Payloads are now linked into the final remote executable... much cleaner but still needs some work

c8_libpayload/pl/CMakeLists.txt

@@ -0,0 +1,23 @@
+project(checkm8_libpayload_sources C ASM)
+include_directories(include)
+
+set(CMAKE_SYSTEM_PROCESSOR arm)
+if(${CMAKE_HOST_SYSTEM_PROCESSOR} STREQUAL "x86_64")
+    set(CMAKE_C_COMPILER   /usr/bin/aarch64-linux-gnu-gcc)
+    set(CMAKE_ASM_COMPILER /usr/bin/aarch64-linux-gnu-as)
+    set(CMAKE_OBJCOPY      /usr/bin/aarch64-linux-gnu-objcopy)
+endif()
+
+set(CMAKE_C_FLAGS "-nostdlib -O")
+
+file(MAKE_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/bin)
+foreach(PL ${PL_NAMES_SHORT})
+    add_executable(payload_${PL} src/${PL}.c)
+    add_custom_command(TARGET payload_${PL} POST_BUILD
+                        BYPRODUCTS ${CMAKE_CURRENT_BINARY_DIR}/bin/payload_${PL}.bin
+                        COMMENT "objcopying ${PL}"
+                        COMMAND ${CMAKE_OBJCOPY}
+                        ARGS -O binary -j .text -j .payload_text -j .payload_data
+                            ${CMAKE_CURRENT_BINARY_DIR}/payload_${PL}
+                            ${CMAKE_CURRENT_BINARY_DIR}/bin/payload_${PL}.bin)
+endforeach(PL)

c8_libpayload/pl/include/brfunc_aes.h

@@ -0,0 +1,24 @@
+#ifndef CHECKM8_TOOL_BRFUNC_AES_H
+#define CHECKM8_TOOL_BRFUNC_AES_H
+
+#include "brfunc_common.h"
+
+int aes_hw_crypto_cmd(unsigned long long cmd,
+                      unsigned char *src, unsigned char *dst,
+                      int len, unsigned long long opts,
+                      unsigned char *key, unsigned char *iv)
+{
+    return ((BOOTROM_FUNC) ADDR_AES_HW_CRYPTO_CMD)(cmd, src, dst, len, opts, key, iv);
+}
+
+#define CREATE_KEY_COMMAND          ((BOOTROM_FUNC) ADDR_CREATE_KEY_COMMAND)
+#define PUSH_COMMAND_KEY            ((BOOTROM_FUNC) ADDR_PUSH_COMMAND_KEY)
+#define PUSH_COMMAND_IV             ((BOOTROM_FUNC) ADDR_PUSH_COMMAND_IV)
+#define PUSH_COMMAND_DATA           ((BOOTROM_FUNC) ADDR_PUSH_COMMAND_DATA)
+#define PUSH_COMMAND_FLAG           ((BOOTROM_FUNC) ADDR_PUSH_COMMAND_FLAG)
+#define WAIT_FOR_COMMAND_FLAG       ((BOOTROM_FUNC) ADDR_WAIT_FOR_COMMAND)
+
+#define rAES_INT_STATUS             (long *) ADDR_AES_CONTROL
+#define rAES_CONTROL                (long *) ADDR_AES_STATUS
+
+#endif //CHECKM8_TOOL_BRFUNC_AES_H

c8_libpayload/pl/include/brfunc_common.h

@@ -0,0 +1,36 @@
+#ifndef CHECKM8_TOOL_BRFUNC_COMMON_H
+#define CHECKM8_TOOL_BRFUNC_COMMON_H
+
+#include "checkm8_config.h"
+
+typedef int (*BOOTROM_FUNC)();
+
+#if CHECKM8_PLATFORM == 8010
+
+/* AES */
+#define ADDR_AES_HW_CRYPTO_CMD              0x100000f0c
+#define ADDR_CREATE_KEY_COMMAND             0x100000e90
+#define ADDR_PUSH_COMMAND_KEY               0x100000c64
+#define ADDR_PUSH_COMMAND_IV                0x100000d18
+#define ADDR_PUSH_COMMAND_DATA              0x100000d98
+#define ADDR_PUSH_COMMAND_FLAG              0x100000e20
+#define ADDR_WAIT_FOR_COMMAND               0x100000ec4
+
+#define ADDR_AES_CONTROL                    0x20A108008
+#define ADDR_AES_STATUS                     0x20A108018
+
+/* SEP */
+#define ADDR_DPA_SEEDED                     0x100001140
+#define ADDR_SEND_DPA_MESSAGE               0x100002338
+
+/* Timing */
+#define ADDR_CLOCK_GATE                     0x100009d4c
+#define ADDR_SYSTEM_TIME                    0x10000B0E0
+#define ADDR_TIME_HAS_ELAPSED               0x10000B04F
+#define ADDR_TASK_SLEEP                     0x10000ADF0
+
+#else
+#error "Unsupported checkm8 platform"
+#endif
+
+#endif //CHECKM8_TOOL_BRFUNC_COMMON_H

