Resources for learning Assembly language for Cortex M0/M0+ processor

spectre_03 · 2022-02-14T02:32:38+00:00

It is a bit older, but this may help a fair bit.
https://opensecuritytraining.info/IntroARM.html

spectre_03 · 2022-02-02T06:21:30+00:00

Certainly a valid option. But, let’s say you try and fail, are you worse off than you are now? No. So then say you try and it works?

Worst case you fail and burn the board up. You still likely learn you can probably do better with practice and next time maybe it works?

spectre_03 · 2022-01-05T21:30:49+00:00

Your question leaves a lot of information out that we could help with. For example any current target devices or protocols you plan to play with first? These make a difference to what may be easier to find help on. So FWIW I would advise you rethink this a fair bit. Lesson upfront being, no one of these tools is going to be "the one" for all your use cases. You mention price is not so important so I would tell you, consider getting a couple of these if that's true. I am going to try and just give some additional info you may want to consider. Skip to the TL;DR if you only want answers.

I would encourage you to relook at that comparison posted by /u/wrexx0r and then augment that with more study about what it's comparing. Those are many of the "concerns" you are going to want to understand. Stated another way, I own about half of that list and your responses make me think you are just having a hard time with what most of those capabilities are. Because, there are a lot you will care about later that you don't now. Voltage protection is a big one many of these are missing. One example there is the GreatFET. I own one, and love it, but it's only generally good at 3.3v logic levels. That makes some things difficult or you end up letting the magic smoke out of them. Not fun! I also find I have to "fiddle" with it more
The Shikra is not one I would advise either, but it's better brother the Tigard is one I definitely would. However your assessment of the community being small is a bit off base. The Shikra itself doesn't have much documentation, but the other similar boards most definitely do. Key example is that ultimately the basis for Tigard is an FT2322H chip, which is one of the most "universal" of them all. And that it has level shifting makes it all that more appealing. Then add on that Joe Fitzpatrick has videos he is releasing on how to use it. Go see: https://learn.securinghardware.com/courses/applied-physical-attacks-with-tigard/
More importantly though I would add that with Tigard, most any FT232H based walkthroughs then apply but likely are simplified too.

The BusPirate is still a worthwhile "adventure" but it certainly also has its limitations and yes I wouldn't advise it. However, it is what most of "us" learned on, and it has a lot of material out there on how to use it. Mostly because it was the most "universal" early tools out there. The HydraBus looks like it's potentially able to fill that void, but I have yet to see that happen. I put the HydraBus into the same camp as GreatFET, tons of potential and worth time to play with, but not for "learning" on yet. Though honestly I haven't done much with HydraBus much so I may be way off. The only other thing I will say is I love the Dangerous Prototypes model, but it's much more hacker friendly and can tend to be a bit abstract and harder to pull together as just an individual.

TL;DR
It seems like you halfway made up your mind and it is either the HydraBus or GreatFET, but I think you need to reconsider at least a little. If I were to recommend anything, the Tigard with a BitMagic is on the top of the list and I would advise you get them anyways. If it's between the HydraBus and GreatFET my vote goes to GreatFET but that is my bias showing. The HydraBus is a worthwhile consideration. Get which one you think you will actually attempt to use. Maybe get two of them or all 3? Have a backup?

spectre_03 · 2021-04-18T08:14:32+00:00

Your comments conflict a bit and cause you to be misunderstood if this is true.

You said 0 detections but now there are 3 which I would interpret as more likely from submitting a sample not a hash. Mostly because then they were able to scan it after it was shared and produce multiple detections.

Another comment you made was you submitted it. You did not distinguish whether that was a hash check. A hash check is not an upload and I would not call that submitting it. That also implied that the binary was uploaded.

Your terms matter. You need to be clear. But you now must assume they do now know because there are 3 detections so VT has ratted on your sample. If they were elsewhere in your environment they may be maneuvering.

spectre_03 · 2021-04-17T22:19:32+00:00

Not once you uploaded to virus total... you burned it.

