Home / Research / A PCI Express endpoint for security

ERIC is a soft SoC for FPGA based on Milkymist SoC. It is designed for system security purposes.

• ERIC SoC Github repository
• ERIC firmware Github repository
• ERIC tools Github repository

ERIC comes also with a pattern matching co-processor used to detect memory structures in host memory (PCIe DMA)

• MPU co-processor assembler Github repository

Motivation

• use it as an offensive gadget to ease exploits construction ;
• use it as a verifier in a remote attestation protocol.

Basic architecture

ERIC is based on Milkymist and interconnected using Wishbone bus. We adapted Milkymist to add our own implementation of a pattern matching co processor and a PCI Express endpoint.

Associated publications

This tools has been illustrated in the following papers

• Benoît Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaâniche - IOMMU protection against I/O attacks: a vulnerability and a proof of concept, Journal of the Brazilian Computer Society 2018
• Benoît Morgan, Eric Alata, Vincent Nicomette, Mohamed Kaâniche - Bypassing IOMMU protection against I/O attacks, 7^th Latin-American Symposium on Dependable Computing 2016
• Benoît Morgan, Éric Alata, Vincent Nicomette - Bypassing DMA remapping using DMA (French), Symposium sur la sécurité des technologies de l’information et des communications 2016
• Benoît Morgan, Éric Alata, Vincent Nicomette, Mohamed Kâaniche, Guillaume Averlant - Design and Implementation of a Hardware Assisted Security Architecture for Software Integrity Monitoring, IEEE 21^st Pacific Rim International Symposium on Dependable Computing 2015

Presentations

• SSTIC 2014 : protection d’hyperviseurs assistée par le matériel
• SSTIC 2016 : attaques DMA avec IOMMU