Raytheon_VHDL_Generator:
Improving Cyber Survivability with Real-Time Hardware Diversification

Project Overview

• Key Research Aims
  1. Implement a soft processor testbed on FPGA with ability to operate with functionally equivalent, heterogeneous processors under basic software operations.
  2. Investigate software toolchain capability to support compile-time hardware diversification.
  3. Investigate survivability of system under a buffer insertion attack.
  4. Develop a tool capable of detecting
• Technical Approach
  • Three functionally equivalent cores with randomized instruction sets are implemented on an FPGA.
  • A voting system monitors the core outputs and produces the correct system result while monitoring for unexpected code execution that would indicate an attack.
  • A SW tool chain creates the core hardware at compile-time.
• Project Benefits
  • A hardware monoculture gives attackers an advantage because a single attack has impact across all platforms using the same architecture.
  • Hardware diversity reduces the attacker's advantage because their attack only impacts the targeted system while different architectures continue to operate.
  • Modern programmable hardware fabrics enable real-time hardware diversification.
• Current Accomplishments
  • VHDL generated for soft processor on FPGA.
  • FPGA simulates 3 unique MSP430's and can the ASM as a MSP430 would.
  • Each simulated MSP430 has a unique instruction set. (but not randomized)

Workflow

Generating VHDL for soft processor on FPGA.

1. In Code Composer Studio (CCS) create a project in C or Assembly (ASM).
2. Attach the MSP430.
3. Debug the program in CCS.
4. Stop the debugger.
5. Run ccs_disassembler.py.
6. Run vhdl_memory_parser.py.
7. Implement each generated vhdl file on an FPGA.
   • This effectively simulates 3 MSP430's with unique and randomized instruction sets.

ccs_disassembler.py

Generates assembly (ASM) from a binary.

Overview

• Converts binary generated by the MSP430 debugger via CCS to ASM by implementing dis430.exe.
• dis430.exe is located at C:\ti\ccs1040\ccs\tools\compiler\ti-cgt-msp430_20.2.5.LTS\bin by default.

Steps

• Checks that the input file exists.
• Checks if the output file already exists. If so remove it.
• Run dis430.exe on the input file and output file.
• Check the exit status of dis430.exe.
• Note: This procedure is extremely dependent on package structure.

vhdl_memory_parser.py

Generates VHDL package and memory for FPGAs from ASM.

Overview

• Converts the ASM generated by ccs_disassembler.py into VHDL memory and packages.
• This essentially extracts the MSP430's program memory from the binary so that an MSP430 can be simulated on an FPGA with code written and debugged in CCS.
• The opcodes from the binary are converted here to each of the three simulated MSP430s unique instruction sets.

Steps

• Call ccs_disassembler.main().
• Removes all VHDL files generated during the last execution.
• Generates 3 unique package files in vhdl for each simulated MSP430.
• Generates 3 unique memory files in vhdl that contain the program memory specified by the asm file for each simulated MSP430.

Challenges

Future features

• Implementation of pique-bin in ccs_disassembler workflow.
  • PIQUE-Bin tool is implemented but cannot be added due to github file size limitations and commit size limitations
  • Any antivirus must be tricked into allowing the PIQUE-Bin tool. There should be a way to add a directory to the exceptions for your antivirus.
• Inject common malware into binary file.
  • Generate infected VHDL and VHDL that removes the infection.
• Malware detection, mitigation and remediation.

Environments

Pycharm

Code Composer Studio (CCS)

• From branch Walker_Dev of \SP_430_Soft_Core\ the following from \MSP_430_Soft_Core\ccs_settings\ and copy into {ti_install_location}\ti\ccs{version_number}\ccs\ccs_base\msp430\include
  • [Custom MSP compiler files (header files, linker files. etc.)]
  • colt430fr2355.cmd
  • colt430fr2355.h
  • lnk_colt430fr2355.cmd
  • msp430.h
• Create a project using custom MSP as the target device
• Prop. -> build -> compiler -> proc options -> silicon version = msp
• Prop. -> build -> compiler -> predefined symbols -> add Pre-define NAME: COLT430FR2355 [//]: # (Include the dunder)
• • Prop. -> build -> compiler -> predefined symbols -> add Pre-define NAME: MSP430FR2355 [//]: # (Include the dunder)
• • Prop. -> build -> compiler -> predefined symbols -> add Pre-define NAME: _FRWP_ENABLE [//]: # (Omit the backslash)
• • Prop. -> build -> compiler -> predefined symbols -> add Pre-define NAME: _INFO_FRWP_ENABLE [//]: # (Omit the backslash)
• Prop. -> build -> compiler -> adv. -> Assembler Options -> ‘check’ keep the generated asm lang.
• Prop. -> general -> linker cmd file = lnk_colt430fr2355.cmd
• Copy target config directory from another CCS project of the same language to this project
• Note: It may be possible to automate this process using the CCS API

Hardware

The MSP430FR2355

Dependencies

Python 3.9

PIQUE-Bin Jar 0.0.1

DriverLib

• In CCS goto Window -> Preferences and search Products. Ensure "Search for products each time CCS starts" is enabled.
• Close CCS (all instances).
• Install MSP430Ware into the directory C:\ti\
• Open CCS. May ask to install software.
• Naviagate to Products again. Now MSP430Ware and MSP430 DriverLib should appear in the 'Discovered Products' category.
• Create a new project using a MSP430FR2355 (not custom) and select one of the DriverLib examples.
• Build the project.
• Customize all project settings (defined in "Code Composer Studio (CCS)" section.
• Empty the driverlib file in this project root.
• Copy the directory C:\ti\MSP430Ware_3_80_14_01\driverlib\driverlib\MSP430FR2xx_4xx\ into this project root at project_root\driverlib\MSP430FR2xx_4xx.
• Navigate to Prop. -> build -> compiler -> include options -> add ${PROJECT_ROOT}/driverlib/MSP430FR2xx_4xx betwwen ${PROJECT_ROOT} and ${CG_TOOL_ROOT}/include
• Double check all other custom settings
• Build project

Helpful Links

Credits

• For Raytheon
• Montana State University Software Engineering Lab MSU SEL Website (MSU SEL Github).
• Dr. Clem Izurieta.
• Dr. Brock LaMeres.
• Originally written by Blake Stanger
• Written by Walker Ward and Michael Heidal.