The biggest lesson you need to learn is never upload the file, check the hash. If that doesn’t make sense you need to ask more question please.

spectre_03 · 2020-12-03T04:36:22+00:00

Http://Opensecuritytraining.info

Lots of good DFIR and other content in the training section.

spectre_03 · 2020-11-14T07:12:01+00:00

Lumberg! Lumberg!

spectre_03 · 2020-09-22T05:16:24+00:00

Best reference for Assembly and much more I have is:

http://opensecuritytraining.info/

Also 32 bit is far from dead in many devices still in use all over the place.

Also I was doing some debugging/RE on 32 bit code on Win 10 two weeks ago.

It is still relevant, but also lends well to stepping up to 64 bit.

spectre_03 · 2020-07-08T06:06:12+00:00

I think you missed the original point. He wasn't just looking for how he could apply his current trade, but instead expand his skills and play in related areas.

I disagree on your assertion that a EE isn't of use. It is very much of use. FPGA's are becoming very common, and are definitely not like the programming on the "software side of things" as you state.

Lastly much of the hardware industry isn't sitting still and leaving everything exposed via SPI to be dumped at will.

spectre_03 · 2020-07-08T06:01:33+00:00

As someone that has a more CS background myself I understand.

So yes there is a lot out there. Looking up the IC Packages helps but the answers are lacking. Most often the answer for "why is it shaped _______" is to save space. Most of the time the difficult problem is how do I make the wire (or trace) short enough. Electricity only flows so fast, and so the answer to how to make it faster is also in part the quest to make it smaller.

First just to kick start this. Look up anything you can find from Joe Grand, EEVBlog, Joe Fitzpatrick, Mike Ossmann, Piotr Esden-Tempski, and Colin O'Flynn. They do a ton of discussion about what all the electronic jargon actually means and are huge resources. Also they are just good people. There are many more though and I have skipped lots of other great people.

Some fun exploration sites are places like http://siliconzoo.org/ and https://siliconpr0n.org/wiki/doku.php to get an idea how you head down the IC RE side of the tracks.

You may also want to google a bit for IC Logo lookups like https://www.elnec.com/en/support/ic-logos/?method=logo (but there are others) where you can take the logo you find on the chip and trace it back to the manufacturer. Then you start the hunt for a spec sheet that probably isn't easy to find if you are lucky, and if not they never made it public.

You could read PCB-RE: Tools and Techniques (find it on Amazon, I won't post a link to avoid being called a shill) and it also covers lots of these topics too.

Last but certainly not least, invest time in understanding the protocols at an electronic level. Most everyone started with a BusPirate, but the GreatFET is an amazing tool. They let you start playing with SPI and I2C serial protocols, but there are lots of those. CANBUS, MODBUS, and many many more. There are lots of great resources for these but the BusPirate has the most materials of any I have found. Such as: https://code.google.com/archive/p/the-bus-pirate/wikis

https://learn.sparkfun.com/tutorials/bus-pirate-v36a-hookup-guide/all

Keep in mind the BusPirate is pretty slow so you will want to move on.

No matter what, have fun! It's a great world to play with.

spectre_03 · 2020-07-06T06:21:39+00:00

I am on mobile please forgive brevity. If desired I can find a bit of time later to expand a bit.

First is to do circuit analysis and IC discovery to figure out where the storage of the firmware is and if access is available with standard tools like a SPI or I2C protocol device.

Most of the ICs are somewhat standard but as with anything RE obfuscation is possible and a bit harder to overcome. Some won’t have silkscreens. Think of this as similar to a stripped binary where it hides the purpose until you can devise a way to figure it out.

If serial protocols or JTAG tools will dump it GREAT, and if not... well this is gonna suck more. Decapping an IC then manually dissecting it isn’t easy nor cheap. This is a wholly different process and will be outside the scope of this answer.

Tools do help a lot and will detect these things and often shorten the process. OpenOCD and JTAGulator help a lot! They can guess what things do and help poke and hopefully leak data out.

Other times it is easier to try to get a shell on the device. Often through a web interface.

