Speaker 1: Welcome to the deep dive. Today, we're diving into the
Speaker 1: world of AR exploitation. Ooh exciting using Beginner's Guide to
Speaker 1: Exploitation on Arm Volume two by Billy Ellis.
Speaker 2: Oh yeah, I've heard of that one.
Speaker 1: It's going to get pretty technical.
Speaker 2: Yeah, this book gets right into it.
Speaker 1: But even if you're not a programmer, you know, understanding
Speaker 1: these concepts I think is absolutely super important for cybersecurity.
Speaker 2: It is. Yeah, so like learning to think like the
Speaker 2: enemy exactly.
Speaker 1: Yeah, like reading the Attacker's playbook. Yeah, so this is
Speaker 1: volume two. It builds on concepts from the first book.
Speaker 2: Right.
Speaker 1: It assumes that you have some basic knowledge.
Speaker 2: Yeah, it kind of jumps right in.
Speaker 1: Programming and memory corruption and that it does. It gives
Speaker 1: you all these like real world code examples and exercises.
Speaker 2: You can really get your hands dirty with this one.
Speaker 1: Oh yeah, and I see it also mentions that you
Speaker 1: need a jail broken arm device.
Speaker 2: Yeah, you need a way to actually test this stuff out.
Speaker 1: To really try out the exercises.
Speaker 2: Right, But even if you're not going to do any
Speaker 2: actual hacking, it's still so valuable to understand how these
Speaker 2: things work.
Speaker 1: Okay, so let's take a look at some of the
Speaker 1: stuff that we're going to be covering, right, Integer overflows
Speaker 1: off by one errors. Oh yeah, I'm a classic double
Speaker 1: free conditions stack pivoting stackpivoty is always fun to hijack
Speaker 1: program execution.
Speaker 2: That's the goal, right.
Speaker 1: It sounds intense.
Speaker 2: It is intense, but also super fascinating.
Speaker 1: So let's start with integer overflows. Chapter one dives right in,
Speaker 1: as does with this program called into overflow dot C. Okay,
Speaker 1: and it's pretty simple. It's checking if input data is
Speaker 1: less than thirty two bytes.
Speaker 2: Sounds simple enough, Yeah, what could go wrong?
Speaker 1: But the problem is the data type that's used to
Speaker 1: store the length. Ah, it's an unsigned chart, which can
Speaker 1: only hold values from zero to two fifty five.
Speaker 2: Right, so if you exceed that what happens? Then that's
Speaker 2: where the fun begins.
Speaker 1: Yeah? Does it throw an error?
Speaker 2: Well not exactly, Okay, it causes this wrap around effect
Speaker 2: wrack around. Yeah. If you've ever seen those old school odometers,
Speaker 2: Oh yeah, like the ones that roll back to zero
Speaker 2: after hitting nine hundred and ninety nine miles. Okay, it's
Speaker 2: kind of like that.
Speaker 1: You exceed the maximum value and then those bits.
Speaker 2: And reset yep, leading to a really small number okay, and.
Speaker 1: The book actually has a really cool diagram that shows
Speaker 1: this visually.
Speaker 2: Oh yeah, they use the eight bits of a char
Speaker 2: to illustrate it.
Speaker 1: It's super helpful. So this wrap around allows an attacker
Speaker 1: to kind of bypass that size check, right because.
Speaker 2: The program thinks the data is smaller than it actually.
Speaker 1: Is, okay, and write more data into the buffer than intended.
Speaker 2: Leading to you guessed it a buffer overflow.
Speaker 1: And then the example in the book shows how this
Speaker 1: leads to a segmentation fault.
Speaker 2: Right, the program just crashes because it can't handle all
Speaker 2: that extra data.
Speaker 1: So essentially, a tiny coding mistake yep, can cause a
Speaker 1: full blown stack buffer overflow.
Speaker 2: Which can have some serious consequences.
Speaker 1: Yeah, it's a little bit scary.
Speaker 2: It is a good reminder that security starts at the
Speaker 2: code level.
Speaker 1: Yeah, okay, so let's move on to chapter two. Okay,
Speaker 1: one byte overflows.
Speaker 2: One bite overflows.
Speaker 1: My first thought was how much damage can one byte
Speaker 1: really do?
