Joe and Miles, give them a round of applause. (  Applause  ) >> Hey, how's it going? Ok, who

here went to Mike Osman's RF Reflectors NSA Playset Talk? Ok, who went to Josh Jatko and Teddy

Reed's ITC Implant Talk? Who went to Dean Anlooki's GSM talk? Okay. Who here bought any NSA

Playset kit from Vendor Village? You don't have to say if your employer sent you to buy one for

research purposes, you know. So this is Stupid PCIe Tricks featuring NSA Playset PCIe. It

didn't really start out as an NSA Playset talk, but it fights right in because this is a

capability that they've got to have. It's got to be on one of the pages rejected or missing.

I'm Joe Fitzpatrick. I have an electrical engineering education with focus on CS and Infosec. I

spent eight years doing security research, speed debut and tool development for CPUs including

hardware pen testing of CPUs and security training for functional validators worldwide. I also

teach a really cool class, software exploitation via hardware hacking, aka SEx via

HEx, so if any of you are interested, you should google look for that. It's somewhat

safe. It's work safe. And our mandatory meeting, "if Joe Fitz, he sitz". If you missed the hot

tub at Tour Camp, you should go next time. It runs in two years. >> I'm Miles Crabill, I'm a

current student and hardware Newbie, but interested in computer science and met up with

Joe last year and have been working with him on the last couple months on this NSA

Playset PCIe stuff. I didn't come in with much hardware experience SP and I've pretty

much been learning as I went. It's been a great time. So I couldn't show this, of course.

>> Miles has been great because he makes it all look presentable. I'm a hardware guy

and not a coder. So a slight disclaimer, I didn't do really good research, I didn't cite a

lot of people, but there are tons of people who have done PCIe work and other stuff so,

the difference is in line with the NSA Playset goals, we try to make it accessible and

inexpensive. We want any 10 years olds to start doing DAM attacks and memory jumps and

lock screen bypasses. Miles will give us the run-down of what the heck is PCIe, because even

though you might know it, you may not know the next layer in detail. >> Okay. So what is

PCIe? Well, the answer is that PCIe is PCI extending on this old specification. It's been

around forever. It's for fast IO, right? If you have a video card or something like that,

network card, sound card, anything really that goes in an extension, it'll probably on

your motherboard, whether you're on a laptop, desktop, most modern computers use PCI and so

this is how you get fast stuff going on the hardware level. So there are also things that don't

match up. As you see here, they don't look exactly the same. However, PCIe is backwards

compatible with PCI and PTIX. On the lower level you have packets that are being transmitted

across lanes, and so a lane is four wires. When you see on a PCI card something like XX 4 or

X 16, that's the number of lanes and it corresponds to throughput, so the amount of

data you're able to transfer. Most video use X 16, because they're transferring a lot of

data. PCI enables DAM access. So PCI hierarchy. The root complex is the highest node in the

hierarchy and pretty much everything else descends from there. You see the switch

connected to the root complex, and PCI devices will connect to the switch and other PCI devices

can be connected to other PCI devices so you get a whole mess when you try underwriting this

stuff. So switching. This is the inside of the switch. From the upstream you have the bus, and

then you have these virtual PCI to PCI bridges, and then these actually interface with the real

devices that you have connected, the real PCI devices. So the layers of PCI building up from

the bottom, you have RxTX on the physical layer of things, the logical side and electrical side

data and then up to the transaction where you're actually working with packets. I

don't know how well you can see this, but this is the actual PCI spec stuff in the top like

device I.D. and vendor I.D. is how you would identify a device. So diving into that we have

LSPCI output, just checking out a specific device. You can see this highlighted area is the

vendor I.D. of a device, and so you can see this highlighted area is the vendor ID of the

device and so this is how you would check the manufacturer. They all have codes associated

and then this would be the device I.D. so this is like per a specific product or family of

products. Then the revision, so you can see that all of this is just right in these bytes that

you can access through LSPCI. And this is your class. Device class. Yes. So you can see that

this is a PCI bridge that's 0604. It's just the code that's assigned to this type of device.

