Core Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous System
summary
Shows a concrete cross‑core escalation chain that wins full SoC control: abusing ion buffer ID reuse and SL interfaces to map attacker pages into TrustZone, using DMA/mailbox/shared memory bugs to run code on IMCU, pivoting IMCU to LPMCU pivot to dump encrypted bootrom, then patching BL31 via LPMCU DMA to install an RWX SMC handler and build a decryption oracle for Kirin 9000. Demonstrates a universal ISP exploit that bypasses lockscreen and reports the method is reliable and repeatable.
AI-written summary · about
chapters (13)
- 0:00Core Escalation research
- 3:20Cross-core privilege escalation
- 9:23Memory management in TEUS
- 12:37IMCU as secure master core
- 15:05Pivoting to LPMCU
- 17:10Highest SoC privilege
- 19:19Core escalation steps
- 20:24Cross-core attack surfaces
- 25:29ISP core example
- 27:17Mitigations and CFG bus
- 30:30ISP exploit demo
- 32:32Secure world design implications
- 33:16Acknowledgments and Q&A
related talks
51mExploiting Hardware Glitches And Side Channels In Perfect Software
48mEverybody be Cool, This is a Robbery!
36mOut Of The Box Exploitation Breaking The Trust Chain Of The Ethereum Phone
39mReflections on Trusting TrustZone
27mCLKSCREW: Exposing the Perils of Security-Oblivious Energy Management
33mHacking in Darkness: Return-oriented Programming against Secure Enclaves
57mExtreme Privilege Escalation on Windows 8/UEFI Systems
22mUnearthing the TrustedCore: A Critical Review on Huawei’s Trusted Execution Environment