Script to inject key and/or auth counter directly into binary image #26

eliotb · 2019-03-22T01:16:07Z

#25
I have changed the parameters slightly:
The --key must be given explicitly or key in .bin is not modified
The --ctr must be given (and non-zero) or counter are in .bin is not modified.

Thus it is possible to change just the key or the counter independently.

I have confirmed that this script produces the same modifications as the original inject_key.py

Signed-off-by: Eliot Blennerhassett <[email protected]>

gl-sergei

Sorry for delay. I was traveling last week. Thank you for contribution! Please consider resolving my comments.

gl-sergei · 2019-03-23T10:57:50Z

src/inject_key_bin.py

+    ctr_blob = struct.pack("<I", args.ctr) * 256
+
+    with open(args.bin, 'r+b') as f:
+        f.seek(args.offset + 1024)


if offset is "Offset within file to patch", why do we need to add 1024 here?

args.offset is offset to start of patching when both key and ctr are patched. Yet I want to be able to patch either independently.
I made it a commandline parameter because I wasn't sure that it would be constant across all targets. Actually I think it is effectively a constant

gl-sergei · 2019-03-23T11:08:33Z

src/inject_key_bin.py

+                    help='.bin file to inject keys into. Or "stdin"')
+parser.add_argument("--key", help="EC private key in DER format")
+parser.add_argument("--ctr", default=0, type=lambda x: int(x,0), help="Value of auth counter")
+parser.add_argument("--offset", default=0xB800, type=lambda x: int(x,0), help="Offset within file to patch")


Maybe we could guess by looking at the .bin file whether it is Tomu binary of stm32f1x? Or at least we could have two preset values one for each of them. Also I don't remember if playing with make flags can change the offset.

All builds share same .ld file, so I think offsets are really constant. Maybe this argument can be removed in favour of a constant. In a pinch, a user can edit the .py to change the value?

I'm wrong about all builds sharing same .ld. There is also efm32hg.ld

gl-sergei · 2019-03-23T11:10:54Z

test/yubico_test.sh

@@ -0,0 +1,18 @@
+# Requires dfu-utils to be installed.
+# This runs through the steps described in https://github.com/Yubico/libu2f-host documentation


Usually I run this test suite for every change: https://github.com/google/u2f-ref-code/tree/master/u2f-tests, it is very complete. But having a simple one is a good thing as well.

Ah ok I didn't know about that. I just wanted a simple 'is the key working' test that didn't involve interacting with a website...

gl-sergei · 2019-03-23T11:11:58Z

test/yubico_test.sh

+echo "Touch key to confirm registration"
+u2f-host -a register -o 'https://demo.yubico.com'  < regchallenge.json > regdata.json
+#cat regdata.json
+curl https://demo.yubico.com/wsapi/u2f/bind -d "username=tomu&password=test&data=$(cat regdata.json)"


can we generate random user/password here to avoid possible conflicts?

Reasonable request.

I've done this

gl-sergei · 2019-03-23T11:13:31Z

test/yubico_test.sh

+curl 'https://demo.yubico.com/wsapi/u2f/enroll?username=tomu&password=test' > regchallenge.json
+cat regchallenge.json
+echo "Touch key to confirm registration"
+u2f-host -a register -o 'https://demo.yubico.com'  < regchallenge.json > regdata.json


Shall we add .json files to .gitignore and clean them up at the end of this script?

Now by default they are cleaned up at end, unless you add "-k" as first argument. Rather simplistic, but I think it is ok for a basic test script.

gl-sergei · 2019-03-23T11:17:31Z

src/inject_key_bin.py

+import os
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--bin", default="build/u2f.bin",


Can we combine inject_key and inject_key_bin into one? Or even replace inject_key with the inject_key_bin...

I think once inject_key_bin is proven to work, it can replace inject_key.

also remove json output unless -k is given Note accounts are removed from demo.yubico.com after 24 hours

gl-sergei · 2019-03-26T06:57:15Z

.gitignore

@@ -2,3 +2,4 @@
 */.dep
 doc/chopstx.info
 .vs/
+*.json


it is better to be more specific about which files to ignore. What about test/*.json ?

gl-sergei · 2019-03-26T07:34:11Z

src/inject_key_bin.py

+                    help='.bin file to inject keys into. Or "stdin"')
+parser.add_argument("--key", help="EC private key in DER format")
+parser.add_argument("--ctr", default=0, type=lambda x: int(x,0), help="Value of auth counter")
+parser.add_argument("--offset", default=stm32f103_offset, type=lambda x: int(x,0), help="Offset within file to patch")


So, for stm32f103 offset can be 0xf400 or 0xf800 depending on build flags (CUSTOM_ATTESTATION_CERT), for efm32hg it can be 0xb400 or 0xb800. But it is more reliable to count backwards. It should always be 2048 bytes from the end of .bin file.

