Recon 2010 - Attacking Hexagon Security Analysis of Qualcomm's ADSP by Dimitrios Tatsis

### Overview In this talk, security researcher Dimitrios Tatsis explores the security architecture and attack surface of Qualcomm's Application Digital Signal Processor (aDSP) and its underlying Hexagon architecture. Originally prompted by auditing attack vectors in the Android kernel, the researcher delves into how the aDSP functions as an auxiliary low-power, high-performance coprocessor running Qualcomm's proprietary real-time operating system, QuRT. The presentation details inter-processor communication via the FastRPC framework, reverse engineering tooling, executing custom code on development hardware, and early fuzzing campaigns targeting exposed DSP libraries.

### Key Topics - **Hexagon Architecture & QuRT**: Hexagon is a 32-bit Very Long Instruction Word (VLIW), little-endian architecture with four parallel execution units executing instruction packets. It shares architectural heritage with Qualcomm's baseband processor. QuRT provides scheduling, memory management, and privileges across QuRT OS, guest OS, and user modes. It lacks ASLR but features stack cookies, write XOR execute memory protections, and basic heap corruption protections. - **FastRPC Framework**: Communication between Android user space and the aDSP relies on the FastRPC framework over Qualcomm's shared memory subsystem. User-space stub libraries call into `libadsprpc`, invoking ioctl commands (`IOCTL_INIT`, `IOCTL_INVOKE`, `IOCTL_MMAP`) on `/dev/adsprpc-smd`. In aDSP user space, `fastrpc_shell_0` and auto-generated 'skel' (skeleton) libraries unmarshal parameters to execute target DSP functions. - **Memory Management & Isolation**: Memory transfers rely on Android's ION allocator to carve out contiguous physical memory. Address translation and isolation are enforced via an SMMU and Memory Protection Unit (MPU), managed by TrustZone via Secure Channel Manager (SCM) calls from the kernel driver. - **Tooling & Reverse Engineering**: Native disassembler support for Hexagon is limited in major frameworks like IDA Pro and Ghidra. Tatsis evaluates existing plugins (Hexagon plugin, GMSK IDA plugin, Radare2) and discusses implementing custom processor module definitions in Ghidra's SLEIGH language to support instruction packet decoding.

### Technical Details - **Running Custom Code**: On production devices, DSP libraries residing in `/vendor/lib/rfsa/adsp` must be signed with Qualcomm keys, and `/dev/adsprpc-smd` is restricted by SELinux. Tatsis bypassed signature restrictions by utilizing an Inforce Open-Q 820 development board (Snapdragon 820 / MSM8996) where debug fuses were enabled. Custom shared libraries could be executed by generating a `testsig.so` using the Hexagon SDK and the board's serial number. - **Fuzzing FastCV**: Tatsis audited the `fastcvadsp_skel` unmarshaling library for Qualcomm's FastCV computer vision library. The skel code verifies method indices against an upper bound (`0x1f`) and enforces minimum argument counts, but does not reject excess arguments. A fuzzer sending randomized buffers repeatedly triggered SMMU faults (returning error code `0x27` / 39) that halted further communication until session restart. - **System Handle Fuzzing**: Direct invocation of system handle `1` (used internally by the kernel for system setup tasks such as `remote_handle_open`) with random method indices and arguments immediately crashed the Open-Q 820 board (running Android 7), producing a fatal aDSP subsystem failure in kernel logs. Testing on a Google Pixel 3 (Snapdragon 845, Android 9/Pie) did not reproduce the crash.

### Takeaways The aDSP presents a rich and exposed attack surface handling untrusted multimedia and sensor data, with FastRPC bridging user applications to DSP components. While memory protection mechanisms like the SMMU and MPU restrict rogue memory accesses, crashes in system handles and SMMU faults illustrate potential vectors for denial-of-service or privilege boundary traversal. Further research requires improved debugging capabilities, refined SLEIGH/Ghidra disassembly modules, and deeper auditing of QuRT and TrustZone interactions.