Speaker 2: Right? It doesn't sound like much, but as this chapter shows, yeah,
Speaker 2: even a single byte can be extremely dangerous. It's all
Speaker 2: about precision and targeting.
Speaker 1: So the example uses two strucks to store data on
Speaker 1: the heap and I like how the book provides this
Speaker 1: visual representation of the heat layout.
Speaker 2: Yeah, those visuals are super helpful. Yeah, for understanding how
Speaker 2: the exploit works.
Speaker 1: It is.
Speaker 2: So the vulnerability here is in this line of code
Speaker 2: that copies data from the command line into a buffer,
Speaker 2: and it's the loop condition. Okay, less than are equal
Speaker 2: to sixteen, that's the problem. Okay, it ends up copying
Speaker 2: seventeen bytes instead of sixteen.
Speaker 1: That one extra bite. What does that overrite?
Speaker 2: That one byte overwrites a function pointer, a function pointer,
Speaker 2: and that's where things get really interesting.
Speaker 1: So an attacker can like carefully craft their input to
Speaker 1: change this pointer to point to their malicious code, and
Speaker 1: the book shows this in action. The program's execution is
Speaker 1: redirected to through a bunch of bees zero by forty two,
Speaker 1: forty two four.
Speaker 2: Yeah, b's and hexadecimal after the exploit. It's a classic
Speaker 2: demonstration of how manipulating just one.
Speaker 1: Bite it's pretty powerful.
Speaker 2: You give you complete control, Yeah, over a program.
Speaker 1: Okay, So chapter three shifts gears to double free.
Speaker 2: Ah, double free?
Speaker 1: What's that all about?
Speaker 2: This is where we get into the dangers of freeing
Speaker 2: the same block of memory twice. Okay, The book uses
Speaker 2: some nice step by step diagrams to explain this. I
Speaker 2: do like the diagram They're super helpful for visualizing what's
Speaker 2: going on.
Speaker 1: So you can see how the heap is divided into
Speaker 1: blocks bite, and how functions like Malik and free manage memory.
Speaker 2: Exactly, and how a double free can create this weird
Speaker 2: situation where two pointers are pointing to the same memory location.
Speaker 1: That's a dangling pointer, right, that's right. It's like having
Speaker 1: a key. It is to a room that's not yours anymore.
Speaker 2: Exactly, a key to a room that doesn't even exist anymore.
Speaker 1: Okay, So if an attacker can put their controlled data
Speaker 1: into that free memory, right, then they can control they.
Speaker 2: Can control what those dangling pointers are pointing to. Okay,
Speaker 2: so potentially leading to arbitrary code execution.
Speaker 1: And the example program they use HEAP level three dot
Speaker 1: C Hmmm, it has some security checks to prevent use.
Speaker 2: After free, right, they try to make it a little
Speaker 2: bit harder.
Speaker 1: But there's another bug.
Speaker 2: There's always another bug.
Speaker 1: Related to free austraya that can be exploited.
Speaker 2: Of course, there is.
Speaker 1: Why is exploiting the double free in this particular program.
Speaker 2: Yeah, so in this case, the key it's because the
Speaker 2: attacker has to get two pointers yeah, to point to
Speaker 2: the same memory location, which is a bit harder because
Speaker 2: of the limited functionality of the example program.
Speaker 1: Okay, but in the.
Speaker 2: Real world, double free vulnerabilities can often be exploited much
Speaker 2: more liably.
Speaker 1: So this is like a simplified example. It is, yeah,
Speaker 1: to illustrate the concept exactly. Okay, let's talk about stack pivoting.
Speaker 2: Oh yes, stack pivoting.
Speaker 1: Chapter four is all about this technique.
Speaker 2: This is a good one.
Speaker 1: It sounds cool, but honestly, the details are a little
Speaker 1: fuzzy for me.
Speaker 2: Okay. So imagine the stack like a pile of plates, okay,
Speaker 2: with the stack pointer pointing to the top plate.
Speaker 1: Okay.
Speaker 2: Stack pivoting is like grabbing that whole pile of plates
Speaker 2: and moving it to a different location that's under the
Speaker 2: attacker's control.
Speaker 1: So you're redirecting the program's execution flow exactly to like
Speaker 1: their own custom stack.
