Shadowing Practice: Watch this before you boot up another device - Learn English Speaking with Video
Creando lección...
1
Ladies and gentlemen, boys and girls, lend me, lend me, lend me your ears.
2
I want to show you this really neat vulnerability in U-Boot that everyone's talking about.
3
Not everyone, but I am.
4
So if you run the script here, QEMU drive, QMU, bada bing, bada boom, you will see the magical values.
5
The 41414141, the 41414141, and the 4242423E.
6
What the hell is even going on?
7
What are we talking about?
8
Guys, we're talking about a vulnerability in U-Boot,
9
the bootloader that allows you to bypass signature verification by exploiting a vulnerability in the bootloader itself.
10
Bugs like this are really, really neat because they actually invalidate an entire trust chain in the way that weird devices like this, like embedded ones and even ones that you sit in your pocket,
11
validate if they use U-Boot.
12
Obviously, this one does not.
13
This one might.
14
Anyway, I'm going to break down the bug, what went wrong, what you can do about it, and then also what the hell all this stuff means.
15
The finding today was found by a company named Binarly.
16
I've done videos on their stuff before.
17
They do a really good job on finding vulnerabilities in like lower level.
18
That's the name of the channel, by the way.
19
Low level.
20
Low level systems like bootloaders or BMC, board management controllers, stuff like that.
21
Again, not an ad for this company, just they do a lot of good work.
22
So the vulnerability today is a stack buffer underflow, kind of hard to say, in uBoot during the FIT image signature verification,
23
specifically in the FDT find regions functions.
24
A lot of words said there.
25
I'm gonna go into what all that means here in a little bit.
26
Okay, so enter uBoot, right?
27
What is uBoot?
28
Well, uBoot, kind of like the name of this folder that I had, I called it Das Boot.
29
uBoot is a system that allows you to, in an embedded world, boot other OSes, right?
30
So typically, the way these weird devices work is you have to bring them up.
31
You gotta get the board to be alive, you have to bring the CPU to live.
32
And then the first thing that you run on a router like this is this thing called a bootloader.
33
A bootloader is a piece of code that allows you to run other code.
34
The idea being, you don't have to make that piece of code know how to boot against every other CPU.
35
You just bring the CPU up to the bootloader, and the bootloader does the rest of the work, right?
36
You can use that bootloader to run your OS, like Linux or Windows or whatever.
37
So if the job of the bootloader is to run code that we want it to run, why does RCE in a bootloader matter?
38
Why does the vulnerability in U-Boot matter to anybody?
39
Great question.
40
What actually is interesting about U-Boot is its ability to facilitate this thing called verified boot, okay?
41
There's this whole world of boot processes
42
that the entire job is to make sure that code
43
that is not meant to be ran does not run on the device.
44
And we do this thing where we use a bunch of cryptographical algorithms using asymmetric encryption with like RSA keys
45
and public keys and stuff to sign the software image before it tries to get loaded.
46
And then using a public key on the device, we verify if that manufacturer signed image is actually what we want.
47
Is it the proper thing that is allowed to run on this device?
48
because maybe we just don't want anyone to be able to
49
run any software they want on random piece of Chinese router, right?
50
Maybe that's a thing that they don't want.
51
Okay.
52
So the issue that happens here is when you go to boot with a U-boot image in this fit format, this flattened image tree format,
53
it is signed with a signature.
54
It is basically taking a private key that the manufacturer owns.
55
We use that to embed a signature cryptographically that says, yup, it was signed by this manufacturer.
56
And then we use the public key on the device to verify the signature
57
that it was manufactured and it is the proper image.
58
But we can invalidate this entire signature verification process.
59
We can upload and execute a piece of code that is not intended by the manufacturer
60
if we can find and exploit a vulnerability inside of the bootloader.
61
And this is exactly what Binarily did.
62
And I'm sorry if you're worth with Binarily and I'm mispronouncing the company's name.
63
I'm not very good at English.
64
Okay, so stack buffer underflow in uBoot during the FIT image signature verification and FDT find regions.
65
Basically, there's code in the bootloader that is finding different regions of the actual image itself.
66
And the vulnerability is based on the same issue as one above, where we rely on the fact that FTT getName, which is a call that happens above, can fail.
67
But this time we're interested in what it writes to the length argument upon failure.
68
The error code.
69
Very interesting.
70
So there's this function called FTT getName, that if for any reason in this searching of the image during this FTT getName process,
71
where it's getting the name of a leaf of this image format, right?
72
If for some reason it's searching and it finds that one of the leaves does not have a slash, right?
73
So strrcare is a thread-safe version of strcare, which basically looks for a token in a string.
74
If that fails, we set error equal to some value and we go to fail.
75
And then in the fail label, we say if the length pointer exists, we are going to write out that length pointer, which should be the output of the actual length of the name.
