-
Notifications
You must be signed in to change notification settings - Fork 15
/
CHANGELOG
279 lines (192 loc) · 10.5 KB
/
CHANGELOG
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
2023-04-11: Depthcharge Release 0.5.0 ("Food for Thought")
----------------------------------------------------------------------------
* Added checker for CVE-2022-2347
* Added more helpful warning message resulting from a lack of a loadaddr
2022-07-05: Depthcharge Release 0.4.0 ("Entertainment!")
----------------------------------------------------------------------------
Added a handful of configuration checker builtins covering:
* CVE-2022-30552 and CVE-2022-30790 (#97)
* CVE-2021-27138 and CVE-2021-27097 (#99)
* No CVE: part_test_dos() stack overflow (#98)
* CVE-2020-8432
* CVE-2017-3225 and CVE-2017-3226
* CONFIG_ENV_IS_IN_* items (#90)
* CONFIG_FIT_SIGNATURE=y without CONFIG_FIT_FULL_CHECK=y
2022-03-05: Depthcharge Bug Fix Update 0.3.2
----------------------------------------------------------------------------
Fixed documentation rendering issues resulting from usage of the new 1.0.0
Sphinx RTD theme release and updated dependency specification accordingly.
2022-03-05: Depthcharge Bug Fix Update 0.3.1
----------------------------------------------------------------------------
Just a little releaselet to get a fix for [Issue #91] into main.
[Issue #91]: <https://github.com/nccgroup/depthcharge/issues/91>
2021-08-01: Depthcharge Release 0.3.0 ("Danny Nadelko")
----------------------------------------------------------------------------
Summary:
* Introduced AARCH64 support (#3)
* Added `Depthcharge.register_payload()` API function (#23)
* Added icache/dcache flush upon payload deployment (#24)
* Fixed ARM DataAbort parsing issue when in Thumb mode (#79)
* Fixed issue displaying multiple DRAM bank info (#81)
* Documentation updates and fixes
* Removal of RETURN_REGISTER payload.
Versions:
Python module (`depthcharge`): 0.3.0
Companion Firmware: 0.1.0
Details:
**Introduced AARCH64 support**
The depthcharge.arch.AARCH64 class has been introduced to support
aarch64 system. A number of fixes and changes throughout the codebase
have been made to accommodate use on 64-bit systems.
There remains a known limitation on ARMv8 devices operating in AARCH32 bit
mode, where we do not necessary have a generic means to trigger data aborts.
The RETURN_REGISTER builtin payload and associated GoRegisterReader
have been removed, as they ultimately provided little value, while being
annoying to add AARCH64-bit support for. The RETURN_MEMORY payload (with no
argument) can be used instead to return a gd pointer, if needed.
2020-12-01: Depthcharge Release 0.2.0 ("Clatter and Hiss")
----------------------------------------------------------------------------
Summary:
* Introduced configuration checker API and depthcharge-audit-config
* Command-line argument and API "breaking" changes:
* ARM is longer the default architecture, "Generic" is
* Migrated uboot.py submodule to a uboot subpackage
* Change to opt-in semantics for payload deploy+execute, device crash/reboot
* Payload base and offset improvements
Versions:
Python module (`depthcharge`): 0.2.0
Companion Firmware: 0.1.0
Details:
**Introduced configuration checker API and depthcharge-audit-config**
The depthcharge.checker API is designed to to facilitate configuration
auditing, where the goal is to consistently and quickly identify common
security pitfalls or known vulnerabilities, so time spent on security
review efforts can be focused elsewhere (e.g., in newly developed code).
The depthcharge.checker.ConfigChecker class defines the overarching
framework and implements the common auditing and reporting functionality.
The depthcharge.checker.UBootConfigChecker and .UBootHeaderChecker
classes implement support for parsing .config and platform configuration
header files, respectively.
The audit() methods of these "checkers" produce depthcharge.checker.Report
objects, which are sets of depthcharge.checker.SecurityRisk objects
that describe the potential risks and provide a high-level, general
recommendations. The Report class supports a few export formats, including
html, csv, and Markdown.
The depthcharge-audit-config script exposes this new API functionality
via the command-line.
**ARM is longer the default architecture, "Generic" is.**
In the interest of being more user friendly, Depthcharge now defaults to an
ARM-ish "Generic" architecture, which is still 32-bit and little endian.
By making no assumptions about registers and instruction set, we can exclude
operations that would otherwise cause a target device to spin out of control.
The goal here is try to balance provide some reasonable amount of
functionality, while being resilient to platform-specific quirks that would
otherwise cause grief fro a newcomer to Depthcharge.
In order to use ARM-specific functionality, one must now do one of the
following:
* API: Create a Depthcharge context using `arch='arm'`
* Scripts: pass an `--arch arm` argument
See `arch/generic.py` for the other Generic architectures available.
However, note that 64-bit and big-endian platforms have not yet undergone
testing.
