PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Introduction to Trusted Execution Environment: ARM's TrustZone

blog.quarkslab.com | research | #reverse-engineering | #mobile-security | #arm | #tee | #trustlet | #trustzone
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

First of two posts on hardware TEEs: introduces Trusted Execution Environments, then ARM TrustZone — Secure and Non-Secure worlds, monitor mode, and trustlet-based trusted applications.
Published
Collected

Related coverage

blog · projectzero.google
Trust Issues: Exploiting TrustZone TEEs
A Project Zero post on exploiting TrustZone-based TEEs, examining how sensitive data like biometrics and keys are protected and where these trusted environments fail.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 1)
Part one of a three-part series touring Samsung's TrustZone implementation (with Trustonic/Kinibi): its components, how they interact, and the TEE security model on Galaxy S6-S9 devices.
research · blog.quarkslab.com
Attacking the ARM's TrustZone
Second TrustZone post: a technical view of the attack surface — monitor message handlers, trustlets and Secure Boot — and what code execution at each privilege level enables.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 3)
Part three of the Samsung TrustZone series: the vulnerabilities found in Secure World components (Kinibi trustlets) and how they were exploited to reach code execution in EL3 on Galaxy devices.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 2)
Part two of the Samsung TrustZone series introduces the toolset built for the research: Ghidra/IDA loaders for MCLF and SBOOT, a trustlet communication framework, an AFL/Unicorn fuzzer and more.
research · blog.quarkslab.com
Recovering an ECU firmware using disassembler and branches
How Quarkslab recovered erased firmware from a fleet-sharing ECU: using the Capstone disassembler and branch analysis to locate scattered code fragments and enable reverse engineering.
Back