76
Instead, we're going to output an error value, and that error value is FTT error bad structure.
77
And then notice that later on in the code we're going to do is we're going to say start copy onto end, the name that we found from that function, oh, and also end plus equals length.
78
Well, the issue here is that length holds a negative value.
79
It is a large negative error code.
80
So instead of actually moving the end of that cursor of parsing forward, the pointer moves backwards.
81
It'll go backwards by the size or the value of error bad structure, which is negative 11th.
82
And then it will increment that and add a slash.
83
As the amount of code generated by AI increases, one thing that scares me is the ability to maintain that volume of code.
84
And that's why today's video is sponsored by CodeRabbit.
85
CodeRabbit is an AI code review tool that helps engineers manage the world of AI generated PRs.
86
For one of my platforms, Lillava Labs, I added a feature to add bookmarks to the site, right? a fairly simple feature, but adding new API endpoints like anything does create potential new security vulnerabilities
87
and someone at the end of the day has to review this code.
88
Now CodeRabbit's new change stack feature makes this really, really easy.
89
If you go to the PR overview page, you get a nice walkthrough of how the code changed, what the major changes are, and also it does some really nice things where it generates diagrams for you
90
that you can easily put into your code's documentation.
91
One of the hardest things about a growing code base is not only tech debt, but knowledge debt, right?
92
Making sure there's documentation that explains exactly how the code works.
93
Now, if you go inside the change stack, you actually see that there's layers here.
94
What CodeRabbit is doing is breaking down the PR into the separate layers that it affects, right?
95
We have the first layer, which is just the bookmark system, right?
96
These single couple of Go files that maintain the bookmarks.
97
But what's even more important is you get a very clean view here of, okay, now how does this system integrate to the overall backend API?
98
This gives you your semantic diff of the code base, showing you what changes and how it changes as a function of the new feature.
99
You know, then we have the last layer here.
100
We have the TypeScript interface
101
that shows you how the new webpage created for the bookmarks is integrated into the rest of the TypeScript system.
102
Breaking down the PR like this, guys, gives you a much better idea of exactly what the PR does.
103
You can go through and review the code, obviously, but knowing systematically how it affects the overall code base is a much cleaner path to a secure development life cycle.
104
And guys, CodeRabbit is used all over the world.
105
You can actually try CodeRabbit for free at this URL below.
106
Go try CodeRabbit out and see if your pull request needs some more work and if CodeRabbit can help you get there.
107
Thank you for sponsoring the video, CodeRabbit.
108
Let's get back to it.
109
So the end result is like actually beautiful, right?
110
So what you have here is a stack frame for the function in question, right?
111
You have the stack frame for this function and you have this end pointer, right?
112
So it's end is this and it's saying end plus equals length.
113
So the pointer for end should go up and up and up the stack grows more positively down.
114
That is important for you to know.
115
If you don't know that, you should know that watching this channel.
116
Damn it.
117
But what's actually happening is we have another stack frame above us, and every time we exploit this vulnerability with these sections that have bad names, that don't have a slash in them,
118
we're actually subtracting the end pointer back and back and back, 11 bytes at a time,
119
until eventually the end pointer points to the return address of the previous stack frame.
120
And I know you're thinking, if you're like a binary exploiter person, and you're like, wait, if this is its own stack frame here, isn't there nothing above it?
121
Well, no, the actual, the contents of this buffer lives in another stack frame below it.
122
So just trust me, this is how it works.
123
So N goes up, up, up.
124
And then using a new malformed section name that does have a slash,
125
we can write arbitrary data we want to the program counter and get it to return to whatever address we want.
126
Again, if this is, you know, 32-bit, like ARM, we're going to have like A, A, A, B, right?
127
And if you're new to the world of exploitation, right, what's happening here, by overriding the program counter value,
128
we now have the ability to arbitrarily run or at least point the CPU to a place to run other code, right?
129
Like we could have put code in like another part of the image
130
and we can like wrap around to like mProtect or whatever, like set the page table entry to make it executable.
131
We do a bunch of evil stuff, right?
132
The end goal here is
133
that we're able to run code in the context of a bootloader that is doing signature verification without a valid signature.
134
We are exploiting the code that is doing signature verification, and this could invalidate an entire secure boot-like process.
135
I want to highlight that this in and of itself is not secure boot.
136
This image would have to be signed by a secure boot key, like the manufacturer key that the actual motherboard has.
137
But that being said, right, it's a really interesting primitive in the world of U-Boot, of bootloader vulnerabilities.
138
Not going to dive super deep into a ton of these, but you have another bunch of vulnerabilities, like, you know, the same kind of bug, denial of service in U-Boot using an FIT image signature because of an unchecked size value.
139
There are other parts of the code that use a name pointer where that name pointer can be null pointer.
140
And because of that, it's going to do a bunch of other stuff.