Speaker 2: That's the idea.
Speaker 1: Okay. So why is this useful for an attacker?
Speaker 2: So sometimes the space available on the stack is too small,
Speaker 2: okay for them to inject their entire malicious payloads.
Speaker 1: They need more room.
Speaker 2: They need more.
Speaker 1: Room, so they pivot to a different section of memory that's.
Speaker 2: Larger exactly, and they control that memory. Okay, so they
Speaker 2: have more space to work with.
Speaker 1: So the book uses this challenge called ROPL level six
Speaker 1: to illustrate this.
Speaker 2: It's a good one.
Speaker 1: It's a classic heat based buffer overflow. But the twist
Speaker 1: is you only get a single gadget, a single gadget
Speaker 1: to gain control of R fifteen PC.
Speaker 2: Ah. Yes, the program, the key to controlling the program.
Speaker 1: So the challenge is to find.
Speaker 2: Find that stack pivot gadget, a stack pivot gadget. Luckily,
Speaker 2: it's provided in the gadget library.
Speaker 1: Okay for this example, So let's take a look at
Speaker 1: this gadget.
Speaker 2: All right.
Speaker 1: It uses two instructions, two instructions MOVs spr five and
Speaker 1: pop R four PC.
Speaker 2: All right. So the first instruction, the mov spr five. Yeah,
Speaker 2: that's the key to the pivot. Okay. It moves the
Speaker 2: value of register R five into the stack pointer okay,
Speaker 2: which effectively sets the stack pointer to the memory location
Speaker 2: pointed to.
Speaker 1: By R five, which is controlled by the attacker.
Speaker 2: It's controlled by the attacker exactly.
Speaker 1: That's the pivot.
Speaker 2: That's the pivot.
Speaker 1: And then the second instruction.
Speaker 2: So the pop R four PC pops.
Speaker 1: Two values off the stack it does. The first goes
Speaker 1: into R four right, and the second goes into the PC.
Speaker 2: The program counter.
Speaker 1: So since the attacker has already set the stack to
Speaker 1: point to their controlled memory, they can cracked these values,
Speaker 1: and in this challenge, that popped value for the PC
Speaker 1: leads to the execution of a secret function.
Speaker 2: It's a classic stack pivoting technique.
Speaker 1: It's very clever, it is, but.
Speaker 2: It requires a lot of knowledge about the target program
Speaker 2: and the ability to find the right gadgets.
Speaker 1: Okay, so that's stack pivoting, that's stat pivoting. Definitely more
Speaker 1: advanced than your typical buffer overflow. Oh yeah, this is
Speaker 1: getting real.
Speaker 2: This is advanced stuff. But that's what attackers use in
Speaker 2: the real world.
Speaker 1: All right, So let's talk about defenses.
Speaker 2: Okay.
Speaker 1: Chapter five introduces stack canaries.
Speaker 2: Stack canaries.
Speaker 1: It sounds kind of cute. It does sound cu for
Speaker 1: such a serious security feature.
Speaker 2: Don't let the name fool you.
Speaker 1: So what are they all about?
Speaker 2: So, stack canaries are designed to detect buffer overflows and
Speaker 2: prevent arbitrary code execution. Think of it like the canary
Speaker 2: in the coal mine.
Speaker 1: Okay, so how do they work?
Speaker 2: So basically they sing. They don't actually sing.
Speaker 1: When there's an overflow.
Speaker 2: No, but I like the way you think. It's more
Speaker 2: like a trip wire. So a stack canary is a
Speaker 2: random value. Okay, let's place on the stack between you
Speaker 2: seeing a buffer and the return address.
Speaker 1: The book has a really cool visual representation of this. Yeah,
Speaker 1: the visual really helps to help you see how it works.
Speaker 2: Absolutely.
Speaker 1: So before a function returns, right, the program checks the
Speaker 1: canary's value exactly, and if.
Speaker 2: It's changed, then it knows something's wrong.
Speaker 1: It means there's been a buffer overflow most likely yes,
Speaker 1: and then the program just terminates gracefully.
Speaker 2: Yep, instead of allowing the attacker to run their malicious code.
Speaker 1: That's pretty clever.
Speaker 2: It is pretty clever.
