quarkslab/titanm

Stars
181
Rank 212,110 (Top 5 %)
Language
C
License
Apache License 2.0
Created about 3 years ago
Updated about 2 years ago

quarkslab/titanm

quarkslab

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

This repository contains the tools we used in our research on the Google Titan M chip

Titan M tools

In this repository, we publish the tools we used in our research on the Google Titan M chip.

We presented our results at Black Hat EU 21 and at the ROOTS workshop within DeepSec.

citadelimgloader: the Ghidra loader for Titan M firmware files
nugget_toolkit: the set of tools to trace messages and communicate with the chip (including an exploit for a known vulnerability and a fuzzer)
bin2rec: a set of scripts used to convert firmware files into rec files that can be used with the SPI rescue feature
BHEU_2021: the materials of our presentation at BlackHat Europe 2021 (the slides and the white paper)
BHUSA_2022: the materials of our presentation at BlackHat USA 2022

NOTE

This project uses submodules. So after cloning the repository, do not forget to run:

$ git submodule update --init --recursive

binbloom

Raw binary firmware analysis software

kdigger

Kubernetes focused container assessment and context discovery tool for penetration testing

quarkspwdump

Dump various types of Windows credentials without injecting in any process.

rewind

Snapshot-based coverage-guided windows kernel fuzzer

arybo

Manipulation, canonicalization and identification of mixed boolean-arithmetic symbolic expressions

irma

IRMA is an asynchronous & customizable analysis system for suspicious files.

conf-presentations

Quarkslab conference talks

dreamboot

binmap

legu_unpacker_2019

Scripts to unpack APK protected by Legu

AERoot

AERoot is a command line tool that allows you to give root privileges on-the-fly to any process running on the Android emulator with Google Play flavors AVDs.

android-restriction-bypass

PoC to bypass Android restrictions

peetch

An eBPF playground

qbindiff

Quarkslab Bindiffer but not only !

quokka

Quokka: A Fast and Accurate Binary Exporter

NFLlib

NTT-based Fast Lattice library

pastis

PASTIS: Collaborative Fuzzing Framework

samsung-trustzone-research

Reverse-engineering tools and exploits for Samsung's implementation of TrustZone

qsynthesis

Greybox Synthesizer geared for deobfuscation of assembly instructions.

pyrrha

A tool for firmware cartography

llvm-passes

Collection of various llvm passes

qb-sync

qb-sync is an open source tool to add some helpful glue between IDA Pro and Windbg. Its core feature is to dynamically synchronize IDA's graph windows with Windbg's position.

starlink-tools

A collection of tools for security research on Starlink's User Terminal

LLDBagility

A tool for debugging macOS virtual machines

tritondse

Triton-based DSE library with loading and exploration capabilities (and more!)

sspam

Symbolic Simplification with PAttern Matching

android-fuzzing

CVE-2020-0069_poc

minik8s-ctf

A beginner-friendly CTF about Kubernetes security.

QBDL

QuarkslaB Dynamic Linker library

iMITMProtect

Prevent Apple to mess with keys

whvp

PoC for a snapshot-based coverage-guided fuzzer targeting Windows kernel components

mattermost-plugin-e2ee

End-to-end encryption plugin for Mattermost

aosp_dataset

Large Commit Precise Vulnerability Dataset based on AOSP CVE

llvm-dev-meeting-tutorial-2015

Material for an LLVM Tutorial presented at LLVM Dev Meeting 2015

dxfx

DxFx is a proof-of-concept DJI Pilot unpacker

irma-probe

irma-frontend

irma-ansible-old

libleeloo

Library to manage big sets of integers (and IPv4 ranges)

sboot-binwalk

irma-brain

nodescan

Asynchronous scanning library

pixiefail

PoC for PixieFail vulnerabilities

python-binexport

Python interface for Binexport, the Bindiff export format

numbat

Library to manipulate and create Sourcetrail databases

bgraph

BGraph is a tool designed to generate dependencies graphs from Android.bp soong files.

training_ecu

Hardware and software for the ECU we use during trainings

dataset-call-graph-blogpost-material

idascript

Utilities scripts and Python module to facilitate executing idapython scripts in IDA.

python-bindiff

Python module wrapping Bindiff usage into a Python API.

BVWhiteBox

This PoC illustrates our work on asymmetric white-box cryptography, it can be used to generate a set of lookup tables used for lattice-based white-box scheme

tpmee

nvidia-ngx-wrapper

sstic-tame-the-qemu

ip_conv_sse

crypto-condor

crypto-condor is a Python library for compliance testing of implementations of cryptographic primitives

qsig

QSig: Patch signature generation - detection tool

linksys-wag200G

Some binaries and tools for the Linksys WAG200N router

windbg-vtl

JavaScript debugger extension for WinDbg that allows to dump the partitions running on Hyper-V

keyringer

Fork of keyringer from https://keyringer.pw (added some features like tree view, additional checks, ...)

irma-common

ansible-selenium-server

a Vagrant VM using Ansible to provide a Selenium Server

irmacl

irma api command line client

land_of_cxx

hooking-golang-playground

Various experiments with golang internals

erlang-prism

PRISM is a disassembler for Erlang BEAM virtual machine bytecode

qb.backup

The server-side script of the qb.backup orchestration solution.

wirego

wdnis_tool

diffing-portal

Static site for diffing portal

Jupyter Notebook

ziphyr

On-the-fly zip of streamed file with optional zipcrypto.

python-zipstream

forked from allanlei/python-zipstream

ansible-playbook-qb.backup

An example Ansible playbook deploying the roles qb.backup and qb.backup_server.

irma-web-ui

IRMA Web User Interface

irma-probe-tutorial

irmacl-async

Asynchronous client library for IRMA API

can-workshop

Files for the Grehack 2021 workshop: Revers3 me if you CAN