41:47,915 --> 00:41:50,520 I cannot call anymore with the PDF. 941 00:41:50,520 --> 00:41:54,490 And if I press F5, again, this is this 942 00:41:58,669 --> 00:41:59,502 Good. 943 00:41:59,502 --> 00:42:00,800 Well, it is still broken. 944 00:42:00,800 --> 00:42:03,570 So I have pass intensely broken, but this done. 945 00:42:03,570 --> 00:42:06,000 So well, I'm good to switch to the new tab, 946 00:42:06,000 --> 00:42:08,193 the backup tab to finish this talk. 947 00:42:10,746 --> 00:42:11,655 But. 948 00:42:11,655 --> 00:42:14,737 Well, I got things such as terminal slowness and cuts. 949 00:42:14,737 --> 00:42:16,650 If you know about it, 950 00:42:16,650 --> 00:42:18,630 this is what we use in Lenox to print things. 951 00:42:18,630 --> 00:42:21,360 So I did the Josh to print the slides, 952 00:42:21,360 --> 00:42:22,380 tell us what happened. 953 00:42:22,380 --> 00:42:24,600 - So I tried to print the slides 954 00:42:24,600 --> 00:42:28,350 and I managed to break both my computer and the printer 955 00:42:28,350 --> 00:42:29,200 at the same time. 956 00:42:30,060 --> 00:42:30,893 And since then, 957 00:42:30,893 --> 00:42:34,230 I was not able to use my printer for any task at all. 958 00:42:34,230 --> 00:42:36,130 I have to do a factory reset, I think. 959 00:42:38,070 --> 00:42:40,770 - Good. We also have a GCC fault, 960 00:42:40,770 --> 00:42:42,300 which we need to investigate 961 00:42:42,300 --> 00:42:44,430 and very big things for Windows, 962 00:42:44,430 --> 00:42:48,633 for the occasional BSOD when compiling the slides. 963 00:42:51,840 --> 00:42:53,917 Bottom line Emoji code is hard 964 00:42:53,917 --> 00:42:56,610 are still many issues in libraries, 965 00:42:56,610 --> 00:42:58,440 software dealing with Emojis. 966 00:42:58,440 --> 00:43:00,243 If you want to find exploiting them, 967 00:43:01,101 --> 00:43:02,903 it probably a good bet to look at them. 968 00:43:04,110 --> 00:43:04,943 In the end, 969 00:43:04,943 --> 00:43:07,210 we do do release all of what we did. 970 00:43:07,210 --> 00:43:09,450 So you have a repository. 971 00:43:09,450 --> 00:43:10,860 Don't hesitate to click on the link. 972 00:43:10,860 --> 00:43:12,520 If you cannot click on the link of a big screen, 973 00:43:12,520 --> 00:43:14,403 just member of a short link. 974 00:43:15,510 --> 00:43:16,680 You have our email address. 975 00:43:16,680 --> 00:43:18,150 If you want to protect us. 976 00:43:18,150 --> 00:43:19,680 And if you have any questions, 977 00:43:19,680 --> 00:43:22,260 don't hesitate to come to the bottom of the stage 978 00:43:22,260 --> 00:43:24,060 and we'll happily answer them. 979 00:43:24,060 --> 00:43:25,529 Thank you a lot. 980 00:43:25,529 --> 00:43:28,279 (audience claps)