/*## (c) SECURITY EXPLORATIONS    2011-2018 poland                           #*/
/*##     http://www.security-explorations.com                                #*/

/* RESEARCH MATERIAL:	SRP-2018-02                                           */
/* [Exploitation Framework for STMicroelectronics DVB chipsets]               */

[PACKAGE CONTENT]
This package contains software framework making it possible to research
security of a SlimCORE and TKD Crypto cores of STi7111 DVB chipset in the
environment of a real life digital satellite TV platform (NC+).

The framework along accompanied tools already proved its usefulness as
they were used for a discovery of a new ST chipset design vulnerability
(SRP-2018-02 Issue 7 - non-atomic loading of crypto keys).

The following Proof of Concept codes and tools are included as part of the
package:
- Source and binary codes for a Proof of Concept code exploiting security
  vulnerabilities for set-top-box and STi7111 chipset access (SRP-2018-02
  Issues 1-3),
- Source and binary codes for a Proof of Concept code exploiting new design
  vulnerability affecting STi7111 DVB chipset (SRP-2018-02 Issue 7),
- Source and binary codes for 2 tools (Compiler Stubs Generator and SlimCORE
  assembler).

Their detailed technical description can be found in SRP-2018-02 report
accompanying this package.

SRP-2018-02 Proof of Concept code is based on the POC developed as part of 
SE-2011-01 project.

As the focus of SRP-2018-02 research was on ST vulnerabilities, our Proof
of Concept code implements only a subset of SE-2011-01 POC commands. Some
new commands targeting SlimCORE and TKD Crypto core have been added though.

Proof of Concept Code features:
- administrative access (OS root, JVM root and kernel level access) to
  STi7111 based set-top-box devices (ITI-2850ST, ITI-2849ST and ITI-2851S)
- full read/limited2 write access to file system
- full read/write kernel and ST chipset I/O space access
- smart card interface interception (APDU req / resp logging)
- runtime firmware interception of STi7111's embedded crypto processor
- firewall disabling
- java and system level directory tree listing
- java and system level file/directory tree transfer
- access to information about system configuration (serial number, software
  version, hardware type, network configuration)
- access to information about MPEG services
- access to SI MPEG sections (PAT, PMT)
- simple MPEG sniffing by PID value
- access to information about various cryptographic keys (Conax, hdcp)
- access to information about user's subscription's status (Conax card
  entitlements)
- access to Electronic Program Guide (EPG)
- DSMCC carousels mounting
- MPEG stream capture of arbitrary HD programming
- access to vulnerable STi7111 processor (SlimCORE and TKD crypto core)
- inspection of TKD crypto core memory
- inspection of chipset security fuses
- execution of custom TKD crypto core commands
- loading and execution of SlimCORE code (images) produced by SlimCORE
  assembler tool
- Conax CWPK chipset pairing key extraction
- plaintext Control Word keys extraction
- the possibility to implement custom framework commands (run custom code
  on a device).

Package structure:
- backdoor
  The main SRP-2018-02 Proof of Concept component and shell. It embeds the
  functionality of the following:
  * logger (printing all log messages received from a set-top-box device), 
  * server (proxy server between set-top-box devices and a shell client),
  * shell (the primary frontend for interacting with a set-top-box by the
     means of a command like shell).
- exploit
  The Exploit component, which embeds the functionality of a HTTP, DNS, SSDP
  and Multiroom servers. It is responsible for triggering and exploitation
  of Issues 1 and 2 on a target set-top-box device.
- docroot
  Document root used by the HTTP server of the Exploit component.
- genstub
  Compiler Stubs Generator tool (GenStub)
- stubs
  The output of the GenStubs tool
- SCAsm
  SlimCORE assembler (SCAsm) tool

[LEGAL DISCLAIMER]
THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, AND TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW NEITHER
SECURITY EXPLORATIONS, ITS LICENSORS OR AFFILIATES, NOR THE COPYRIGHT
HOLDERS MAKE ANY REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY OR FITNESS
FOR A PARTICULAR PURPOSE OR THAT THE SOFTWARE WILL NOT INFRINGE ANY THIRD
PARTY PATENTS, COPYRIGHTS, TRADEMARKS, OR OTHER RIGHTS. THERE IS NO
WARRANTY BY SECURITY EXPLORATIONS OR BY ANY OTHER PARTY THAT THE SOFTWARE
WILL MEET YOUR REQUIREMENTS OR THAT IT WILL BE ERROR-FREE.

YOU ASSUME ALL RESPONSIBILITY AND RISK FOR THE SELECTION AND USE OF THE
SOFTWARE TO ACHIEVE INTENDED RESULTS AND FOR THE INSTALLATION, USE, AND
RESULTS OBTAINED FROM IT. 

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL
SECURITY EXPLORATIONS, ITS EMPLOYEES OR LICENSORS OR AFFILIATES BE LIABLE
FOR ANY LOST PROFITS, REVENUE, SALES, DATA, OR COSTS OF PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES, PROPERTY DAMAGE, PERSONAL INJURY, INTERRUPTION
OF BUSINESS, LOSS OF BUSINESS INFORMATION, OR FOR ANY SPECIAL, DIRECT,
INDIRECT, INCIDENTAL, ECONOMIC, COVER, PUNITIVE, SPECIAL, OR CONSEQUENTIAL
DAMAGES, HOWEVER CAUSED AND WHETHER ARISING UNDER CONTRACT, TORT, NEGLIGENCE,
OR OTHER THEORY OF LIABILITY ARISING OUT OF THE USE OF OR INABILITY TO USE
THE INFORMATION CONTAINED IN THIS MATERIAL, EVEN IF SECURITY EXPLORATIONS
OR ITS LICENSORS OR AFFILIATES ARE ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