c8_libpayload/pl/include/brfunc_sep.h

@@ -0,0 +1,9 @@
+#ifndef CHECKM8_TOOL_BRFUNC_SEP_H
+#define CHECKM8_TOOL_BRFUNC_SEP_H
+
+#include "brfunc_common.h"
+
+#define DPA_SEEDED                  ((BOOTROM_FUNC) ADDR_DPA_SEEDED)
+#define SEP_CREATE_SEND_DPA_MESSAGE ((BOOTROM_FUNC) ADDR_SEND_DPA_MESSAGE)
+
+#endif //CHECKM8_TOOL_BRFUNC_SEP_H

c8_libpayload/pl/include/brfunc_timing.h

@@ -0,0 +1,10 @@
+#ifndef CHECKM8_TOOL_BRFUNC_TIMING_H
+#define CHECKM8_TOOL_BRFUNC_TIMING_H
+
+#include "brfunc_common.h"
+
+#define CLOCK_GATE                  ((BOOTROM_FUNC) ADDR_CLOCK_GATE)
+#define SYSTEM_TIME                 ((BOOTROM_FUNC) ADDR_SYSTEM_TIME)
+#define TIME_HAS_ELAPSED            ((BOOTROM_FUNC) ADDR_TIME_HAS_ELAPSED)
+
+#endif //CHECKM8_TOOL_BRFUNC_TIMING_H

c8_libpayload/pl/include/util.h

@@ -0,0 +1,7 @@
+#ifndef CHECKM8_TOOL_UTIL_H
+#define CHECKM8_TOOL_UTIL_H
+
+#define PAYLOAD_SECTION __attribute__ ((section (".payload_text")))
+#define TEXT_SECTION __attribute__((section (".text")))
+
+#endif //CHECKM8_TOOL_UTIL_H

c8_libpayload/pl/src/aes.c

@@ -0,0 +1,59 @@
+#include "brfunc_aes.h"
+#include "brfunc_timing.h"
+#include "brfunc_sep.h"
+
+#include "util.h"
+
+PAYLOAD_SECTION
+int aes_hw_crypto_command(unsigned int cmd,
+                          void *src,
+                          void *dst,
+                          int len,
+                          unsigned int opts,
+                          void *key,
+                          void *iv)
+{
+    int seeded;
+    long cgvar;
+    long start = 0, timeout = 0;
+
+    __asm__("orr %0, xzr, #0x3c" : "=r" (cgvar));
+    CLOCK_GATE(cgvar, 0);
+
+//    seeded = DPA_SEEDED();
+//    if(!(seeded & 1))
+//    {
+//        SEP_CREATE_SEND_DPA_MESSAGE();
+//        start = SYSTEM_TIME();
+//
+//        while(!(seeded & 1) && !(timeout & 1))
+//        {
+//            seeded = DPA_SEEDED();
+//            timeout = TIME_HAS_ELAPSED(start, 1000);
+//        }
+//    }
+//
+//    if(timeout) return -1;
+
+    unsigned int key_command = CREATE_KEY_COMMAND(0, 0, 0, 0, 1, 0, 0, 0);
+    *rAES_INT_STATUS = 0x20;
+    *rAES_CONTROL = 1;
+
+    PUSH_COMMAND_KEY(key_command, key);
+    PUSH_COMMAND_IV(0, 0, 0, iv);
+    PUSH_COMMAND_DATA(0, 0, src, dst, len);
+    PUSH_COMMAND_FLAG(0, 1, 1);
+    WAIT_FOR_COMMAND_FLAG();
+
+    *rAES_CONTROL = 2;
+    CLOCK_GATE(cgvar, 0);
+    return 0;
+}
+
+TEXT_SECTION
+int _start(void *src,
+           void *dst,
+           void *key)
+{
+    return aes_hw_crypto_command(0, src, dst, 128, 0, key, 0);
+}

