Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Method of Attack, Physical Access Attacker has physical possession of the device Many devices are small and portable Assume that attacker has only external access Short access time Lacks knowledge about internals Attack through external interface Normal user interface USB, SD card interface Slides created by: Professor Ian G. Harris Physical Access Attacks Attacker can do what user can do Read numbers from a phone Examine digital pictures, etc. USB/SD card allows large, fast data theft USB may be “bootable” Device may automatically run code on USB key Attacker can rewrite Flash memory Install arbitrary malware Slides created by: Professor Ian G. Harris Defenses Against Physical Attacks Do not lose physical control of your device Enable password protection on the device Can be inconvenient Slides created by: Professor Ian G. Harris Intrusive Physical Attacks Attacker gains extended physical access to the device Attacker knows about the design of the device Attacker opens the device and accesses internal signals Requires unusual sophistication Normal users do not need to worry Slides created by: Professor Ian G. Harris Reading Internal Signals CPU RAM Logic Analyzer Attacker can view data transferred between ICs Intellectual property (songs, videos, etc.) Secret keys, etc. Slides created by: Professor Ian G. Harris Reading Internal Signals, Defenses Encrypt all data in transit between ICs Expensive and time consuming Make device tamper-proof Very expensive Use internal board layers for routing Layers can be sanded down Epoxy over ICs to hide part numbers Epoxy is removable Slides created by: Professor Ian G. Harris Reprogramming FLASH Memory CPU Flash JTAG Attacker can reprogram the entire device though its JTAG interface Slides created by: Professor Ian G. Harris Reprogramming FLASH Defenses Make flash unprogrammable Blow an internal fuse Updates become impossible Require secret key to access JTAG Costly Slides created by: Professor Ian G. Harris “Super” Intrusive Attacks Attacker gains access to the design of the ICs inside the device Requires time, knowledge, and access Only large organizations could launch this type of attack Slides created by: Professor Ian G. Harris Hardware Trojans CPU ASIC Trojan Trojan Attacker modifies IC design before fabrication Spy at the design and/or fabrication site IC includes altered functionality Slides created by: Professor Ian G. Harris Side-Channel Attacks Examine “information leakage” via power and delay analysis if (key[I]) then { . . . } If key[i] == 1 then power will be higher and delay will be longer Requires precise knowledge of IC algorithm and implementation Slides created by: Professor Ian G. Harris IP Watermarking Attacker steals IP design and sells it as his own Need to prove that a stolen design is actually stolen Insert “markers” into the design which can be recognized later Add extra logic that has no real function Markers must not be apparent to the attacker Slides created by: Professor Ian G. Harris ATmega Assembly a = b + c; Compiler lw $r1, ($s1) lw $r2, ($s2) add $r3, $r2, $r1 sw $r3, ($s3) Load b from memory Load c from memory Add b and c Store result a in memory Assembler 10010001000000110000001000000001 add $r3 $r2 Slides created by: Professor Ian G. Harris $r1 Assembly Instructions Assembly instructions are a readable mnemonic for machine instructions One-to-one mapping from assembly instructions to machine instructions • Except macros ADD R0, R1 0000110000000001 Slides created by: Professor Ian G. Harris ATmega Instruction Formats ADD instruction Rd <- Rd + Rr OOOO11RDDDDDRRRR 16-bit machine instructions 6-bit opcode 2 5-bit register arguments (32 registers) Direct Register Addressing mode used Slides created by: Professor Ian G. Harris Instruction Format, 1 register ANDI instruction Rd <- Rd && K 0111KKKKDDDDKKKK 4-bit opcode 1 4-bit register argument (only 16 registers) 8-bit constant Slides created by: Professor Ian G. Harris Instruction Format, 1 register ASR (arithmetic shift right) instruction Rd <- Rd >> 1 1001010DDDDD0101 11-bit opcode 1 5-bit register argument Slides created by: Professor Ian G. Harris Instruction Format, Branch BREQ (branch if equal) instruction Z == 1 then PC <- PC + K + 1 111100KKKKKKK001 Assumes that comparison (sub) already performed 9-bit opcode 11 constant, PC offset addressing Branch distance is limited Slides created by: Professor Ian G. Harris Assembly Code Structure An input line may take one of the four following forms: 1. [label:] directive [operands] [Comment] 2. [label:] instruction [operands] [Comment] 3. Comment 4. Empty line Label is an alias for a line of code • Used for jumps/branches Slides created by: Professor Ian G. Harris Example Assembly Program label: .EQU var1=100 ; Set var1 to 100 (Directive) .EQU var2=200 ; Set var2 to 200 test: rjmp test ; Infinite loop (Instruction) ; Pure comment line .EQU assigns a string to a constant Semicolon (;) sets off comments Slides created by: Professor Ian G. Harris Some Arithmetic Operations Some instructions take immediate (constant) arguments Some instructions use carry from previous operations Slides created by: Professor Ian G. Harris Some Logical Operations Logical operations are bitwise Some instructions take only one argument Slides created by: Professor Ian G. Harris Accessing Registers/Memory All registers are memory mapped Special instructions are used to access non-register memory Slides created by: Professor Ian G. Harris General Purpose Registers General-purpose