141
There's a whole bunch of interesting bugs on this write-up.
142
I'll put it in the description below.
143
But it's an interesting case study in the world of U-Boot, of bootloader vulnerabilities.
144
And the question for the class, the question that everyone probably wants to know the answer to, would Rust have fixed this?
145
Sort of.
146
So again, U-Boot, the whole point of this is to have the CPU be brought up, the CPU runs a bootloader, the bootloader then enables the OS, right?
147
We are at the super, super low level, name of the channel, by the way, in the boot process, okay?
148
Now, doing this in Rust is actually like there are these things called peripheral access crates
149
or these things called hardware abstraction layer crates
150
that allow you to write code that is not unsafe for the board in question.
151
That being said, doing things like raw MMIO
152
that maybe there isn't a peripheral extraction crate written for is very hard to do.
153
And it always does depend on unsafe code, even inside of the peripheral abstraction crates or access crates.
154
There is there has to be by the nature of how embedded software works, right?
155
It's global mutability, which is what Rust is designed to get rid of.
156
Inside of even this code, there has to be a piece of unsafe code, unfortunately.
157
But that being said, it's possible, just not easy.
158
And yes, Rust would have fixed bugs like this, right?
159
You would, well, actually, kind of think about it.
160
I don't think you're able to fix this bug
161
because all you're doing here is writing out to a pointer and a value, right?
162
And then from there, it's causing the underflow.
163
So I'm not necessarily sure if that's the case.
164
You can't raw pointers in rust
165
so there you go that's that's the answer actually you know the rust um error
166
and not error the the okay and error type the result type would fix this
167
because what this is actually the classical issue in c where
168
you're using the error code in the error state as the
169
actual value slot right this is like the entire problem
170
that the rust t e or rust result type fixes
171
and before we leave by the way in the code here what we're showing you
172
so what i did here is i i wrote um i compiled uboot the vulnerable version
173
which there is no patch for by the way yet.
174
I compiled UBoot to run in QMU.
175
QMU is like a system emulator, emulates an arm chip.
176
And then I ran UBoot and I tried to signature validate with the FIT image that has the vulnerable structures in it.
177
And then by using this, I was able to take control of the registers that are put on the stack, right?
178
So R10, the frame pointer, and ultimately PC, where PC is the return address that we're going to execute next, right?
179
And by doing that, this proves
180
that I have at least the the ability to point the CPU to other places in the code
181
that I want to run my evil stuff right now.
182
Obviously, the question of like NX and ASLR comes up, but that is a different question for a different video.
183
Anyway, thank you for watching, guys.
184
I appreciate it.
185
If you like this stuff, check out my other stuff, and then give me a little kiss on the cheek.
186
Okay, we'll see you later.
187
Goodbye.
📺 Mismo canal
✨ Recomendar Video
C13
173 oraciones
STOP Running Code On Your Computer
Business EnglishUniversity StudentsWorking Adults
C13
263 oraciones
Even Valve is Disappointed - Steam Machine Review
Business EnglishUniversity StudentsWorking Adults
C1101 oraciones
BGP Overview
Business EnglishUniversity StudentsWorking Adults
C167 oraciones
The Ultimate IoT Roadmap in 2026? | Embedded Systems & IoT Career Roadmap
Business EnglishUniversity StudentsWorking Adults
C13
190 oraciones
MySQL took 21 years to fix this bug
Business EnglishUniversity StudentsWorking Adults
C11
364 oraciones
Running AI Agents in Secure Sandboxes with E2B & Docker MCP | Docker’s AI Guide to the Galaxy
Business EnglishUniversity StudentsWorking Adults
C11
207 oraciones
How I Made $30,000 Hacking Broken Access Control
Business EnglishUniversity StudentsWorking Adults
C15
194 oraciones
Microbit lesson 1 introduction
Business EnglishUniversity StudentsWorking Adults
C1155 oraciones
Every Hardware Protocol Explained Simply in 10 Minutes!
Business EnglishUniversity StudentsWorking Adults
B22
252 oraciones
Memory is crazy expensive so I made my own…
Business EnglishUniversity StudentsWorking Adults
C11
146 oraciones
🚫 Java Deadlock Explained: Why Your Code is Stuck 😱 (Beginners Must Watch!)
Business EnglishUniversity StudentsWorking Adults
C11
197 oraciones
Unreal Engine 5.8 - Experimental MCP Server Support Walkthrough | State of Unreal 2026
Business EnglishUniversity StudentsWorking Adults
Vocabulario y notas de pronunciación para esta lección
Este vídeo tiene 187 frases y 2645 palabras para practicar shadowing. La parte hablada dura 12:14. El hablante habla rápido, unas 216 palabras por minuto, así que espera sonidos enlazados y reducidos. El 82 % de las palabras está entre las 3.000 más comunes del inglés; conviene repasar el resto antes de empezar.
