Completed
Arbitrary TZ Code Execution
Class Central Classrooms beta
YouTube playlists curated by Class Central.
Classroom Contents
Reflections on Trusting TrustZone
Automatically move to the next video in the Classroom when playback concludes
- 1 Intro
- 2 What is TrustZone?
- 3 TrustZone Architecture
- 4 Real-World Uses
- 5 Prior Work
- 6 Motivation
- 7 Toolchain
- 8 Attack Surface
- 9 Attacker Assumptions
- 10 QSEE SCM Interface
- 11 SCM Call-by-Register Convention
- 12 SCM Command Structures
- 13 Structure Sanity Checking
- 14 Secure Memory Checking Pseudocode
- 15 Review: Integer Overflow
- 16 Integer Overflow Vulnerability
- 17 Pathological Command Buffer
- 18 What is Written to Response Header?
- 19 Sorcery!
- 20 Building Better Primitives
- 21 Choosing A New Write Primitive
- 22 SMC Handler Table
- 23 SMC Table Extension Attack
- 24 Arbitrary TZ Code Execution
- 25 Lessons Learned