**Migration uboot.py submodule to a uboot subpackage**
The migration of the uboot.py submodule to a uboot subpackage was
performed in order to allow new additions to be introduced in a more
organized manner.
The uboot.py submodule has been converted to a subpackage organized as
follows:
* depthcharge.uboot.board: Platform and "board" configuration data
* depthcharge.uboot.cmd_table: Console command handler table inspection
* depthcharge.uboot.env: Environment (variable) functionality
* depthcharge.uboot.jump_table: Exported jump table definitions
This breaks the (unstable) v0.1.x API. Below is a summary of the v0.1.x
items that have been removed, along with their corresponding replacements in
the (also unstable) v0.2.x API.
depthcharge.uboot.board:
v0.1.x: depthcharge.uboot.bdinfo_dict()
Replaced by:
v0.2.x: depthcharge.uboot.board.bdinfo_dict()
depthcharge.uboot.cmd_table:
v0.1.x: depthcharge.uboot.cmdtbl_entry_to_bytes()
Replaced by:
v0.2.x: depthcharge.uboot.cmd_table.entry_to_bytes()
depthcharge.uboot.env:
v0.1.x: depthcharge.uboot.raw_environment_regex()
depthcharge.uboot.raw_env_var_regex()
depthcharge.uboot.expand_environment()
depthcharge.uboot.expand_variable()
depthcharge.uboot.parse_raw_environment()
depthcharge.uboot.load_raw_environment()
depthcharge.uboot.save_raw_environment()
depthcharge.uboot.create_raw_environment()
depthcharge.uboot.parse_environment()
depthcharge.uboot.load_environment()
depthcharge.uboot.save_environment()
Replaced by:
v0.2.x: depthcharge.uboot.env.raw_regex()
depthcharge.uboot.env.raw_var_regex()
depthcharge.uboot.env.expand()
depthcharge.uboot.env.expand_variable()
depthcharge.uboot.env.parse_raw()
depthcharge.uboot.env.load_raw()
depthcharge.uboot.env.save_raw()
depthcharge.uboot.env.create_raw()
depthcharge.uboot.env.load()
depthcharge.uboot.env.save()
depthcharge.uboot.jump_table:
v0.1.x: depthcharge.uboot.jump_table_exports()
depthcharge.uboot.find_jump_table()
Replaced by:
v0.2.x: depthcharge.uboot.jump_table.exports()
depthcharge.uboot.jump_table.find()
**Opt-in Operation Semantics**
Previously, Depthcharge would attempt to automatically explore a device as much
as possible when the depthcharge.Depthcharge context object is created (which
is what is happening when the depthcharge-inspect is used).
However, when beginning work on a bringing up MIPS support, it became clear
that the (expected) failures resulting from previously untested U-Boot versions
(including those heavily modified by a platform vendor) would be very unintuitive
to new users of the Depthcharge toolkit. In order to better to provide a better
user experience (i.e. a less annoying and kludgy-feeling toolkit), as well as
making adding new architecture support less of a hassle, the platform inspection
now behaves according to opt-in semantics, rather than opt-out semantics.
In the depthcharge.Depthcharge constructor, there are now `allow_deploy`
and `skip_deploy` options, whose semantics are detailed in the corresponding
API documentation. On the command-line, these correspond to -A, --allow-deploy
and -S, --skip-deploy arguments.
Similarly, the opt-out of operations requiring a device crash or reboot in
scripts was found to be unfriendly and has been similarly been changed to
have opt-in semantics. The relevant API function keyword argument has always
been allow_reboot; the change was only needed in scripts' command-line
options, which now match: -R, --allow-reboot
**Payload base address and offset improvements**
The code used to configure the address at which Depthcharge should
deploy payloads has been updated to address some deficiencies and
better match the promises made in the API docs.
2020-07-22: Depthcharge 0.1.1.post1
----------------------------------------------------------------------------
Post-release update to temporarily work around setup.py issue (#14)
affecting RTD builds until proper fix is merged in a later release.
Versions:
Python module (`depthcharge`): 0.1.1.post1
Companion Firmware: 0.1.0
2020-07-22: Depthcharge Release 0.1.1 ("Burn No Bridges")
----------------------------------------------------------------------------
Documentation and packaging fixes - no functional changes.
Versions:
Python module (`depthcharge`): 0.1.1
Companion Firmware: 0.1.0
2020-07-21: Depthcharge Release 0.1.0 ("Against the Grain")
----------------------------------------------------------------------------
Initial public release of Depthcharge.
Versions:
Python module (`depthcharge`): 0.1.0
Companion Firmware: 0.1.0
Current limitations:
- Supports ARM (32-bit) only. Additional architecture support can be
introduced via python/depthcharge/arch.py.
- The Companion Firmware currently acts only as an I2C peripheral.
This can certainly be expanded upon to also act as a SPI peripheral.
- GoExecutor is the only Executor implementation. Boot commands could also
be leveraged as such, provided that payloads are wrapped in appropriate
image formats, preferably automatically by Depthcharge.