Vocabulario clave de este vídeo
15 palabras del vídeo que vale la pena aprender, con su pronunciación y significado:
| Palabra | Pronunciación | Significado |
|---|---|---|
| boot sustantivo | /but/ | bota |
| vulnerability sustantivo | /ˌvʌln(ə)ɹəˈbɪlɪti/ | vulnerabilidad |
| pointer sustantivo | /ˈpɔɪn.təɹ/ | puntero |
| signature sustantivo | /ˈsɪɡ.nə.t͡ʃə/ | firma, rúbrica |
| stack sustantivo | /stæk/ | pila, montón |
| rust sustantivo | /ɹʌst/ | óxido, herrumbre |
| verification sustantivo | /ˌvɛ.ɹə.fɪˈkeɪ.ʃən/ | verificación |
| layer sustantivo | /ˈleɪ̯ɚ/ | capa, tongada |
| manufacturer sustantivo | /ˌmænjʊˈfæktʃəɹə/ | fabricante, fabriquero |
| exploit sustantivo | /ˈɛksplɔɪt/ | hazaña, proeza |
| format sustantivo | /ˈfɔːɹ.mæt/ | formato |
| generate verbo | /ˈd͡ʒɛn.ə.ɹeɪt/ | generar |
| bug sustantivo | /bʌɡ/ | chinche |
| lend verbo | /ˈlɛnd/ | prestar, emprestar |
| verify verbo | /ˈvɛɹɪfaɪ/ | verificar |
Phrasal verbs que vas a escuchar
| Palabra | Significado |
|---|---|
| break down verbo | descomponerse, averiarse |
| bring up verbo | levantar, alzar |
| check out verbo | investigar, chequear |
| come up verbo | salir a relucir |
| get back to verbo | responder / contestar (en un rato), volver / tornar a contactar |
| go through verbo | atravesar |
| go up verbo | subir |
Pronunciación a tener en cuenta
El hablante usa 39 contracciones y formas reducidas, como we're, you're, don't. Dilas en su forma corta, tal como las oyes.
- Los sonidos de “th”: thread /ˈθɹɛd/, algorithm /ˈælɡəɹɪðm̩/, motherboard /ˈmʌðɚˌbɔɹd/, walkthrough /ˈwɔːk.θɹuː/
- Los sonidos de “sh” y “zh”: verification /ˌvɛ.ɹə.fɪˈkeɪ.ʃən/, documentation /ˌdɑkjəmɛnˈteɪʃən/, exploitation /ˌɛksplɔɪˈteɪʃn̩/, extraction /ɪkˈstɹækʃən/, encryption /ɪnˈkɹɪpʃən/
- Palabras largas — cuida el acento: vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, verification /ˌvɛ.ɹə.fɪˈkeɪ.ʃən/, manufacturer /ˌmænjʊˈfæktʃəɹə/, peripheral /pəˈɹɪf(ə)ɹ(ə)l/, documentation /ˌdɑkjəmɛnˈteɪʃən/
Cómo practicar con este vídeo
- Escucha el vídeo entero una vez sin hablar y anota las palabras que no conoces.
- Empieza a velocidad 0,75×, haz shadowing frase por frase y vuelve a la velocidad normal cuando te resulte fácil.
- Grábate y compara con el original, prestando atención a palabras como boot, vulnerability, pointer.
Gramática en este vídeo
Las estructuras que más usa el hablante, con las palabras exactas del vídeo:
| Estructura | En el vídeo |
|---|---|
| Voz pasiva be + participio pasado — importa lo que ocurre, no quién lo hace | was found · is not meant · is allowed |
| Oraciones de relativo who / which + oración — información extra sobre una persona o cosa | getName, which is · structure, which is · layer, which is |
| Present perfect have/has + participio pasado — una acción pasada que sigue importando ahora | I've done · have fixed |
¿Qué es la Técnica de Shadowing?
Shadowing es una técnica de aprendizaje de idiomas respaldada por la ciencia, desarrollada originalmente para la formación de intérpretes profesionales y popularizada por el políglota Dr. Alexander Arguelles. El método es simple pero poderoso: escuchas audio en inglés nativo y lo repites en voz alta de inmediato, como una sombra que sigue al hablante con solo 1-2 segundos de retraso. A diferencia de la escucha pasiva o los ejercicios de gramática, el shadowing obliga a tu cerebro y músculos de la boca a procesar y reproducir simultáneamente patrones de habla reales. Las investigaciones muestran que mejora significativamente la precisión de la pronunciación, la entonación, el ritmo, el habla conectada, la comprensión auditiva y la fluidez al hablar, convirtiéndola en una de las metodologías más efectivas para la preparación del IELTS Speaking y la comunicación en inglés en el mundo real.