Archive for October, 2019

How are the PINS defined and programmed in Tiva TM4C1294XL board

From this:

https://tthtlc.wordpress.com/2019/10/26/understanding-how-energia-generate-the-binaries-for-my-tm4c1294xl-board/

We can see how to program the LED pins on the TM4C1294XL board – just using the alias RED_LED and GREEN_LED and BLUE_LED which is defined somewhere. And all program are written in C and compiled by arm-none-eabi-gcc.

Where? In $HOME/.energia15/packages/energia/hardware/tivac/1.0.3/system/inc/tm4c1294ncpdt.h:

which can be found in other places:

http://users.ece.utexas.edu/~valvano/arm/tm4c1294ncpdt.h

http://users.ece.utexas.edu/~valvano/arm/lm4f120.s

AirSupply Lab has good examples for working with GPIO to control the LEDs:

http://www.airsupplylab.com/tiva-c-series/30-tiva-lab-02-using-gpio-to-control-led.html#ek-tm4c1294xl-launchpad

But before the pins can be used, it must be initialized first, as described here:

http://www.airsupplylab.com/index.php?option=com_content&view=article&id=39&catid=22

One feature where ARM differ from Intel x86 CPU is that here port-mapping I/O does not exists. You only have memory-mapped I/O. So all PIN access are really writing and reading some memory addresses, which is also called “registers”. This is a good introduction to memory mapped I/O on ARM CPU:

https://www.youtube.com/watch?v=aT5XMOrid7Y

References:

https://henryforceblog.wordpress.com/2015/05/02/blink-example-using-timer-on-a-tiva-launchpad/: This article attempts to use the different timer available on the TM4C directly using the ROM_xxxx API provided by Energia:

The definitions are located in a file “packages/energia/hardware/tivac/1.0.3/system/driverlib/rom_map.h” (6000+ lines long) and snapshot of it are shown below:

And their actual usage can be found in lots of the sample implementation in the “$HOME/.energia15/packages/energia/hardware/tivac/1.0.3/cores/tivac” directory:

And the official documentation for the ROM API are here:

http://fiona.dmcs.pl/~pzajac/pliki/SKRA/UG-ROM-TM4C129x-797.pdf (called ROM User Guide)

https://doanminhdang.gitlab.io/notes/Tools/Hardware/Microcontrollers/Arm_Cortex-M4_TM4.html

Other than the ROM based API programming, is another method: direct register modification (DRM).

https://jspicer.net/2018/07/15/pll-configuration-for-the-ek-tm4c1294xl/

And there in Stellaris Peripheral Driver Library is documented the direct register modification guidelines:

https://www.ti.com/lit/pdf/spmu019

A snippet is shown below :

Understanding how Energia generate the binaries for my TM4C1294XL board

http://wiki.ros.org/rosserial_tivac/Tutorials/TivaWare%20Setup

http://www.ti.com/tool/SW-TM4C

http://www.ti.com/tool/SW-TM4C#technicaldocuments

Inside Energia, choose “Board Manager” and install components for Tiva:

Creating the simplest hello-world program:

/*
Blink
The basic Energia example.
Turns on an LED on for one second, then off for one second, repeatedly.
Change the LED define to blink other LEDs.

Hardware Required:
* LaunchPad with an LED

This example code is in the public domain.
*/

// most launchpads have a red LED
#define LED RED_LED

//see pins_energia.h for more LED definitions
//#define LED GREEN_LED

// the setup routine runs once when you press reset:
void setup() {
// initialize the digital pin as an output.
pinMode(LED, OUTPUT);
}

// the loop routine runs over and over again forever:
void loop() {
digitalWrite(LED, HIGH); // turn the LED on (HIGH is the voltage level)
delay(50); // wait for a second
digitalWrite(LED, LOW); // turn the LED off by making the voltage LOW
delay(500); // wait for a second
}

Looking at the command line executed via “ps -ef”:

The gcc commands spewed out:

/home/tthtlc/.energia15/packages/energia/tools/arm-none-eabi-gcc/6.3.1-20170620/bin/../lib/gcc/arm-none-eabi/6.3.1/cc1plus -quiet -I /home/tthtlc/.energia15/packages/energia/hardware/tivac/1.0.3/variants/EK-TM4C1294XL -I /home/tthtlc/.energia15/packages/energia/hardware/tivac/1.0.3/system/driverlib -I /home/tthtlc/.energia15/packages/energia/hardware/tivac/1.0.3/system/inc -I /home/tthtlc/.energia15/packages/energia/hardware/tivac/1.0.3/system -I /home/tthtlc/.energia15/packages/energia/hardware/tivac/1.0.3/cores/tivac -I /home/tthtlc/.energia15/packages/energia/hardware/tivac/1.0.3/variants/EK-TM4C1294XL -imultilib thumb/v7e-m/fpv4-sp/hard -iprefix /home/tthtlc/.energia15/packages/energia/tools/arm-none-eabi-gcc/6.3.1-20170620/bin/../lib/gcc/arm-none-eabi/6.3.1/ -isysroot /home/tthtlc/.energia15/packages/energia/tools/arm-none-eabi-gcc/6.3.1-20170620/bin/../arm-none-eabi -MMD /tmp/arduino_build_5357/sketch/Blink.ino.cpp.d -MQ /tmp/arduino_build_5357/sketch/Blink.ino.cpp.o -D__USES_INITFINI__ -D printf=iprintf -D F_CPU=120000000L -D ARDUINO=10807 -D ENERGIA=10807 -D ENERGIA_EK_TM4C1294XL -D ENERGIA_ARCH_TIVAC /tmp/arduino_build_5357/sketch/Blink.ino.cpp -quiet -dumpbase Blink.ino.cpp -mcpu=cortex-m4 -mthumb -mcpu=cortex-m4 -mthumb -mfloat-abi=hard -mfpu=fpv4-sp-d16 -mabi=aapcs -auxbase-strip /tmp/arduino_build_5357/sketch/Blink.ino.cpp.o -g -Os -w -std=gnu++11 -ffunction-sections -fdata-sections -fno-threadsafe-statics -fno-rtti -fno-exceptions –param max-inline-insns-single=500 -o /tmp/ccxPVy15.s

We can see that it is using arm-none-eabi-gcc to compile before being flashed, and the output are also “thumb” formatted:

cd /home/tthtlc/.energia15/packages/energia/tools/arm-none-eabi-gcc/6.3.1-20170620/bin

and you can see the tools:

And going to the /tmp/ directory, there is a temporary directory created for processing all the ELF processing:

Using objdump to disassemble the ELF:

export PATH=/home/tthtlc/.energia15/packages/energia/tools/arm-none-eabi-gcc/6.3.1-20170620/bin:$PATH

arm-none-eabi-objdump -d Blink.ino.elf

And the full details are pasted here:

https://pastebin.com/z2h88Bqs

But essentially the following are found:

The g_pfnVectors can be found from “$HOME/.energia15/packages/energia/hardware/tivac/1.0.3/cores/tivac/startup_gcc.c“.   Within the g_pfnVectors are all the dynamic function pointers for interrupt handling:

Selection_893

 

These hardware vector offset are determined by hardware, and therefore are also declared as “constant”, and cannot be changed.

From the “libraries/core.a” found in the arduino_build_5357 directory, are listed all the core libraries components – which will include all the functions declared in the above header file:

00000000 <UARTIntHandler>:
00000000 <UARTIntHandler1>:
00000000 <UARTIntHandler2>:
00000000 <UARTIntHandler3>: ……etc

Only some of these will be compiled into the .text section of the ELF.

If we had used “Export compiled binary” and generated a binary in the export library directory, we can identify that binary as identical to the “.text” section of the ELF file above – which is exactly the portion only needed to be flashed to the evaluation kit.

To understand fully the different hardware handler of the binary will require the full datasheet of the microcontroller:

http://www.ti.com/lit/ds/symlink/tm4c1294ncpdt.pdf

To understand how the blinking happens, we shall go into the digitalWrite() implementation (inside $HOME/.energia15/packages/energia/hardware/tivac/1.0.3/cores/tivac/wiring_digital.c):

85 void digitalWrite(uint8_t pin, uint8_t val)
86 {
87 uint8_t bit = digitalPinToBitMask(pin);
88 uint8_t mask = val ? bit : 0;
89 uint8_t port = digitalPinToPort(pin);
90 uint32_t portBase = (uint32_t) portBASERegister(port);
91
92 if (port == NOT_A_PORT) return;
93
94 ROM_GPIOPinWrite(portBase, bit, mask);
95 }

These are programming the 4 LEDs.

Four user LEDs are provided on the board. D1 and D2 are connected to GPIOs PN1 and PN0. D3 and D4 are connected to GPIOs PF4 and PF0.

Selection_887

For details (on other GPIOs, timers etc) please lookup datasheet for the board:

http://www.ti.com/tool/EK-TM4C1294XL

http://www.ti.com/lit/ug/spmu365c/spmu365c.pdf

And other document:

http://www.ti.com/product/TM4C1294NCPDT/technicaldocuments

https://www.ti.com/product/TM4C1290NCPDT

Other relevant links:

https://github.com/Lauszus/TM4C-MSC-bootloader

https://github.com/shawn-dsilva/tm4c-linux-template

https://github.com/energia/Energia

https://github.com/YashBansod/ARM-TM4C-CCS

Fastbin attack

https://www.youtube.com/watch?v=0exSe-PAhns

http://folk.uio.no/laszloe/ctf/fastbin.pdf

http://blog.fxiao.me/how-to-heap/

https://0x00sec.org/t/heap-exploitation-fastbin-attack/3627

https://azeria-labs.com/heap-exploitation-part-2-glibc-heap-free-bins/

https://dokydoky.tistory.com/460

https://heap-exploitation.dhavalkapil.com/diving_into_glibc_heap/bins_chunks.html