Speaker 1: But I'm sure attackers have figured out ways to get
Speaker 1: around this, right of course, like what well.
Speaker 2: One common method is to try and leak the canary value.
Speaker 1: So if they can figure out what that random value
Speaker 1: is exactly, they can just overwrite it with the correct value.
Speaker 2: Mm hm and make it look like nothing happened.
Speaker 1: During their exploit.
Speaker 2: Right.
Speaker 1: That's sneaky.
Speaker 2: It is sneak.
Speaker 1: So the book walks through an example of defeating a
Speaker 1: stack canary in this program called canary dot com.
Speaker 2: See, yeah, they show you how an attacker would actually
Speaker 2: do this. That's pretty interesting.
Speaker 1: So they show how to find the instructions that are
Speaker 1: responsible right for placing and checking the canary.
Speaker 2: They use a debugger.
Speaker 1: Yeah, using a debugger like GDB. So our stack canary
Speaker 1: is useless.
Speaker 2: Then no, not at all. Yeah, there's still a valuable
Speaker 2: security feature.
Speaker 1: Okay.
Speaker 2: They make exploitations significantly.
Speaker 1: Harder, so they raise the bar a little bit exactly
Speaker 1: for attackers.
Speaker 2: They forced attackers to be more sophisticated. Okay, And that's
Speaker 2: what defense and depth is all about.
Speaker 1: So it's just one layer of protection. It's one layer
Speaker 1: in a well secured system exactly. Okay. So let's talk
Speaker 1: about heap fung shoe.
Speaker 2: Heap fung shoe.
Speaker 1: Chapter six is all about this.
Speaker 2: This is a fun one.
Speaker 1: It sounds surprisingly zen.
Speaker 2: It does right hacking technique like arranging furniture for optimal
Speaker 2: energy flow, but in memory. But in memory exactly.
Speaker 1: So what is heap fung shoe?
Speaker 2: So it's all about manipulating the layout of the heap okay,
Speaker 2: to make heap based exploits more reliable. Okay, and it
Speaker 2: does kind of involve thinking about the arrangement.
Speaker 1: Of things like playing tetris with memory.
Speaker 2: Yeah, like tetris with memory, trying to get.
Speaker 1: Things to line up.
Speaker 2: You got it.
Speaker 1: The book uses some diagrams.
Speaker 2: Again, the diagrams are super helpful for visualizing this.
Speaker 1: So they show the initial layout of the heap, and
Speaker 1: then they.
Speaker 2: Show and then they show how an attacker.
Speaker 1: How an attacker can create these.
Speaker 2: Holes by strategically allocating and deallocating blocks.
Speaker 1: Of memory so they can get their target object allocated
Speaker 1: into a specific hole exactly sandwich between controlled data sandwich.
Speaker 2: I love that analogy.
Speaker 1: And then they can use that controlled data to overwrite
Speaker 1: important values.
Speaker 2: Like function pointers for example.
Speaker 1: And then they walk through an example of attacking the
Speaker 1: program heap level three using this technique. They do so
Speaker 1: they manipulate the program to fragment the heap.
Speaker 2: They do a bunch of allocations and de allocations.
Speaker 1: And then, with careful timing, right timing is key, they
Speaker 1: allocate a string object and a device object. Okay, so
Speaker 1: that the device object ends up between two string objects.
Speaker 2: All right, they made their sandwich.
Speaker 1: So they've made the sandwich. Yes, Now, how does this
Speaker 1: lead to an exploit.
Speaker 2: So this layout allows the attacker to overflow a nearby
Speaker 2: string object okay, and that overflow data overwrites the function
Speaker 2: pointer of the device object.
Speaker 1: And then boom, they've got control and.
Speaker 2: They control the execution flow.
Speaker 1: It's amazing how they can set this up just right.
Speaker 2: It's all about setting up the heap for that exploit.
Speaker 1: So developers can actually use this knowledge to build more
Speaker 1: robust defenses.
Speaker 2: By understanding how attackers might manipulate the heap, you can
Speaker 2: implement safeguards.
Speaker 1: So that's integer overflows, one byte overflows, double free stack, pivoting,
Speaker 1: stack canaries. We've covered a lot of ground heap fung shui.
