Skip to content

LongtermSecurityInc/samsung-npu

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

3 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Reversing and Exploiting Samsung's Neural Processing Unit

Companion repository for the Reversing and Exploiting Samsung's Neural Processing Unit article on Longterm Security's blog.

Repository

This repository is organised as follows:

  • binaries/
    • npu_sXX_binary.bin
    • npu_sXX_dump.bin
      • Dumps of the NPU firmwares from running phones. These are the binaries we used in the blogpost to reverse engineer the NPU.
  • exploit/
    • PoCs to get code execution in the NPU and trigger the stack buffer overflow in the Android kernel.
  • patches/
    • Kernel patch to re-enable memory dumps of the NPU from the kernel. The Samsung kernel version we used as a base is G980FXXU5CTL1.
  • reverse/
    • Files containing our reverse engineered comprehension of the NPU. They detail:
      • the initialization of the NPU;
      • components such as the heap, events, semaphores, timers, events, etc.;
      • tasks and the scheduling algorithm;
      • the implementation of the mailbox used to communicate between the NPU and the kernel.
  • tools/
    • npu_sram_dumper
      • Tool to dump the NPU from a running phone.
    • npu_firmware_extractor
      • Tool to extract the NPU firmware from a boot image.

References

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published