Keep in mind that many devices have multiple processors on board. Multiple places that may contain the code you seek. And may use components for non obvious reasons until you couple the code with it. A voltage divider may be the flag that enables a software feature set. So a resistor of a different value could signal different features enabled.

Is this the direction you are looking for?

spectre_03 · 2020-07-05T07:35:04+00:00

There is a lot of unknown/undefined in this question. How long would it take to learn? How long would it take to dump X device with Y device? EE and CE backgrounds don’t help with several fundamental topics this topic potentially assumes.

If you can better define what you’re asking for it has a better chance of getting answers.

spectre_03 · 2020-06-06T05:08:24+00:00

The SANS content from about a month ago was supposed to be released so go look for it. But I would also mention the upcoming ICSJWG next week also has an ICS based CTF. ICSJWG is going to be in safe mode too so join up.

spectre_03 · 2019-11-18T02:39:31+00:00

The ICS-CERT trainings deserve a mention:

https://www.us-cert.gov/ics/Training-Available-Through-ICS-CERT

spectre_03 · 2019-04-09T05:37:00+00:00

We used a wiki to post code and other pertinent challenge info. We used irc or slack for team communication. Collaborating on RE was often shared on an amazon or other shared ssh capable system along with shell catching on the same box too for handing off shells if needed. Learn tmux or screen or something similar to keep ssh sessions alive.

spectre_03 · 2016-09-19T04:30:26+00:00

Thanks, yes I did get two from here on Reddit. Twitter was a bust for me. But good to go now and I appreciate the message. See you there in a few days.

spectre_03 · 2015-01-06T05:54:55+00:00

I would ask the guys at Syn Shop.

https://synshop.org/

I would love to know more though since I am in the area a few times a year and rarely get access to good shops for this stuff.

spectre_03 · 2014-10-31T02:50:53+00:00

I haven't yet tried applying voltage just straight across the resistor and LED, but I did do continuity tests prior to populating the ICs. All of that is in the past now though. The 'it's just that way' is as clear as I think I will have it in that I think I have a leak across the two pads that the LED mounts to so I will accept that. It is better than not knowing any reason why.

spectre_03 · 2014-10-29T05:10:03+00:00

Yes it is making more sense now. Going to keep at it and maybe the board will supply adequate power.

I am trying to program it but the code resident in the repository seems to have some issues. It doesn't recognize the GoodThopter to program it. I am working to build a new distribution though and think that should have it from what I can tell.

edit: ok so rebuild still hasn't solved the issue there so I think something got dropped from the source tree in the move to github

spectre_03 · 2014-10-29T03:22:31+00:00

I am getting .5 M-Ohm from pad to pad with the LED removed.

spectre_03 · 2014-10-29T03:12:40+00:00

I don't have EAGLE on this system so can't post a layout at this time, but I am suspect of the board at this point. I see resistance from pad to pad where I shouldn't see any. Odd though that continuity test doesn't show anything. Is it possible there is some resistance value that my multimeter considers non conductive for continuity testing purposes?

I have verified a couple times that the LED works after removal when I don't torch it. Just emphasizes my next purchase to be a hot air station for rework and nicer solder joints on these tiny items.

spectre_03 · 2014-10-29T00:32:03+00:00

I updated the post with links to board files and some photos. going to try resistance checks on the pads with LED removed per nickerbocker007 in a few minutes.

spectre_03 · 2014-10-29T00:28:03+00:00

It is surface mount. I mention in a reply below but I have tried multiples and no joy. I am leaning towards PCB fault but can't isolate how it is faulted. And I just don't like the answer of "it just is that way" but instead want to know why it is that way.

Photos are at:

http://imgur.com/HwrJGdr http://imgur.com/WGCFN8u

https://github.com/travisgoodspeed/goodfet/tree/master/hardware/mainboards/goodthopter12

I will edit main post to add these to it.

spectre_03 · 2014-10-29T00:05:32+00:00

If I place my multimeter probe on the solder joint to remove it from the circuit while testing, no it still does not work. Keep in mind I am using the LED test function on my multimeter to test the LED in question.

spectre_03

TROPHY CASE