Speaker 2: It's amazing how much you can do with memory.
Speaker 1: It's a lot, and it's pretty exciting.
Speaker 2: It is. It's a fascinating area of security.
Speaker 1: But we've only just scratched the surface we have. There's
Speaker 1: so much more to explore, So in part two of
Speaker 1: our deep dive, we're going to continue exploring some of
Speaker 1: the more advanced techniques.
Speaker 2: We're going to get into some real world stuff.
Speaker 1: Outlined in this book, absolutely including an example of building
Speaker 1: an ROP chain on an actual and not an actual
Speaker 1: target system. So stay tuned and we'll be back soon.
Speaker 2: We'll be back.
Speaker 1: Welcome back to the deep dive.
Speaker 2: It's great to be back.
Speaker 1: In part one, we went through some pretty wild stuff.
Speaker 1: Oh we did dodging buffer overflows, playing Tetris with the.
Speaker 2: Heap stack pivoting, fun times stack pivoting.
Speaker 1: It was like a crash course. It was in memory corruption.
Speaker 2: Absolutely, But that was just the warm up, just the basics.
Speaker 2: Now we're going deeper, deeper into the rabbit hole.
Speaker 1: Into the world of return oriented programming.
Speaker 2: Oh yes, ROP or ROP. This is where things get
Speaker 2: really interesting.
Speaker 1: So Chapter seven of Beginner's Guide to Exploitation on Air,
Speaker 1: Volume two is going to be our guy roadmap. Yeah,
Speaker 1: our roadmap for this adventure. And we're going to be
Speaker 1: looking at how attackers build ROP chains on real.
Speaker 2: Systems, real world stuff, targeting the kernel, the heart of
Speaker 2: the operating side.
Speaker 1: So before we get lost in the assembly jungle.
Speaker 2: It can be a juggle out there, let's make sure
Speaker 2: we're all.
Speaker 1: On the same page. Okay, what exactly is an ROP gadget?
Speaker 1: That's an ROP gadget and why are they so important?
Speaker 2: Is a pre existing snippet of code? Okay, within a
Speaker 2: program that ends with a return instructions okay, and attackers
Speaker 2: use these gadgets to indirectly achieve their goals.
Speaker 1: So they're not actually writing their own.
Speaker 2: Code, right, They can't just inject their own code directly,
Speaker 2: so they have to use what's already there.
Speaker 1: So they're piecing together existing instructions exactly.
Speaker 2: It's like creating a Frankenstein's Monster of code.
Speaker 1: It's like a puzzle. It is a puzzle where they
Speaker 1: have to find the right pieces, yeah, and.
Speaker 2: Fit them together in just the right way to get
Speaker 2: the desired outcome.
Speaker 1: So why is this so powerful?
Speaker 2: Well, because it allows attackers to bypass security mechanisms. Okay,
Speaker 2: they try to prevent vent the execution.
Speaker 1: Of data by essentially using legitimate code.
Speaker 2: Exactly, they're reusing code that's already there.
Speaker 1: It's pretty sneaky, is very sneaky, But it sounds like
Speaker 1: you need to be pretty skilled to pull this off.
Speaker 2: You need a deep understanding of the target system. You
Speaker 2: need to know how memory is laid out, what gadgets
Speaker 2: are available.
Speaker 1: So when we talk about kernel level exploitation, that puzzle
Speaker 1: gets even more complex.
Speaker 2: Oh yeah, the kernel has a lot of security mechanisms
Speaker 2: in place.
Speaker 1: So like the iOS kernel that prevents non position independent
Speaker 1: binaries from executing.
Speaker 2: So attackers need to find ways around that.
Speaker 1: Okay, So let's say we have that information, like what
Speaker 1: we know the memory layout, where do we even begin
Speaker 1: to look for these gadgets?
Speaker 2: So there are a few tools and techniques that attackers use.
Speaker 2: One common approach is to use a disassembler. A disassembler, yeah,
Speaker 2: like Hopper or idea pro.
Speaker 1: So they're manually looking through code.
Speaker 2: They are, but it can be very tedious.
Speaker 1: Especially when you're dealing with something like the iOS kernel.
Speaker 2: Yeah, that's a lot of code to sift through.
Speaker 1: So are there any shortcuts?
