杀手锏：破解苹果新款 USB-C 控制器.pdf

1、ACE up the SleeveHacking into Apples new USB-C controllerhextree.iowhoamiThomas Roth aka stacksmashing Security researcher-Hardware&Firmware Co-founder at hextree.io Twitter:ghidraninja YouTube:stacksmashinghextree.ioThanksSiguza Oly(Thunderbolt Patcher)AsahiLinux Team Carlo Maragno Jiska,Fabian&Car

2、oCarlo Maragno Marc Zyngier(maz)T8012 Dev Team aunali1 h0m3us3r mrarm Rick Markhextree.ioThe backstoryhextree.iohextree.iohextree.ioChargingUSBVideo&AudioThe obvious stuffhextree.ioChargingUSBVideo&AudioThe cool stuffJTAGUARTSDQThe obvious stuffhextree.ioThe cool stuffJTAGUARTSDQTamarin Cablehextree

3、.iohextree.ioThe cool stuff?hextree.iohextree.iohextree.iohextree.iohextree.ioUSB-PD NegotiationVDMhextree.ioUSB-PD NegotiationVDMUSB-C Port Controllerhextree.iohextree.ioConfiguration Channelhextree.ioConfiguration ChannelAll handled by the USB-C Port(Micro)controllerhextree.ioPhoto by h0m3us3rThan

4、ks T8012 Dev Team!hextree.iohextree.ioVDMVendor Defined Messageshextree.ioVDMVendor Defined Messageshextree.ioVDMVendor Defined Messageshextree.ioVDMVendor Defined Messageshextree.iohextree.ioSerial RXSerial TXhextree.ioSerial RXSerial TXVDM action 0 x306hextree.iohextree.iohextree.ioType-C Port Con

5、trollerhextree.ioType-C Port ControllerACEhextree.ioType-C Port ControllerACEACE2ACE3hextree.ioType-C Port ControllerACESystem on Chiphextree.ioType-C Port ControllerACESystem on ChipUSB&Thunderbolthextree.ioType-C Port ControllerACESystem on ChipUSB&ThunderboltSerial consolehextree.ioType-C Port Co

6、ntrollerACESystem on ChipUSB&ThunderboltSerial console&more!hextree.ioBut how can we send VDM?hextree.ioHow can we send VDM?macvdmtool Back-left port of MacBook Pro to get serial etc Central Scrutinizer Hardware tool to get serial console on MacBookhextree.ioTamarin-CAllows bi-directional access to