Главная
Study mode:
on
1
Introduction
2
Disclaimers
3
About me
4
Battle plan
5
Extracting Firmware
6
Shell
7
Device Profile
8
Device Content
9
Cleanup
10
Load in Gydra
11
R2 Pipe
12
Function Offsets
13
Broadcom
14
Firmware dump
15
Header format
16
Program store
17
Plan
18
Signature Libraries
19
Function ID databases
20
Functions signatures
21
Function tracing
22
Function naming
23
Vtable
24
Rename Vtables
25
Address of vectors
26
Data segment identification
27
Firmware Offset
28
Stack Location
29
Stack Base Address
30
Memory Map
31
Memory Map offsets
32
Bugs
33
Memory Corruption
34
Store Copy
35
Parental Control Page
36
Storycuts
37
Heap Overflow
38
Device Crash
39
Drop Chain
40
Recap
41
Netgear
42
Exploit
43
Shellcode
44
Linker
45
Persistence
46
Implant
47
Bootkit
48
Persistence Demonstration
49
Recommendations
50
IP Manager
51
Future work
52
Open source
53
References
Description:
Explore the world of eCos RTOS offensive security research in this comprehensive conference talk from BruCON 0x0D. Delve into the inner workings of eCos-based devices, from cable modems to ICS components, and learn techniques for firmware analysis, exploitation, and long-term persistence. Follow along as the speaker demonstrates how to extract and analyze eCos firmware, write exploits for memory corruption vulnerabilities, and develop firmware implants. Gain insights into Broadcom's eCos internals, including interrupts, exception handling, memory layout, and heap management. Discover tools and methodologies for security professionals interested in eCos platform security, covering topics such as function identification, vtable analysis, and memory mapping. Witness practical demonstrations of exploiting vulnerabilities and achieving persistence on eCos devices. Conclude with recommendations for improving eCos security and explore future research directions in this underexplored area of embedded systems security. Read more

ECOS Offensive Security Research Logbook

BruCON Security Conference
Add to list
0:00 / 0:00