Speaker 2: There are? Luckily rules there are tools called ROP gadget finders.
Speaker 1: ROP gadget finders.
Speaker 2: These tools automatically scan the binary code and extract potential gadgets.
Speaker 1: So it makes the process a lot easier, much easier.
Speaker 1: Are there any specific gadget finders.
Speaker 2: There are a few out there that you would recommend.
Speaker 2: The book Mentions one created by Jonathan sall One, Okay,
Speaker 2: which you can find on GitHub.
Speaker 1: So we've got our gadget finding tools, We're ready to go.
Speaker 1: What kind of gadgets are we actually looking for?
Speaker 2: So the specific gadgets you need.
Speaker 1: What should we be keeping an eye out for.
Speaker 2: Depend on your goal, okay, But some common types include
Speaker 2: write what whear gadget right what where? These allow you
Speaker 2: to write data to a specific memory address.
Speaker 1: Okay, so you can control the data exactly.
Speaker 2: You can control the target program's data.
Speaker 1: Okay. Stack pivot gadgets we've already talked about those.
Speaker 2: We have those. Let you redirect the stackpointer. Yeah. And
Speaker 2: then system called gadgets.
Speaker 1: System call gadgets.
Speaker 2: These are very powerful.
Speaker 1: Why are they so powerful.
Speaker 2: Because they allow you to invoke system calls, okay, which
Speaker 2: are functions provided by the operating system.
Speaker 1: You can do things like read sensitive file.
Speaker 2: You can read files, execute commands.
Speaker 1: Have elevated privileges.
Speaker 2: With elevated privileges, that's the danger.
Speaker 1: It sounds dangerous, it is. So by chaining these different
Speaker 1: gadgets together, that's the art of ROP, attackers can create.
Speaker 2: Very powerful exploits.
Speaker 1: So it's like a chain reaction. It is of carefully planned.
Speaker 2: Actions, each gadget triggering.
Speaker 1: The next, leading to the ultimate goal.
Speaker 2: Exactly. That's a great way to put and.
Speaker 1: I imagine domnning an ROP chain. It's not easy, is
Speaker 1: not a walk in the park.
Speaker 2: No, it's not.
Speaker 1: What are some of the challenges.
Speaker 2: So one challenge is finding gadgets that work well together. Okay,
Speaker 2: not all gadgets can be chained together seamlessly. Yeah, they
Speaker 2: might have specific requirements or side effects.
Speaker 1: So you need to find the right gadgets.
Speaker 2: You need to find the right set of gadgets that
Speaker 2: work well together. They work harmoniously together. Yeah. Another challenge
Speaker 2: is ASLR. ASLR address space layout randomization.
Speaker 1: That's a big one.
Speaker 2: It is a big one.
Speaker 1: We talked about that.
Speaker 2: Before we did.
Speaker 1: It randomizes memory addresses. It does make it harder to
Speaker 1: predict where things are exactly. So how do attackers deal
Speaker 1: with that? Well, they have to get creative, got their
Speaker 1: ways around it.
Speaker 2: There are sometimes they can exploit other vulnerabilities to leak
Speaker 2: information about the memory layout, or use techniques like heap.
Speaker 1: Spraying so they can increase the chances of their payload
Speaker 1: landing at a predictable address in a specific spot exactly.
Speaker 1: So even with ASLR, attackers can still find ways they
Speaker 1: can to build their rop chains.
Speaker 2: They're very determined.
Speaker 1: It's impressive how they can do that.
Speaker 2: It's a constant arms race between attackers and defenders.
Speaker 1: So it's like attackers are finding ways to bypass.
Speaker 2: They are, and then defenders are trying to stay one
Speaker 2: step ahead, trying. It's a never ending battle.
Speaker 1: So we're nearing the end of part two already of
Speaker 1: our rop field adventure Time Flies.
Speaker 2: When you're having fun.
Speaker 1: What are some key takeaways?
Speaker 2: I think the biggest takeaway is that knowledge is power.
Speaker 1: Knowledge is power.
Speaker 2: The more we understand how attackers think.
Speaker 1: Yeah, and operate, the better we can defend against them.
Speaker 2: Exactly.
Speaker 1: So this deep dive into rop is all about giving
Speaker 1: you that knowledge.
