7th Workshop on System Software for Trusted Execution (SysTEX 2024)

SyncEmu: Enabling Dynamic Analysis ofStateful Trusted Applications
Christian Lindenmeier1, Matti Schulze1, Jonas Röckl1, Marcel Busch2
Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), Germany
2
École Polytechnique Fédérale de Lausanne (EPFL), Switzerland
1

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

1

TEEs on COTS Android Mobile Devices
Smartphone landscapeRich Execution Environment (REE)

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

Trusted Execution Environment (TEE)

July 8, 2024

2

TEEs on COTS Android Mobile Devices
Software components on COTS smartphones

Secure World (SW)

Normal World (NW)

Client Applications (CAs)e.g., keystore-daemon
N-EL0

IPC

Trusted Applications (TAs)e.g., keystoreTA
S-EL0

shm

N-EL1
TEE Driver

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

SMC

S-EL1 / EL3
Secure Monitor / TrustZone OS

July 8, 2024

3

SyncEmu: Enabling Dynamic Analysis of Stateful Trusted Applications
Motivation●Problem: TrustZone firmware has vulnerabilities1
Multiple reasons: complex attacker model, large TCB, memory unsafe languages,…

1

Cerdeira, D., Santos, N., Fonseca, P., & Pinto, S. (2020, May). Sok: Understanding the prevailing security vulnerabilities intrustzone-assisted tee systems. In 2020 IEEE Symposium on Security and Privacy
Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

4

SyncEmu: Enabling Dynamic Analysis of Stateful Trusted Applications
Motivation●Problem: TrustZone firmware has vulnerabilities1
Multiple reasons: complex attacker model, large TCB, memory unsafe languages,…

●Static analysis is cumbersome and limited
Multiple reasons: closed-source binaries,...

→ We need a way to dynamically analyze COTS TrustZone firmware

1Cerdeira, D., Santos, N., Fonseca, P., & Pinto, S. (2020, May). Sok: Understanding the prevailing security vulnerabilities intrustzone-assisted tee systems. In 2020 IEEE Symposium on Security and Privacy
Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 20245

Challenges in Analyzing Trusted Applications
Access to COTS smartphones is locked down

Challenge #1 – Limited Introspection●Locked-down nature of COTS smartphones●No accessible debug interfaces●TrustZone extensions prevent memory introspection→ On-device dynamic analysis not feasible●

Previous work limited e.g., black-box fuzzing2

2Busch, M., Machiry, A., Spensky, C., Vigna, G., Kruegel, C., & Payer, M. (2023, May). Teezz: Fuzzing trusted applications on cots android
devices. In 2023 IEEE Symposium on Security and Privacy
Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

6

Challenge #1 – SyncEmu’s Approach
Rehosting TrustZone OS Firmware

CAsTAsAndroidTZOS

Rehosting: We execute the targeted softwarein an emulated environment which mimics(necessary parts of) the original device→ Only rehost TZOS and TAs

MemoryChristian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

7

Challenge #1 – SyncEmu’s Approach
Rehosting TrustZone OS Firmware

CAs

TAs

AndroidTZOS

Rehosting: We execute the targeted softwarein an emulated environment which mimics(necessary parts of) the original device→ Only rehost TZOS and TAs
Challenges:●
Unknown physical memory map●●MemoryTAs●TZOS

Missing peripherals
Proprietary and complex hardware (fingerprintsensor, crypto cells)Intertwined software components

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 20248

SyncEmu’s Rehosting Framework
OverviewTAs
SharedMemory

Identify main dependencies
TZOS●

Breakpoint hooks●Secure Monitor Callbacks
Peripheral Callbacks
Minimal Bootloader●Bootloader Emulation
Mimic bootloader stages

