UEFIDump replaced by UEFIExtract with ‘unpack’ option

~ hucktech ~ Leave a comment

UEFITool is a Qt-based GUI tool that works on Mac/Windows/Linux. In addition to the main Qt-based GUI tool, the project also has a few other command line tools, UEFIExtract, UEFIFind, UEFIDump. And there are two codebases on Github, master and new-engine.

Some of the command line tools have been changing: UEFIDump was a tool that dumped info. UEFIDump is now gone, replaced by UEFIExtract with the “unpack” option (the “dump” option is related).

https://github.com/LongSoft/UEFITool/blob/new_engine/UEFIExtract/uefiextract_main.cpp

UEFIDump/UEFIExtract aside, UEFIFind is also useful to find information:

https://github.com/LongSoft/UEFITool/blob/new_engine/UEFIFind/uefifind_main.cpp

 

GEF 2018.10 released: GDB Enhanced Features for exploit devs & reversers

~ hucktech ~ Leave a comment

New features:
Support for RISC-V architecture (@dlrobertson )
Brand new skin, designed by our own @Grazfather
New command print-format
New convenience variables / functions ($_pie , $_heap) by @wbowling
Better AARCH64 support
All command outputs are now buffered, so less IO, more perf
“Repeatable” commands are in
PyEnv support (@hazedic)
Ditched Travis-CI for Circle-CI
Glibc Tcache bins support
Colorized hexdump byte (pwntools-like)

Changelog:
Bugfix in x86 EFLAGS parsing
Better and more unit tests
More caching (on key functions, settings, etc.)
Fixed the doc
(ARM) Auto. adjust GEF mode from cspr flag
Bugfix in capstone integration
Fixed minor issues in format-string-helper
Fixed IDA integration, thx @cclauss
And more minor bugfixes, and speed improvement

https://github.com/hugsy/gef

gef-context

BB-Weight-Angr: Angr-based static analysis tool for vusec/vuzzer64 fuzzing tool

~ hucktech ~ Leave a comment

https://github.com/ash09/angr-static-analysis-for-vuzzer64

This repository contains a Angr-based static analysis module developed during my internship at VU Amsterdam for their fuzzing tool Vuzzer. It supports both the 32bit and 64bit versions of Vuzzer
see-also:

Telemetry: Enhancing Customer Triage of Intel® SSDs

~ hucktech ~ Leave a comment

by Behnam Eliyahu and Monika Sane

Telemetry refers to an umbrella of tools, utilities, and protocols to remotely extract and decode information for debugging potential issues with Intel® SSDs. Telemetry works over industry standard protocols, and eliminates or minimizes the need to remove SSDs from customer systems for retrieving debug logs. Telemetry thus enables host tools, Intel technical sales specialists, (TSS), Intel application engineers (AEs), and Intel engineering teams to better identify and debug performance excursions, exception events and critical failures in Intel® SSDs, without sending the physical drive to Intel for failure analysis. This capability is designed in accordance with NVMe* 1.3 telemetry specifications as well as corresponding ACS 4 SATA definitions (which are common industry standards), and is expected to accelerate debugging of external and internal bug sightings pertaining to Intel® SSDs. The key difference between NVMe and SATA is the fact that there is no controller-initiated capability on SATA drives.[…]

https://itpeernetwork.intel.com/telemetry-enhancing-customer-triage/

 

See-also:
https://github.com/linux-nvme/nvme-cli/blob/master/Documentation/nvme-telemetry-log.txt
https://github.com/linux-nvme/nvme-cli/blob/master/linux/nvme.h

What’s New In NVMe 1.3


https://nvmexpress.org/resources/specifications/

Sites with sample firmware rom binaries

~ hucktech ~ Leave a comment

I was looking for some UEFI binaries to include in a workshop, and thought I’d make a quick post on the options.