Speaker 2: It is, even though it's technical, Yeah, it's important to
Speaker 2: understand these things, Okay, whether you're a developer, a security professional,
Speaker 2: or just someone who's interested, or just someone who's curious
Speaker 2: about how things work.
Speaker 1: Yeah, and how things can be broken.
Speaker 2: And how they can be broken exactly.
Speaker 1: Security is everyone's responsibility, it is, So by understanding these concepts,
Speaker 1: you can help build a more secure a world.
Speaker 2: That's the goal.
Speaker 1: Okay. So that brings us to the end of part
Speaker 1: two of our deep dive.
Speaker 2: Time Flies into ar exploitation. It does.
Speaker 1: In part three, we're gonna shift gears and we're going
Speaker 1: to explore ARM sixty.
Speaker 2: Four the world of mobile devices, the world of mobile devices, smartphones, tablets,
Speaker 2: all that good stuff.
Speaker 1: So stay tuned and we'll be back soon.
Speaker 2: We'll be back.
Speaker 1: Welcome back to the deep dive for the final part
Speaker 1: of our journey.
Speaker 2: I can't believe it's already the final part.
Speaker 1: I know it's flown by it has. So we've climbed
Speaker 1: the treacherous cliffs of memory corruption, We've navigated the labyrinthine.
Speaker 2: Heap, we've seen it all.
Speaker 1: We've even mastered stack pivoting like pros, and most importantly,
Speaker 1: we've learned how attackers exploit these vulnerabilities right.
Speaker 2: To gain control of systems.
Speaker 1: Yeah, and we even ventured into the world of ROP.
Speaker 2: Oh yes, ROP return oriented programming.
Speaker 1: Discovering how attackers can chain together these tiny snippets of code.
Speaker 2: It's amazing what they can do to.
Speaker 1: Create these really powerful exploits.
Speaker 2: It is, but all of our.
Speaker 1: Adventure make sures so far have been in the thirty
Speaker 1: two bit.
Speaker 2: ARM world, right, the land of ARMv seven.
Speaker 1: Now it's time to step into the future. The future
Speaker 1: is now the world of ARM sixty four. ARM sixty
Speaker 1: four the dominant architecture in most modern mobile devices.
Speaker 2: Smartphones, tablets, even some laptops.
Speaker 1: So Chapter nine of Beginner's Guide to Exploitation on ARM
Speaker 1: Volume two, Okay, is our guide for this new landscape,
Speaker 1: our roadmap, and we're going to see how the exploitation
Speaker 1: techniques we've discussed translate to this new world.
Speaker 2: Because it's a different world.
Speaker 1: It is a different world.
Speaker 2: But there are some similarities.
Speaker 1: So is everything we've learned about thirty two BITARM exploitations
Speaker 1: still relevant?
Speaker 2: That's a good question.
Speaker 1: Yeah, or do we need to throw out our playbooks.
Speaker 2: I wouldn't throw them out just yet, okay, because the
Speaker 2: good news is, yeah, a lot of the core principles
Speaker 2: are still the same. Okay, memory corruption, control, flow, hijacking.
Speaker 1: So the fundamentals haven't changed.
Speaker 2: The fundamentals are the same, Okay, it's just the details
Speaker 2: that are different.
Speaker 1: So it's like visiting a new country. I like that
Speaker 1: analogy where they speak a slightly different dialoge a.
Speaker 2: Different dialect of the same language.
Speaker 1: Of the same language.
Speaker 2: Exactly.
Speaker 1: We still need to understand memory layouts. Yes, we need
Speaker 1: to exploit vulnerabilities. Of course, overwrite crucial data. That's how
Speaker 1: you gain control and manipulate the program counter.
Speaker 2: To redirect execution flow.
Speaker 1: Okay, so that's reassuring it is. But let's get.
Speaker 2: Specific, all right, let's dive into the details.
Speaker 1: What are some of the key differences?
Speaker 2: Okay, So one of the most noticeable differences is register size.
Speaker 1: Register size.
Speaker 2: ARM sixty four uses sixty four bit registers, okay, compared
Speaker 2: to the thirty two bit registers in ARM v seven.
Speaker 1: So everything's just bigger essentially. Yes, more room to store data.