registers are written using: • LDI - Load Immediate LDI R16, 0xFF R16 <- 0xFF • MOV - Copy Register MOV R0, R1 R0 <- R1 • SBR - Set Bits in Register SBR R0, 0xFF R0 <- R0 | 0xFF • CBR - Clear Bits in Register CBR R0, 0xAA R0 <- R0 & (0xFF - 0xAA) Slides created by: Professor Ian G. Harris LDI Instruction LDI Rd, K 8-bits for the immediate, K 4-bits for the register, Rd Can only access 16 registers (R16 - R31) SBR and CBR have the same limitation Slides created by: Professor Ian G. Harris MOV Instruction MOV Rd, Rr 5-bits for each register, can access all registers Can move from high regs to low regs Slides created by: Professor Ian G. Harris I/O Registers I/O registers are written/read using: • IN - In Port IN R0, PORTB R0 <- PINB • OUT - Out Port OUT R0, PORTB PORTB <- R0 • SBI - Set Bit in I/O Register SBI PORTB, 3 PORTB <- PORTB | 1<<3 • CBI - Clear Bits in I/O Register CBI PORTB, 3 PORTB <- PORTB & !(1<<3) Slides created by: Professor Ian G. Harris SBI Instruction SBI A, b 5 bits specify register, 3 bits specify bit to set Slides created by: Professor Ian G. Harris Addressing SRAM (Ext. I/O) •Instructions are 16-bits long •SRAM addresses are 16-bits long •Address cannot fit in the instruction •Memory addresses are stored in special-purpose registers •X, Y, and Z registers are each 2 bytes •LD, ST instructions are used to access SRAM Slides created by: Professor Ian G. Harris Data Indirect Addressing LDI XH HIGH(0x01A8) LDI XL HIGH(0x01A8) LD R0, X ST X, R0 •Registers X, Y, and Z can be used to address SRAM •XH (YH, ZH) and XL (YL, ZL) are low and high bytes Slides created by: Professor Ian G. Harris Branching PC typically advances by 2 after each instruction • Instructions are 2 bytes long Branching changes the PC counter to a new location Unconditional Branches always occur Conditional Branches occur only if a condition is true Needed to implement conditional control flow (if, then) and loops (while, for, etc.) Labels are used to name branch destination Slides created by: Professor Ian G. Harris Unconditional Branching JMP k 32-bit instruction Need 22-bits to address 4M memory space Assembler substitutes label with address Slides created by: Professor Ian G. Harris Relative Jump (RJMP) RJMP k Only 16-bit instruction, address is 12 bits long (4K range) PC relative addressing used • Destination is PC + k + 1 Restricted to close jumps (+/- 2K) Not usually a problem (especially on small processors) Slides created by: Professor Ian G. Harris Conditional Branches Branch occurs is appropriate condition is satisfied Conditions depend on results of previous arithmetic operations ADD R0, R1 BRVS dest . . dest: ADD R2, R3 BRVS is Branch is Overflow is Set Branch occurs if previous addition resulted in overflow Slides created by: Professor Ian G. Harris Status Register (SREG) SREG contains information about the results of arithmetic/logic operations Bit 5 – H: Half Carry Flag Bit 4 – S: Sign Bit, S = N ⊕ V Bit 3 – V: Two’s Complement Overflow Flag Bit 2 – N: Negative Flag Bit 1 – Z: Zero Flag Bit 0 – C: Carry Flag Slides created by: Professor Ian G. Harris Conditional Branch Instructions Test indicates the relationship between operands Boolean shows values in SREG Slides created by: Professor Ian G. Harris Branch Conditions SREG must be set before conditional branch instruction C code example: if x < y then x++; else y++; Assume x is in R0 and y is in R1 CP R0, R1 BRLT then else: INC R1 RJMP done then: INC R0 done: … Compare operation, CP, used to set SREG • Does not affect other regs Slides created by: Professor Ian G. Harris Skip Instructions “Skip” instructions skip the next instruction if a condition is satisfied Can be used as a mini conditional branch SBRC - Skip if bit in register is cleared (0) SBRS R0, 0 INC R0 Rounds R0 up to nearest even number Slides created by: Professor Ian G. Harris Subroutines RCALL k calls a subroutine starting at label k • PC + 1 is pushed onto the stack RET returns from a subroutine • PC is popped off of the stack No other calling procedures are followed • Registers are not pushed/popped • Arguments are not pushed/popped • No local vars allocated on stack Slides created by: Professor Ian G. Harris Using the Stack PUSH Rd places contents of Rd on the stack Decrements stack pointer (SP) POP Rd places contents of stack in Rd • Increments (SP) SP must be initialized to top of SRAM, RAMEND LDI OUT LDI OUT R0, LOW(RAMEND) SPL, R0 R0, HIGH(RAMEND) SPH, R0 Slides created by: Professor Ian G. Harris Assembler Directives Assembler directives give commands to the assembler Do not generate machine code instructions .DSEG var1: .byte 1 var2: .byte 2 .CSEG ldi XL, LOW(var1) ldi XH, HIGH(var1) ld R0, X .DSEG declares data segment • Placed in SRAM .CSEG declares code segment • Placed in FLASH .BYTE allocates space • Only in data segment Slides created by: Professor Ian G. Harris EEPROM Segment .ESEG eeconsts:.db 0xff, 0x11 .CSEG fconsts: .dw 0xffff .ESEG declares initialized data in EEPROM .DB declares a data byte in program memory (CSEG) or EEPROM (ESEG) .DW declares a word (16-bits) in CSEG or ESEG Slides created by: Professor Ian G. Harris Other Assembler Directives .DEF <symbol>=R<n> Define a symbol to refer to a register Ex. .DEF i=R9 Placement in file should precede first use .UNDEF undefines the symbol .EQU <constant>=<expression> Define a constant to refer to a constant value Ex. .EQU ZERO = 0 Constant cannot be redefined or undefined .SET <variable>=<expression> Same as .EQU except variables can be changed later Slides created by: Professor Ian G. Harris