# 055 - Stacks Of Bricked Chips

Page: https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/055-stacks-of-bricked-chips
Text version: https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/055-stacks-of-bricked-chips.md
Podcast: [Unnamed Reverse Engineering Podcast](https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753)
Published: 2022-03-13T18:27:23+00:00
Episode link: https://unnamedre.com/episode/55
Audio file: https://traffic.libsyn.com/secure/reverseengineering/055_-_Stacks_Of_Bricked_Chips.mp3?dest-id=552832
Processing state: processed
JSON: https://stenobird.com/v1/public/podcasts/unnamed-reverse-engineering-podcast-752753/episodes/055-stacks-of-bricked-chips
Duration seconds: 3717

## Resource

Laura Abbott from Oxide Computer details her discovery of a privilege escalation vulnerability in NXP's Arm TrustZone-M implementation. The discussion covers the technical process of reverse engineering ROM patches and the challenges of coordinated disclosure with hardware vendors.

## Highlights
- Main idea: Vulnerabilities in hardware ROM patches can break the fundamental security assumptions of Arm TrustZone-M
- Practical takeaway: Using Ghidra and SVD loaders can help reconstruct hardware register access during reverse engineering
- Failure mode: Relying on vendor-provided security settings without verifying the underlying hardware implementation can lead to broken trust chains
- Technical insight: Code golfing Arm assembly is a useful technique for developing minimal, impactful proofs of concept
- Lesson learned: Documentation, including obscure spreadsheets attached to PDFs, is often the most undervalued tool in a researcher's arsenal

## Topics

Reverse Engineering, Arm TrustZone-M, NXP Semiconductors, Ghidra, Rust Programming, Linux Kernel, Hardware Security, Privilege Escalation, Firmware Analysis

## Chapters
- 1:00 — The Future of Systems Programming: A discussion on the transition from C to Rust in kernel development and the promise of memory-safe languages for microcontrollers.
- 6:00 — Establishing a Root of Trust: Exploring the difficulty of verifying exactly what software is running on a system and building a verifiable chain of trust.
- 10:00 — Reverse Engineering with Ghidra: How the researcher utilized Ghidra and existing projects to begin analyzing hardware firmware.
- 15:00 — Analyzing the ROM Patch: A deep dive into reviewing the ROM patch functionality and identifying potential bugs in the immutable code.
- 24:00 — Demonstrating Privilege Escalation: The process of creating a proof of concept to show the ability to read secure registers from a non-secure state.
- 29:00 — Code Golfing for Exploitation: Using minimal instruction sets to demonstrate the bypass of hardware security boundaries.
- 38:00 — Tooling and Research Methodology: Discussing the use of SVD loaders, register allocation, and the importance of technical documentation.

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/unnamed-reverse-engineering-podcast-752753/episodes/055-stacks-of-bricked-chips/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/unnamed-reverse-engineering-podcast-752753/055-stacks-of-bricked-chips.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.