PicoDMA: DMA Attacks at Your Fingertips
summary
A pocket-sized M.2 implant built from the $220 PicoEVB FPGA and a Pycom radio performs remote DMA: it executes 64-bit streaming reads and writes, an FPGA-accelerated memory search and PCILeech-compatible memory patching. The prototype fits M.2 2230/E slots, sustains reliable SPI comms in thousands of trials with zero failures in demo runs, loads a kernel-mode implant over the link and successfully extracts credentials from an air-gapped Ubuntu 16.04 box.
AI-written summary · about
chapters (24)
- 0:00Introduction and agenda
- 1:13DMA attack overview
- 1:55Previous DMA research
- 3:56USB and wireless implants
- 5:39Forensics and case study
- 7:07Project goals and Pico DMA
- 8:36Deployment scenarios
- 10:52Advantages of wireless access
- 11:51Pico EVB platform
- 13:13Engineering challenges
- 15:18PCI Express fundamentals
- 19:44PCI TLP structure
- 23:31FPGA concepts and tools
- 29:01FPGA debugging techniques
- 31:53SPI interface implementation
- 34:21FPGA state machines
- 37:28Design challenges and bugs
- 39:52Microcontroller integration
- 40:28MicroPython constraints
- 41:45Radio software stack
- 42:59Wiring and deployment
- 44:12Live demo
- 47:02Kernel implant execution
- 48:33Conclusions and Q&A
related talks
30mAffordable EMFI Attacks Against Modern IoT Chips
38mHow to Hack Any Micro-controller with a Raspberry Pi Pico…
55mReliable and Secure Embedded Systems
43mLessons Learnt from Reusing QDMA NIC to Base Band PMD
43mThe Tao of Hardware the Te of Implants
32mFrom UART to PCIe and DMA: Selecting Connectivity for Your FPGA-based Subsystem
48mInternet of Programmable Things
40mBiohacking: The Invisible Threat