Slides from my presentation on ARM Shellcode at #44CON 2018, London.
In this talk, we explore ARM egghunting and "Quantum Leap" code - polyglot ARM shellcode. A bonus side effect of this talk will be creating headaches for those who like to defend agaisnt attacks using age old signature based techniques.
Optimizing AI for immediate response in Smart CCTV
Make ARM Shellcode Great Again
1. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
Make ARM Shellcode
Great Again
Saumil Shah
@therealsaumil
13 September 2018
2. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
# who am i
CEO Net-square.
• Hacker, Speaker, Trainer,
Author.
• M.S. Computer Science
Purdue University.
• LinkedIn: saumilshah
• Twitter: @therealsaumil
3. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
Agenda
• A background on ARM shellcode
• My research around ARM shellcode
– cache coherency (solved before)
– space limitations
– polyglot tricks
• Demos
4. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
Shellcode in tight spaces
• Egghunter:
• Searches for an EGG (4+4 byte value) in the
process memory.
• Uses syscalls to determine whether a
memory page exists or not (safely).
• Upon finding it, Egghunter transfers the
control to the code following the egg.
• Nothing new here - done before.
5. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
Egghunter - Common Problems
• DEP
• If Egg+shellcode is in a different memory
region, then it may not be executable
• e.g. Stack overflow, shellcode in the heap.
• ROP chains?
• Enter the mprotect egghunter!
8. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
ARM Shellcode Polyglot Tricks
• Common trick in ARM shellcode is to switch
to Thumb mode at the beginning.
• The "I can signature this" debate.
– YARA Rules, IDS, Bro, blah blah…
• What if our target is a Thumb-only
processor?
– example: Cortex-M
• One Shellcode To Run Them All
9. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
"Quantum Leap" Shellcode
Start in THUMB modeStart in ARM mode
THUMB shellcode
(execve, reverse, …)
THUMB shellcode
(execve, reverse, …)
"LEAP"
TO
THUMB
PASS THROUGH
PASS THROUGH
PASS THROUGH
Quantum
Leap
Same
Same
But
Different
10. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
"Quantum Leap" - what we need
• An understanding of ARM and Thumb
encoding:
– ARM instruction: "DO SOMETHING"
– 2 THUMB instructions: "PASS THROUGH"
• Conditional Execution in ARM instructions
– very helpful!
• A little bit of luck and perseverance.
• Nomenclature Credit: "dialup".
11. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
Simple ARM to Thumb switch
• Avoid Branches, Load/Store, Floating
Point, etc.
• Should work on ARMv6.
– avoid Thumb2 instructions
• Avoid Illegal instructions.
0: e28f1001 add r1, pc, #1
4: e12fff11 bx r1
8: 270b movs r7, #11
a: beff bkpt 0x00ff
0: 1001 asrs r1, r0, #32
2: e28f b.n 524
4: ff11 e12f vrhadd.u16 d14,d1,d31
8: 270b movs r7, #11
a: beff bkpt 0x00ff
ORIGINAL ARM CODE "THUMB VIEW"
12. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
ARM and THUMB decoding - 1
e28f1001: 1110 0010 1000 1111 0001 0000 0000 0001 add r1,pc,#1
4 BYTE ARM INSTRUCTION:
conditional
opcodestatus
operand
1
destination
operand
2
Thumb instruction 2
Thumb instruction 1
• Controlled by
opcode and
conditional flags.
• Partially influenced
by the first
operand.
• Trickier to control.
• Controlled by
Operands of the
ARM instruciton.
• Easier to control.
im
m
ediate
13. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
ARM and THUMB decoding - 1
e28f1001: 1110 0010 1000 1111 0001 0000 0000 0001 add r1,pc,#1
1001: 0001 0000 0000 0001 asrs r1,r0,#32
e28f: 1110 0010 1000 1111 b 524
1 ARM INSTRUCTION RESULTING INTO 2 THUMB INSTRUCTIONS:
conditional
opcodestatus
operand
1
destination
operand
2
im
m
ediate
Branch instructions
are destructive
Thumb Opcode
influenced by ARM
conditional bits
14. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
(Un)conditional Instructions
• How can we turn an ARM instruction into a
conditional instruction…
• …with guaranteed execution everytime?
• COMPLIMENTARY CONDITIONS.
• One of the instructions is guaranteed to
execute, irrespective of condition flags.
e28f1001 add r1, pc, #1 128f1005 addne r1, pc, #5
028f1001 addeq r1, pc, #1
UNCONDITIONAL INSTRUCTION COMPLIMENTARY CONDITIONS
15. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
ARM and THUMB decoding - 2
128f1005: 0001 0010 1000 1111 0001 0000 0000 0101 addne r1,pc,#5
1005: 0001 0000 0000 0101 asrs r5,r0,#32
128f: 0001 0010 1000 1111 asrs r7,r1,#10
028f1001: 0000 0010 1000 1111 0001 0000 0000 0001 addeq r1,pc,#1
1001: 0001 0000 0000 0001 asrs r1,r0,#32
028f: 0000 0010 1000 1111 lsls r7,r1,#10
USING CONDITIONAL ARM INSTRUCTIONS:
conditional
opcodestatus
operand
1
destination
operand
2
im
m
ediate
No destructive
instructions in
Thumb mode
Complimentary
Conditional ARM
instructions
17. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
Assembling the Quantum Leap
• No Thumb2 instructions.
• No NULL bytes.
• Many iterations.
• bx sl implemented by push {sl}, pop {pc}.
• Register list proved to be a challenge.
• Registers r4, sl altered (in ARM).
• Registers r0, r1, r2, r3 altered (in Thumb).
19. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
Conclusion
• ARM/Thumb Polyglot instructions and
conditional execution offer many
opportunities for obfuscation and
signature bypass.
• Lots of exploration opportunities in ARM
shellcoding.
https://github.com/therealsaumil/arm_shellcode
20. NETSQUARE (c) SAUMIL SHAH44CON 2018 LONDON
exit()
Saumil Shah
@therealsaumil
#44CON 2018