c8_libpayload/pl/src/aes_busy.c

@@ -0,0 +1,25 @@
+#include "util.h"
+#include "brfunc_aes.h"
+#include "brfunc_timing.h"
+
+
+TEXT_SECTION
+int _start(void *src, void *dst, void *key, int rep)
+{
+    int i, j;
+    unsigned char src_data[16];
+    for(j = 0; j < 16; j++)
+    {
+        src_data[j] = ((unsigned char *) src)[j];
+    }
+
+//    task_sleep(100);
+    for(i = 0; i < rep; i++)
+    {
+        if(i % 2 == 0) aes_hw_crypto_cmd(16, src_data, dst, 16, 0, key, 0);
+        else aes_hw_crypto_cmd(16, dst, src_data, 16, 0, key, 0);
+ //       task_sleep(15);
+    }
+
+    return 0;
+}

c8_libpayload/pl/src/aes_sw.c

@@ -0,0 +1,182 @@
+#include "util.h"
+#include "brfunc_timing.h"
+
+PAYLOAD_SECTION
+void task_sleep(unsigned int usec)
+{
+    ((BOOTROM_FUNC) ADDR_TASK_SLEEP)(usec);
+}
+
+PAYLOAD_SECTION
+void sub_bytes(unsigned char block[16], unsigned char sbox[16][16])
+{
+    int i;
+    unsigned char val;
+
+    for(i = 0; i < 16; i++)
+    {
+        val = block[i];
+        block[i] = sbox[val >> 4u][val & 0xfu];
+    }
+}
+
+PAYLOAD_SECTION
+void shift_rows(unsigned char block[16])
+{
+    unsigned char temp1, temp2;
+
+    temp1 = block[0x1];
+    block[0x1] = block[0x5];
+    block[0x5] = block[0x9];
+    block[0x9] = block[0xd];
+    block[0xd] = temp1;
+
+    temp1 = block[0x2];
+    temp2 = block[0xe];
+    block[0x2] = block[0xa];
+    block[0xe] = block[0x6];
+    block[0xa] = temp1;
+    block[0x6] = temp2;
+
+    temp1 = block[0x3];
+    block[0x3] = block[0xf];
+    block[0xf] = block[0xb];
+    block[0xb] = block[0x7];
+    block[0x7] = temp1;
+}
+
+PAYLOAD_SECTION
+void mix_cols(unsigned char block[16],
+              unsigned char mul2_lookup[256], unsigned char mul3_lookup[256])
+{
+    unsigned char r0, r1, r2, r3;
+    int i;
+
+    for(i = 0; i < 4; i++)
+    {
+        r0 = block[4 * i];
+        r1 = block[4 * i + 1];
+        r2 = block[4 * i + 2];
+        r3 = block[4 * i + 3];
+
+        // no reason for the "+ 0" here but it makes the code look more lined up :)
+        block[4 * i + 0] = mul2_lookup[r0] ^ mul3_lookup[r1] ^ r2 ^ r3;
+        block[4 * i + 1] = r0 ^ mul2_lookup[r1] ^ mul3_lookup[r2] ^ r3;
+        block[4 * i + 2] = r0 ^ r1 ^ mul2_lookup[r2] ^ mul3_lookup[r3];
+        block[4 * i + 3] = mul3_lookup[r0] ^ r1 ^ r2 ^ mul2_lookup[r3];
+    }
+}
+
+PAYLOAD_SECTION
+void add_key(unsigned char block[16], unsigned char key[16])
+{
+    int i;
+    for(i = 0; i < 16; i++)
+    {
+        block[i] = block[i] ^ key[i];
+    }
+}
+
+PAYLOAD_SECTION
+void expand_key(unsigned char key[16], unsigned char key_sched[176], int n,
+                unsigned char sbox[16][16], unsigned char rc_lookup[11])
+{
+    int i, j, prev_key_base, key_base = 0;
+    unsigned char val;
+    for(i = 0; i < 16; i++)
+    {
+        key_sched[i] = key[i];
+    }
+
+    for(i = 1; i < n; i++)
+    {
+        prev_key_base = key_base;
+        key_base = 16 * i;
+
+        for(j = 0; j < 3; j++)
+        {
+            val = key_sched[prev_key_base + 13 + j];
+            key_sched[key_base + j] = sbox[val >> 4u][val & 0xfu];
+        }
+
+        val = key_sched[prev_key_base + 12];
+        key_sched[key_base + 3] = sbox[val >> 4u][val & 0xfu];
+
+        key_sched[key_base] ^= rc_lookup[i - 1];
+
+        for(j = 0; j < 4; j++)
+        {
+            key_sched[key_base + j] = key_sched[key_base + j] ^ key_sched[prev_key_base + j];
+        }
+
+        for(j = 4; j < 16; j++)
+        {
+            key_sched[key_base + j] = key_sched[key_base + j - 4] ^ key_sched[prev_key_base + j];
+        }
+    }
+}
+
+PAYLOAD_SECTION
+void aes128_encrypt_ecb(unsigned char *msg, unsigned int msg_len, unsigned char key[16],
+                        unsigned char sbox[16][16], unsigned char rc_lookup[11],
+                        unsigned char mul2[256], unsigned char mul3[256])
+{
+    unsigned char key_sched[176];
+    expand_key(key, key_sched, 11, sbox, rc_lookup);
+
+    unsigned int num_blocks = msg_len / 16;
+    unsigned char *block;
+
+    unsigned int i, j;
+    for(i = 0; i < num_blocks; i++)
+    {
+        block = &msg[16 * i];
+        add_key(block, key_sched);
+
+        for(j = 0; j < 9; j++)
+        {
+            sub_bytes(block, sbox);
+            shift_rows(block);
+            mix_cols(block, mul2, mul3);
+            add_key(block, &key_sched[16 * (j + 1)]);
+            task_sleep(20);
+        }
+
+        sub_bytes(block, sbox);
+        shift_rows(block);
+        add_key(block, &key_sched[16 * (j + 1)]);
+    }
+}
+
+TEXT_SECTION
+unsigned int _start(unsigned char *msg, unsigned int msg_len, unsigned char *key,
+                    unsigned char sbox[16][16], unsigned char rc_lookup[11],
+                    unsigned char mul2[256], unsigned char mul3[256])
+{
+    unsigned long long start, end;
+
+    __asm__ volatile ("mrs %0, cntpct_el0" : "=r" (start));
+    aes128_encrypt_ecb(msg, msg_len, key, sbox, rc_lookup, mul2, mul3);
+    __asm__ volatile ("mrs %0, cntpct_el0" : "=r" (end));
+
+//    for(i = 0; i < 256; i++)
+//    {
+//        __asm__ volatile ("dc civac, %0" : : "r" (&sbox[i % 16][i / 16]) : "memory");
+//        __asm__ volatile ("dc civac, %0" : : "r" (&mul2[i]) : "memory");
+//        __asm__ volatile ("dc civac, %0" : : "r" (&mul3[i]) : "memory");
+//    }
+//
+//    for(i = 0; i < 16; i++)
+//    {
+//        __asm__ volatile ("dc civac, %0" : : "r" (&msg[i]) : "memory");
+//        __asm__ volatile ("dc civac, %0" : : "r" (&key[i]) : "memory");
+//    }
+//
+//    for(i = 0; i < 12; i++)
+//    {
+//        __asm__ volatile ("dc civac, %0" : : "r" (&rc_lookup[i]) : "memory");
+//    }
+//
+//    __asm__ volatile ("dsb sy");
+    return end - start;
+}

