CSC 583 Topics in Computer Security

2024-Fall Course Website

Instructor: Si Chen

Course Logo

Course Description

This course offers an in-depth exploration of ARM architecture and security, with a focus on practical applications and real-world vulnerabilities. Students will gain comprehensive knowledge of ARM instruction sets, memory management, and advanced exploitation techniques.

Key Topics

  • ARM Instruction Set: Detailed study of ARM assembly language, including data movement, arithmetic operations, and control flow instructions.
  • Memory Management: Understanding of stack and heap operations, endianness, and memory layout in ARM systems.
  • Security Vulnerabilities: In-depth analysis of common security flaws, including stack overflow, heap overflow, and return-oriented programming (ROP) attacks.
  • Exploit Development: Hands-on experience in crafting exploits for various vulnerabilities, using both assembly and high-level languages.
  • Advanced Topics: Introduction to kernel exploitation and analysis of complex attack vectors.

The course combines theoretical lectures with practical lab exercises, allowing students to apply their knowledge in a controlled environment. Students will work with real ARM systems, develop exploit code, and learn to identify and mitigate security risks.

By the end of the course, students will have a solid foundation in ARM architecture and a deep understanding of security principles, preparing them for advanced roles in system programming, security research, and vulnerability analysis.

Expected Background

Graduate Students: Completion of all four core courses is required. A strong background in security is also expected.

Accelerated Undergraduate Students: Completion of CSC 302 is mandatory. If you have not completed this course, please consult with the instructor for eligibility.

Textbook

No Textbook

Course Content

# Date Topic Slides Supporting Materials
Class 1 Aug 27, 2024 Introduction ch01.pdf
  • endianness
  • endianness.c
    		•
    Class 2 Sep 03, 2024 ARM Instruction Set (1): mov/mvn, add/and ch02.pdf
  • little_endian.s
  • big_endian.s
  • mvn_example.s
    		•
    Class 3 Sep 03, 2024 ARM Instruction Set (2): str/ldr ch03.pdf
  • ldr_str_example.s
    		•
    Class 4 Sep 10, 2024 ARM Instruction Set (3): B, BL ch04.pdf
  • example1.s
  • b_ex1.s
  • b_ex2.s
  • bl_ex.s
  • hello_world.s
    		•
    Class 5 Sep 17, 2024 ARM Instruction Set (4): Stack & Stack Frame ch05.pdf
  • stack.s
  • stack_frame.s
    		•
    Lab 1
    (10 points)     		Sep 17, 2024 Lab: ARM Instruction Set
    		 lab1.pdf
  • How to connect to BadgerCTF
  • How to write a lab report
  • lab1.s
    		•
    Class 6 Sep 24, 2024 ARM Security: Stack Overflow ch06.pdf
  • overflow.c
  • attack.py
    		•
    Class 7 Oct 1, 2024 ARM Security: Stack Overflow (2) ch07.pdf
  • overflow.c
  • test_shellcode.c
  • shell.s
  • shell_wrong.s
  • exploit.py
  • exploit2.py
    		•
    Lab 2
    (10 points)     		Oct 1, 2024 Lab: ARM Stack Overflow
    		 lab2.pdf
  • lab2.c
  • exploit.py (template)
  • How to connect to BadgerCTF
  • How to write a lab report
    		•
    Class 8 Oct 08, 2024 Lab2 Review
    Online Asynchronous     		[Video]
  • lab2.c
  • exploit.py (template)
  • Hint for the second part
    		•
    Class 9 Nov 05, 2024 ARM Security: XN and Return-oriented programming (ROP) ch9.pdf
  • exploit.py
  • rop.c
    		•
    Class 10 Nov 12, 2024 ARM Security: PLT, GOT and Format String Bug ch10.pdf
  • rop
  • exploit.py
  • rop.c
  • ret2libc
  • ret2libc.c
  • ret2libc.py
  • leak
  • leak.c
  • leak.py
  • modify
  • modify.c
  • modify.py
    		•
    Lab 3
    (10 points)     		Nov 14, 2024 Lab 3: ARM ROP Attack
    		 lab3.pdf
  • lab3.c
  • rop_exploit.py (template)
  • How to connect to BadgerCTF
  • How to write a lab report
    		•
    Class 11 Nov 19, 2024 ARM Security: Heap Overflow (1) ch11.pdf
  • exploit.py
  • heap.c
    		•
    Class 12 Nov 26, 2024 Kernel Exploitation[Video]
    Online Asynchronous    		 ch12.pdf
  • uaf.c
  • babydriver.tar
  • CISCN2017-babydriver
  • Ghidra
    		•
    Class 13 Dec 03, 2024 ARM Security: Heap Overflow (2) House of Force ch13.pdf
  • hof.c
    		•
    Final Project
    (40 + 10 (Quiz) points)     		Dec 02, 2024 Final Project
    		 final.pdf
    Target IP: 143.244.149.32
    Target Port: 8888
    Vulnerable program: final_remote(final.c)
    Target File (flag): flag.txt
    XN is on, PIE/ASLR are off
    Hint Libc base address (on remote server): 0x40835000
  • Please check the Quiz on D2L
  • final (binary on the remote server)
  • final.c
  • final.py (template)
  • Gadgets information
  • How to connect to BadgerCTF
  • How to write a lab report
    		•

    Tutorials and Supporting Materials