PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Deep Dive Into Samsung's TrustZone (Part 1)

blog.quarkslab.com | research | #reverse-engineering | #arm | #tee | #samsung | #trustzone | #kinibi
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part one of a three-part series touring Samsung's TrustZone implementation (with Trustonic/Kinibi): its components, how they interact, and the TEE security model on Galaxy S6-S9 devices.
Published
Collected

Related coverage

research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 3)
Part three of the Samsung TrustZone series: the vulnerabilities found in Secure World components (Kinibi trustlets) and how they were exploited to reach code execution in EL3 on Galaxy devices.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 2)
Part two of the Samsung TrustZone series introduces the toolset built for the research: Ghidra/IDA loaders for MCLF and SBOOT, a trustlet communication framework, an AFL/Unicorn fuzzer and more.
research · blog.quarkslab.com
Attacking the ARM's TrustZone
Second TrustZone post: a technical view of the attack surface — monitor message handlers, trustlets and Secure Boot — and what code execution at each privilege level enables.
research · blog.quarkslab.com
Introduction to Trusted Execution Environment: ARM's TrustZone
First of two posts on hardware TEEs: introduces Trusted Execution Environments, then ARM TrustZone — Secure and Non-Secure worlds, monitor mode, and trustlet-based trusted applications.
blog · projectzero.google
Trust Issues: Exploiting TrustZone TEEs
A Project Zero post on exploiting TrustZone-based TEEs, examining how sensitive data like biometrics and keys are protected and where these trusted environments fail.
research · blog.quarkslab.com
Reverse Engineering Samsung S6 SBOOT - Part II
Part two of the Samsung S6 SBOOT reverse engineering series: two techniques for locating Trustonic's TEE (t-base) inside the proprietary bootloader blob, continuing the path toward the TEE OS.
Back