Firmware Vault, a unofficial collection of Apple EFI ROMs:
https://github.com/theopolis/uefi-firmware-parser

A new site, from the author of UEFI Firmware Parser:
https://github.com/theopolis/uefi-firmware-samples

The same author wrote uefi-spider, a tool to scrape vendor web sites of their images, but it appears bitrot has taken effect. It’d be nice if someone submitted some patches to update this useful script. It’d be even nicer if someone would  maintain a site of crawled binaries, so multiple people don’t have to run the crawler against the sites.

tool review: uefi-spider (and firmware_vault)

The Intel Minnowboard releases include some binaries that can be used for analysis:
https://firmware.intel.com/projects/minnowboard-max

Similar to the Minnowboard releases, the Intel FSP releases includes multiple binaries:
https://github.com/IntelFsp/FSP

Linaro.org should have some ARM images. Tianocore should have some OVMF images, and has ShellBinPkg binaries for Intel and ARM. Tianocore and this site have UEFI OVMF images:
https://www.kraxel.org/repos/
https://github.com/tianocore/edk2/tree/master/ShellBinPkg

If you have other ideas, please leave a Comment on the blog with new URLs. Thanks!

ASUS Z390 Motherboards Automatically Push Software into Windows

~ penglish0 ~ Leave a comment

https://www.techpowerup.com/248827/asus-z390-motherboards-automatically-push-software-into-your-windows-installation

The ASUS UEFI firmware exposes an ACPI table to Windows 10, called “WPBT” or “Windows Platform Binary Table”. WPBT is used in the pre-built OEM industry, and is referred to as “the Vendor’s Rootkit.” Put simply, it is a script that makes Windows copy data from the BIOS to the System32 folder on the machine and execute it during Windows startup – every single time the system is booted. According to the Microsoft WPBT reference, which describes this feature as useful for “anti-theft software”, this binary is a “native, user-mode application that is executed by the Windows Session Manager during operating system initialization.”, which means “before all other programs, with administrative privileges”. This gives pretty much full control over everything, including protected folders and the registry.

Dell PowerEdge BIOS failure with Intel ME

~ hucktech ~ Leave a comment

https://www.dell.com/support/article/us/en/19/sln309027/dell-poweredge-14g-bios-update-fails-on-the-first-attempt-second-attempt-works?lang=en

[…]For servers with greater than 24 days of power on time since the last AC power cycle, the first BIOS update will fail because the Intel Management Engine (ME) fails to enter recovery mode for the BIOS update.[…]

Non-Dell OEMs: please also add this to your QA cycle. 🙂

Reversing ESP8266 Firmware (Part 1)

~ hucktech ~ Leave a comment

Exciting, this is expected to be a 6-part series!

[…]The challenge was described as follows: We managed to obtain the firmware of an unknown device connected to our wireless access point. We’ve been told it’s connecting to a service and retrieving secrets, but we can’t reach the service. Can you?[…]

Reversing ESP8266 Firmware (Part 1)

https://boredpentester.com/wp-content/uploads/2018/10/recovered_file_updated.zip

Building a Proof of Concept Hardware Implant

Implanted Apple Lightning USB cable [at BSidesPDX]

~ hucktech ~ Leave a comment

https://twitter.com/_MG_/status/1054929638621757441

https://mg.lol/blog/badusb-cables/

VirtualBox 6.0 Beta 1 released

~ hucktech ~ Leave a comment

https://forums.virtualbox.org/viewtopic.php?f=1&t=89946

https://blogs.oracle.com/virtualization/oracle-vm-virtualbox-60-beta-1-released

Hmm, it looks like the ChangeLog is not up-to-date yet, unclear what firmware changes have occured:

https://www.virtualbox.org/wiki/Changelog

Build Your Own Hardware Implant

~ hucktech ~ Leave a comment

Bloomberg’s story about an alleged hardware implant […] Several people were pointing out the fact that the BMC (Baseboard Management Controller – the component allowing an out-of-band access to the server) could be tampered with, allowing an implant to control the BMC to gain access to the network card. But how does it work in practice? Let’s see if we can reproduce this.[…]

Build Your Own Hardware Implant

ARM releases EBBR 0.7 spec

~ hucktech ~ Leave a comment

The Embedded Base Boot Requirements (EBBR) specification defines requirements for embedded systems to enable inter-operability between SoCs, hardware platforms, firmware implementations, and operating system distributions. The aim is to establish consistent boot ABIs and behaviour so that supporting new hardware platforms does not require custom engineering work.

https://github.com/ARM-software/ebbr/releases/tag/v0.7

https://github.com/ARM-software/ebbr
https://github.com/ARM-software/ebbr/wiki

see-also:

Click to access Dong_Wei_ARM_Final.pdf

https://www.linaro.org/blog/the-boot-problem/