AwesomeREA.org

Tool

Titan M tools (Quarkslab)

Tools Quarkslab published from its research on Google's Titan M security chip in Pixel phones: a Ghidra loader for Titan M (Citadel) firmware files, nosclient for tracing and sending the chip's protobuf-based commands from Android with a black-box fuzzer built on libprotobuf-mutator, a parser for sigrok SPI captures, and scripts that convert firmware images to the rec files of the chip's SPI rescue feature. The repository also holds the Black Hat Europe 2021 white paper and slides, the ROOTS'21 paper and the Black Hat USA 2022 slides, which describe reverse engineering the firmware, sniffing its SPI communication with the application processor, and black-box and emulation-based fuzzing; the authors say the vulnerabilities they found were disclosed to Google.

Targets
Firmware · Protocol
Category
Firmware tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • A research release with no tags or packages: the last commit, on 2022-08-22, added the Black Hat USA 2022 slides two days after nosclient was updated for that talk. The emulation-based fuzzer those slides describe is not in the repository, and no Titan M firmware images, Boot ROM dumps or keys are committed.
  • Firmware files must come from the analyst's own Pixel device; the white paper notes that Titan M first shipped with the Pixel 3. Sending commands with nosclient needs root access on the device, as the white paper explains, and the SPI parser expects a sigrok CSV export of the analyst's own capture.
  • citadelimgloader builds with Gradle against a local Ghidra installation named by GHIDRA_INSTALL_DIR; no supported Ghidra version is stated. nosclient builds with CMake for Linux, for Android arm64 with the NDK, or in the provided Debian 10 Docker image with NDK r21e, after the libnos (AOSP), protobuf, libprotobuf-mutator and sqlite submodules are initialized.
  • The ROOTS'21 paper reports that the black-box fuzzer rediscovered several known vulnerabilities within seconds and found a new one in the then-latest firmware; these are the authors' results on their own devices. The README says the toolkit also contains an exploit for a known vulnerability; this entry describes only the analysis tooling.
  • LICENSE is Apache-2.0. The fuzzer bundles a generated libradamsa.c without its own license notice, the client includes protobuf sources generated from the nugget/app message definitions and small KeyMint enum headers, and the presentation PDFs state no license. No tool was built or run, and the sources establish no REA or AI use.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · quarkslab/titanm · Revision 7b6c252
  2. citadelimgloader/README.md GitHub · quarkslab/titanm · Revision 7b6c252
  3. nugget_toolkit/README.md GitHub · quarkslab/titanm · Revision 7b6c252
  4. nugget_toolkit/fuzzer/README.md GitHub · quarkslab/titanm · Revision 7b6c252
  5. nugget_toolkit/Dockerfile GitHub · quarkslab/titanm · Revision 7b6c252
  6. bin2rec/Readme.md GitHub · quarkslab/titanm · Revision 7b6c252
  7. .gitmodules GitHub · quarkslab/titanm · Revision 7b6c252
  8. BHEU_2021/EU-21-Rossi_Bellom-2021_A_Titan_M_Odyssey-wp.pdf GitHub · quarkslab/titanm · Revision 7b6c252
  9. ROOTS/DamianoMelotti_ReversingAndFuzzingTheGoogleTitanMChip_paper.pdf GitHub · quarkslab/titanm · Revision 7b6c252
  10. BHUSA_2022/Titan_BHUSA.pdf GitHub · quarkslab/titanm · Revision 7b6c252
  11. LICENSE GitHub · quarkslab/titanm · Revision 7b6c252

More in Firmware and hardware

All 46 entries in Firmware and hardware