And so enumeration, as I said before, it gets pretty messy because it's depth first,

traversal of the tree hierarchy and everything like switches and PCI‑ to‑ PCI bridges show up

multiple times. And so any kind of LSPCI VD output is just a headache to look out. It's huge.

So  ‑ ‑ >> Okay. I'm back on. Routing PCIe. So we talked a little bit about what PCIe is

from a conceptual level. The fundamental difference is PCI was 32 bits in parallel, a big

flat parallel bus with multiple devices sitting on it. PCI express is this high‑ speed

serial with differential signaling. When you route high‑ speed signaling and high speed

differential signals you have some rules to follow, okay? If you wanted to make your own PCI

express device, you have to follow the step by step complicated mandatory and

inflexible rules to routing PCIE. For every single one of these. Number one, route your

pairs at roughly equal length. That's pretty much it. They made this spec to make it easier for

designing boards, because routing 32 lines in parallel along with the cloth, they have

to be equal lengths. That's a pain in the ass. They said ok, we'll do each pair on it's own,

TX pair and RX pair, and as long as each pair is the same length, the next line over can be a

different length, the next line over can be a different length, which works well when you have a

long card. It doesn't matter. All of that is taken care of by the physical layer of the PCIE.

There's some specs, right? You have to have board traces and 12 inches or less, cards are

supposed to be 13 1/2 total. 2 chips on one board supposed to be 15 inches. And if you follow

the rules, your board might work. If you don't follow these rules, it might still work. So

PCI express 1 X, the lowest common denominator, is 2.5GHz TX, 2.5GHz RX and 100MHz Clock.

That is a common clock and that's actually optional. The device can actually generate

it's own clock. It depends on the system and device. You can do it with the clock. But we'll

throw it in there, just for, you know, because we have room. If we wanted to make a table to

connect this, what do we need? We need something that can do high‑ speed, and PCI express

specifies actually like external cabling and it's really expensive. I don't like

expensive things, because I'm cheap. This is a cross‑ section of the USB 3 cable. If you look

inside, you've got the red and the black are ground to BCC, and the green and white are your old

school USB, USB 2.0 wires, right? Those are designed go up to 240 megabytes, right? That's

what USB megabyte was and that's plenty to carry our clock. You have the two level pockets, the

red, blue, and the purple and orange and those hold the high speed lanes and those go at 5

gigahertz. Right? So we have this cable we can get them for a couple of bucks at pretty much

any store and they carry exactly what they need, they carry 5 gigahertz, 5GHz and 500MHz.

That's actually more than we need. I threw together this little PCB. It looks like a PCIe

card. There's a dotted line in a middle. That's because I'm cheap again. And you can get a 5x5 cm

board for one price and I wanted two boards, but I didn't want to have to pay for two boards, so I

put them on the same board. Cut them in half if you want or use as is. You can see those red and

blue lines those are the top and bottom layers where I just connect the wires together and I

actually did a really bad job of this. You can do your own production stuff, do your own.

You can actually buy these premade from several manufacturers on eBay and all

express and other places in China, but that's no fun. So I made my own. This is what the

board looks like, and I have the cool silk solder mask, silver lettering because that's really

important when you make PCB to have your logo on there. I call it PEXternalizer. There's the

board cut in half at the other end and assembled on the populated board. They're a 1X

PCI express socket up there and the end looks kind of mundged up and molten, that's because I

just got my soldering iron and ran through that to open it up so I could put a 16 X card in.

Here's a quick screen shot basically. This PCI express wireless adapter in, and it's

connected and running, and I can connect to wireless networks. That's all well and good, but

that's old news. What else can we do? What devices can we add PCI express to that don't

generally have it? Have you seen this? Intel Galileo. It's an arduino board, but it actually

has a mini PCIe board on the back. What can you do with that? It's supposed to only work with

WiFi adapters, but that's no fun. Anybody can put a WiFi adapter in an arduino. Yeah,

make light flash. Oh, I'm not wearing that shirt. Oops. Makers make lights flahs. Hackers make

other people's lights flash. I made another version of the board, a mini‑ PCIE version.