Secure Monitor Emulation
Handle SMCs
Hardware Emulation
Handle MMIO accesses

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

9SyncEmu’s Rehosting Framework
Overview

TAs
SharedMemoryIdentify main dependencies
TZOS●

Bootloader Emulation
Mimic bootloader stages

Iterative
Refinement

Breakpoint hooks●

Secure Monitor Callbacks
Peripheral Callbacks
Minimal Bootloader

Analyze

Run●

Secure Monitor Emulation
Handle SMCs
Hardware Emulation
Handle MMIO accesses

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

RepeatFixJuly 8, 2024

10

Challenges in Analyzing Trusted Applications
Execution of CAs and TAs is intertwined

Challenge #2 – Complex CA-TA Protocols●

GlobalPlatform defines interfaces for TAs●

Custom protocols depending on use case of TA●TA execution is highly stateful●

Previous work tried emulating NW components3

CATA
InitializeContext()
OpenSession()
InvokeCommand(A)Custom Protocol

InvokeCommand(Z)→ Rehosting NW is not feasible

CloseSession()

3Harrison, L., Vijayakumar, H., Padhye, R., Sen, K., & Grace, M. (2020). PARTEMU: Enabling Dynamic Analysis of Real-World TrustZone
Software Using Emulation. In 29th USENIX Security Symposium
Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

11SyncEmu’s CA-in-the-loop Technique
Forwarding SMCs

TAs
CA-in-the-loop
SVC

1. Intercept on-device SMC
2. Sync shared memory

modified
TEE Driver
1shm
2

shm
2

TZOS

3. Forward SMC and sync registers

3SMC

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

3emulated
Secure Monitor

July 8, 2024

12

Evaluation
Feasibility of Rehosting TZOS Implementations

Rehosting TrustedCore from Huawei’s P9lite smartphone●Minimal Bootloader: 19 assembly instructions●

Peripheral Callbacks: 18 emulated MMIO accesses●

Secure Monitor Callbacks: Hook at first SMC by
TrustedCore and pause emulation

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

13

Evaluation
CA-in-the-loop

Rehosting environments are hard to evaluate because we have not ground truth●Approach: Input-Output methodology4→ Compare return values of on-device TEE and rehosted TEE

4Fasano, A., Ballo, T., Muench, M., Leek, T., Bulekov, A., Dolan-Gavitt, B., ... & Robertson, W. (2021, May). Sok: Enabling security
analyses of embedded systems via rehosting. In Proceedings of the 2021 ACM Asia conference on computer and communications
security
Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

14

Evaluation
CA-in-the-loop

Rehosting environments are hard to evaluate because we have not ground truth●Approach: Input-Output methodology4→ Compare return values of on-device TEE and rehosted TEE

Experiment 1: OP-TEE with QEMU’s machine virt
●Experiment 2: Huawei P9lite with modified TEE Driver (~300 lines C)●→ Hardware emulation is thelimiting factor

4

Fasano, A., Ballo, T., Muench, M., Leek, T., Bulekov, A., Dolan-Gavitt, B., ... & Robertson, W. (2021, May). Sok: Enabling security
analyses of embedded systems via rehosting. In Proceedings of the 2021 ACM Asia conference on computer and communications
security
Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

15

Discussion
Limitations and Future Work

Limitations:●Physical smartphone required for CA-in-the-loop (low scalability)●

TZOS and TA binaries required (may be encrypted)●

DMA and unique hardware secrets

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

16

Discussion
Limitations and Future Work

Limitations:●Physical smartphone required for CA-in-the-loop (low scalability)●

TZOS and TA binaries required (may be encrypted)●DMA and unique hardware secrets

Future Work:●Finding strategies to emulate peripherals easier and more accurate●

Extend with other TZOS implementations●Integrate security testing (e.g. fuzzing)

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 2024

17

SummaryThanks for your attention!

●Open source rehosting framework for proprietary TrustZone images●Showcasing CA-in-the-loop technique●

Identify future directions for research in TEE rehosting
https://github.com/syncemu/syncemu

Christian Lindenmeier, IT Security Infrastructures Lab, FAU Erlangen-Nürnbeg (FAU), Germany

July 8, 202418