Pushed new code that uses this calculation by default

gl-sergei · 2019-03-26T07:35:30Z

test/yubico_test.sh

@@ -0,0 +1,29 @@
+# Basic test
+# Requires dfu-utils to be installed.


libu2f-host instead of dfu-utils?

Package "u2f-host" on debian. Pushed this change

gl-sergei · 2019-04-28T11:57:58Z

Any update on this?

Signed-off-by: Eliot Blennerhassett <[email protected]>

Default is 0x800 (2048) bytes from the end of file Signed-off-by: Eliot Blennerhassett <[email protected]>

Signed-off-by: Eliot Blennerhassett <[email protected]>

gl-sergei

Thank you for working on this! I am thinking about adding basic test functionality into certtool which would not require installing of u2f-host and calling the yubico web site. I find inject_key_bin useful and I would like it to replace inject_key. Would you mind to submit just the inject_key_bin part and replace existing inject_key with it? I can do it myself if you have no time/not wiling to do it with giving you credit of course.

test/yubico_test.sh

Co-Authored-By: eliotb <[email protected]>

Signed-off-by: Eliot Blennerhassett <[email protected]>

eliotb added 4 commits March 22, 2019 14:11

Script to inject key and/or auth counter directly into binary image

c470d93

Signed-off-by: Eliot Blennerhassett <[email protected]>

typo in param help string update

71621e3

Signed-off-by: Eliot Blennerhassett <[email protected]>

Allow hex numeric arguments. Change default offset.

33edbb3

Test script using u2f-host and demo.yubico.com to test key

cf01fa1

Signed-off-by: Eliot Blennerhassett <[email protected]>

gl-sergei requested changes Mar 23, 2019

View reviewed changes

eliotb added 3 commits March 24, 2019 15:59

Randomish user and password

d0e5af4

also remove json output unless -k is given Note accounts are removed from demo.yubico.com after 24 hours

Clarify offsets

895f7b0

Add .json to gitignore

d7709b5

gl-sergei requested changes Mar 26, 2019

View reviewed changes

eliotb added 4 commits May 6, 2019 10:58

fix missing parens and format in print

43c88fa

Signed-off-by: Eliot Blennerhassett <[email protected]>

Calculate default offset relative to end of file

6a4b390

Default is 0x800 (2048) bytes from the end of file Signed-off-by: Eliot Blennerhassett <[email protected]>

Requires u2f-host package, not dfu-utils

53047f4

Signed-off-by: Eliot Blennerhassett <[email protected]>

Narrow json ignore to test directory

abb859d

Signed-off-by: Eliot Blennerhassett <[email protected]>

gl-sergei requested changes May 7, 2019

View reviewed changes

test/yubico_test.sh Outdated Show resolved Hide resolved

gl-sergei and others added 2 commits May 7, 2019 16:35

fix comment spelling

f1c9c4e

Co-Authored-By: eliotb <[email protected]>

Overwrite inject_key_bin.py with inject_key.py

d64c74d

Signed-off-by: Eliot Blennerhassett <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Script to inject key and/or auth counter directly into binary image #26

Script to inject key and/or auth counter directly into binary image #26

eliotb commented Mar 22, 2019

gl-sergei left a comment

gl-sergei Mar 23, 2019

eliotb Mar 24, 2019

gl-sergei Mar 23, 2019

eliotb Mar 24, 2019

eliotb Mar 24, 2019

gl-sergei Mar 23, 2019

eliotb Mar 24, 2019

gl-sergei Mar 23, 2019

eliotb Mar 24, 2019

eliotb Mar 24, 2019

gl-sergei Mar 23, 2019

eliotb Mar 24, 2019

eliotb Mar 24, 2019

gl-sergei Mar 23, 2019

eliotb Mar 24, 2019

gl-sergei Mar 26, 2019

gl-sergei Mar 26, 2019

eliotb May 5, 2019

gl-sergei Mar 26, 2019

eliotb May 5, 2019

gl-sergei commented Apr 28, 2019

gl-sergei left a comment

		@@ -0,0 +1,18 @@
		# Requires dfu-utils to be installed.
		# This runs through the steps described in https://github.com/Yubico/libu2f-host documentation

		@@ -0,0 +1,29 @@
		# Basic test
		# Requires dfu-utils to be installed.

Script to inject key and/or auth counter directly into binary image #26

Are you sure you want to change the base?

Script to inject key and/or auth counter directly into binary image #26

Conversation

eliotb commented Mar 22, 2019

gl-sergei left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gl-sergei commented Apr 28, 2019

gl-sergei left a comment

Choose a reason for hiding this comment