https://paper.seebug.org/445/

https://quentinmeffre.fr/exploit/heap/2018/11/02/fastbin_attack.html

https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/

Heap Allocation: modern innovation

http://supertech.csail.mit.edu/papers/Kuszmaul15.pdf

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.87.3870&rep=rep1&type=pdf

http://transact2014.cse.lehigh.edu/baldassin.pdf

https://people.cs.umass.edu/~emery/pubs/gcvsmalloc.pdf

https://people.cs.umass.edu/~dtench/pdfs/mesh_arxiv.pdf

Understanding double free error in exploitation

From previous blog:

https://tthtlc.wordpress.com/2019/10/12/how-to-exploit-the-heap-allocation-bug-in-protostar/

We can see there is a an “double free” error:

Core was generated by `./heap3′.
Program terminated with signal SIGABRT, Aborted.
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x0000007fb5dce8b4 in __GI_abort () at abort.c:79
#2 0x0000007fb5e0765c in __libc_message (action=action@entry=do_abort,
fmt=fmt@entry=0x7fb5ec8b88 “%sn”) at ../sysdeps/posix/libc_fatal.c:181
#3 0x0000007fb5e0d9c4 in malloc_printerr (
str=str@entry=0x7fb5ec47f0 “double free or corruption (fasttop)”) at malloc.c:5350
#4 0x0000007fb5e0f568 in _int_free (av=<optimized out>, p=0x557507d750, have_lock=0)
at malloc.c:4230
#5 0x000000557506aa00 in main ()

And looking through the source code:

https://fossies.org/linux/glibc/malloc/malloc.c

And more explanation of how the algorithm worked are given below:

https://jipanyang.wordpress.com/2014/06/09/glibc-malloc-internal-arena-bin-chunk-and-sub-heap-1/

http://blog.fxiao.me/how-to-heap/

https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/

https://reverseengineering.stackexchange.com/questions/15033/how-does-glibc-malloc-work

https://cs50.stackexchange.com/questions/10742/2014-pset5-double-free-in-load

https://stackoverflow.com/questions/23530461/double-free-or-corruption-fasttop-in-my-encoder

More discussion of heap exploitation techniques:

https://github.com/shellphish/how2heap (which produced the diagram below):

https://azeria-labs.com/heap-exploitation-part-2-glibc-heap-free-bins/

http://blog.k3170makan.com/2018/12/glibc-heap-exploitation-basics.html

Fastbin attack method:

https://quentinmeffre.fr/exploit/heap/2018/11/02/fastbin_attack.html

https://sploitfun.wordpress.com/2015/03/04/heap-overflow-using-malloc-maleficarum/

https://www.tooboat.com/?p=629

https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/

https://manybutfinite.com/post/anatomy-of-a-program-in-memory/

https://sploitfun.wordpress.com/2015/02/11/syscalls-used-by-malloc

https://dangokyo.me/2017/12/05/introduction-on-ptmalloc-part1/

https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/

https://heap-exploitation.dhavalkapil.com/diving_into_glibc_heap/

https://parasol.tamu.edu/publications/download.php?file_id=570

http://web.mit.edu/sage/export/singular-3-0-4-3.dfsg/omalloc/Misc/dlmalloc/malloc.ps

Dou Lea-era Notes:

http://gee.cs.oswego.edu/dl/html/malloc.html

http://gee.cs.oswego.edu/pub/misc/malloc.c

https://research.cs.wisc.edu/sonar/projects/mnemosyne/resources/doc/html/malloc-original_2src_2dlmalloc_8c-source.html

https://www.cs.tufts.edu/~nr/cs257/archive/doug-lea/malloc.html

http://gee.cs.oswego.edu/dl/papers/

Vickblöm

Research scattered with thoughts, ideas, and dreams

Penetration Testing Lab

Offensive Techniques & Methodologies

Astr0baby's not so random thoughts _____ rand() % 100;

@astr0baby on Twitter for fresh randomness

The Data Explorer

playing around with open data to learn some cool stuff about data analysis and the world

Conorsblog

Data | ML | NLP | Python | R

quyv

Just a thought

IFT6266 - H2017 Deep Learning

A Graduate Course Offered at Université de Montréal

Deep Learning IFT6266-H2017 UdeM

Philippe Paradis - My solutions to the image inpainting problem

IFT6266 – H2017 DEEP LEARNING

Pulkit's thoughts on the course project

Thomas Dinsmore's Blog

No man but a blockhead ever wrote except for money -- Samuel Johnson

the morning paper

a random walk through Computer Science research, by Adrian Colyer

The Spectator

Shakir's Machine Learning Blog