I'll show you pictures. We'll look over. I'll actually show you. Oh, whoa. So we've got here

a nice  ‑ ‑ oh, there. It's upside graphics card backwards. We've got our Intel Galileo and

flip on the other side we have the mini PCIe card with the USB header. Again it's USB header

it's just USB header and cable because they're cheap. On the other end I have the populated

thingy‑ do which has a little power regulator on the end. We don't have the power supply and

cables and extra VGA to hook it up and show you, but basically we plug  ‑ ‑ stay still. I'm

looking at the screen. Whoo! Anybody sick yet? Pop it in the slot. >> Oh, gosh. >> There we

go. So you got that, right? You got it. There we go. You have more than 12 inches. Yeah. Do

you think it still works? Yeah, it still works. And so here's a screen shot. Whoa, here we go.

Actually when we tried it out, we used a bigger graphics card because bigger is better, right?

So wired them up PCIe that tiny Arduino and that nice big burly graphics card hovering over it

and if we hook it and we look, I had to do a little bit of custom building of that, which is

annoying because of the software and I hate software. If you do all this PCIe, same tools as

before. It's on the Galileo board already. You see a whole bunch of 8086, 8086, 8086.

Anybody knows who vendor I.D. that is? All the way down at the bottom is the 10de. Who do you

think that might be? Invideos. So, ya know. Sneak it in there and put it Invidy with Intel in

bed a little longer. Here we go. I hooked you up to my full HD display, to say, hey, I have X

running. There's no keyboard input or anything like that, but at this point it's a software

problem and I'm a hardware guy. It's someone else's problem, right? So let's move on. The

other device I played around with, and I don't have it here to show off is not fully working

yet. This is a Pogoplug. It's a network storage device. It has an Ethernet port and USB port

and you plug it in. It shares it with the whole world. It doesn't tell you about that part. If we

look at two versions of the PCE, the cheap and expensive one. The big difference in the upper left

corner is an extra chip that's a USB‑ 3 chip. You want USB 3 on your very slow network storage

device. The way it's connected is PCI express. If you see on this one, the purple wires on

the left hand side, those are my PCI express lanes. I have TX and Rx pairs and then I've got a

clock line. He took it with my phone through my magnifying glass, but you see on the left

we have a couple tiny little resistors that have it over it. Can you see it? You can't? Oh,

no. You can. So you see right there, there's a couple resistors because the resistance

loaders, you have to put on the clock lines, and over here's they're still very small, but

you see that little brown spot right there and there? Those are capacitors that are soldered to

the tip of USB connector and then the wire is soldered to the other edges side. It looks

pretty fancy. But a year and a half ago I sucked at soldering and still do. You find a friend

who can do it. Thanks, Kenny. He's not here, but you know. Those of you who know Kenny, he

does good work. Again, that goes out to a USB connector, which is the same Pen out as this chain

again. So my plan there is to get it working and see if I can compile those drivers for ARM

instead. So introducing SLOTSCREAMER. This is where we get into the NSA Playset side of

things. It reset our timer. Oh, its 2:16. We're good. Introducing SLOTSCREAMER, its in

all CAPS because it's cool to have things in all CAPS. I've had some critiquing because the

name sounds too good, it's not random and silly enough for NSA Playset because it actually is a

device that goes in a slot. I apologize. Again, I mentioned before I didn't do a lot of

research or citation, but I was at Black Hat and I saw this awesome slide which was from

Steven Weiss talking about protecting date in-use from firmware and physical attacks,

which is kind of what we're about to do. I figured I'd throw his slide in here. Thank you to

all of these people for all the work they have done, because I wouldn't have done this if it

wasn't done before me including all the citations. So it's also really cool to go into someone

else's talk and see my name on it. Whoo. This is my first time talking at DEF CON. (  Applause 

) >> It's Miles' first time, too. I'm glad we could have our first time together Miles. ( 

Applause  ) >> A lot of people are playing with this doing these PCI Express attacks, but a

lot of them are using FPGAs. FPGAs are expensive and they're difficult and they're hard and

you have to download like 28 bytes of software to get them working. Which who cares about