Speaker 2: More space to work with.
Speaker 1: So the instruction of monics are different too.
Speaker 2: Right, Yeah, than the monics are a bit different.
Speaker 1: Because you're working with larger registers.
Speaker 2: Right, Some instructions have different names or slightly different syntax.
Speaker 1: Can you give me some examples?
Speaker 2: Sure? So remember how we used posh and pop instructions
Speaker 2: in ARMv seven, Yeah.
Speaker 1: To add and remove items from the stack.
Speaker 2: Well, in AIRM in sixty four, yeah, we use STP
Speaker 2: and LDP instead.
Speaker 1: SDP and LDP store pair and load pair. So instead
Speaker 1: of pushing and popping single registers, right, we're storing and
Speaker 1: loading pairs.
Speaker 2: Here's the registers.
Speaker 1: Okay, so that makes sense it does. What about returning
Speaker 1: from functions?
Speaker 2: Ah? Yes, that's another difference.
Speaker 1: Airmv seven just uses rat.
Speaker 2: Right, simple and straightforward.
Speaker 1: That AIRM sixty four gets a little fancier okay.
Speaker 2: Uses a combination of LDP and RAT interesting it is.
Speaker 1: Okay, So there are definitely some tweaks.
Speaker 2: Some adjustments so technique, but the underlying concepts.
Speaker 1: But the book shows how ROP can still be applied
Speaker 1: in AARM sixty four absolutely so they have an AIRM
Speaker 1: sixty four version they do of the ROP Level one challenge,
Speaker 1: which is great for practice, so you can really see
Speaker 1: how these concepts translate.
Speaker 2: To the new architecture.
Speaker 1: So even with all these changes, it's still about finding
Speaker 1: the right gadgets always chaining them together.
Speaker 2: That's the heart of ROPS, in the right way to
Speaker 2: achieve your goal.
Speaker 1: So it seems like ARM sixty four it doesn't completely
Speaker 1: rewrite the rules of exploitation.
Speaker 2: It just adds a little bit of complexity.
Speaker 1: It just requires a bit of adaptation, adaptation and creativity.
Speaker 1: So as we wrap up this deep dive, it's been
Speaker 1: quite a journey. It has been an amazing journey.
Speaker 2: Through the world of ARM exploitation.
Speaker 1: What are some key takeaways?
Speaker 2: Okay, Well, I think the most important takeaway for our
Speaker 2: listeners is that secure coding practices are absolutely essential.
Speaker 1: Secure coding because.
Speaker 2: Even small errors can have huge consequences.
Speaker 1: You have to validate your inputs carefully. You do be
Speaker 1: mindful of memory management.
Speaker 2: Memory management is.
Speaker 1: Key, and always prioritize security from the very beginning. Yeah,
Speaker 1: throughout the whole development process.
Speaker 2: Absolutely.
Speaker 1: Okay, So knowledge is power.
Speaker 2: Knowledge is power.
Speaker 1: Understanding how these exploits work.
Speaker 2: Right, because that's how you protect yourself.
Speaker 1: Yeah, you have to know what the attackers are doing exactly,
Speaker 1: and you have to keep.
Speaker 2: Learning, never stop learning.
Speaker 1: Because this world is constantly changing.
Speaker 2: It's a constantly evolving landscape.
Speaker 1: It's been an amazing journey, it has. We've climbed the
Speaker 1: mountains of memory corruption.
Speaker 2: We've been to the top, we've.
Speaker 1: Explored the depths of the heat.
Speaker 2: We've seen it all.
Speaker 1: And we've even mastered the art of stack.
Speaker 2: Bending state bending.
Speaker 1: I like that. Most importantly, we've gained valuable knowledge. Yes,
Speaker 1: knowledge is key about how attackers exploit these vulnerabilities and
Speaker 1: how we can protect ourselves.
Speaker 2: And that's what it's all about.
Speaker 1: So thank you for joining us, Thank you for having
Speaker 1: me on this deep dive. It's been a pleasure into
Speaker 1: the world of arm exploitation. Until next time, stay curious,
Speaker 1: stay safe.
Speaker 2: Stay secure, and keep exploring the world of cybersecurity.
Speaker 1: The fascinating world of cybersecurity,