c8_libpayload/pl/src/sync.c

@@ -0,0 +1,10 @@
+#include "util.h"
+
+TEXT_SECTION
+void _start()
+{
+    __asm__("dmb sy");
+    __asm__("ic iallu");
+    __asm__("dsb sy");
+    __asm__("isb");
+}

c8_libpayload/pl/src/sysreg.c

@@ -0,0 +1,17 @@
+#include "util.h"
+
+struct sysregs
+{
+    long pt_base;
+    long evt_base;
+};
+
+TEXT_SECTION
+long long _start()
+{
+    struct sysregs res;
+    __asm__("mrs %0, ttbr0_el1" : "=r" (res.pt_base));
+    __asm__("mrs %0, vbar_el1"  : "=r" (res.evt_base));
+
+    return res.pt_base;
+}

c8_libpayload/pl/src/task_sleep_test.c

@@ -0,0 +1,20 @@
+#include "util.h"
+#include "brfunc_common.h"
+
+PAYLOAD_SECTION
+void task_sleep(unsigned int usec)
+{
+    ((BOOTROM_FUNC) ADDR_TASK_SLEEP)(usec);
+}
+
+TEXT_SECTION
+unsigned long long _start(unsigned int usec)
+{
+    unsigned long long start, end;
+
+    __asm__ volatile ("mrs %0, cntpct_el0" : "=r" (start));
+    task_sleep(usec);
+    __asm__ volatile ("mrs %0, cntpct_el0" : "=r" (end));
+
+    return end - start;
+}