Home

Awesome

Firmware Analysis Toolkit

FAT is a toolkit built in order to help security researchers analyze and identify vulnerabilities in IoT and embedded device firmware. This is also used in the "Offensive IoT Exploitation" training conducted by Attify.

Note:

Firmware Analysis Toolkit (FAT henceforth) is based on Firmadyne with some changes. Firmadyne uses a PostgreSQL database to store information about the emulated images. However just for the core functionality i.e. emulating firmware, PostgreSQL is not really needed. Hence FAT doesn't use it.

Setup instructions

FAT is developed in Python 3. However you need to have both Python 3 and Python 2 installed since parts of Firmadyne and its dependencies use Python 2. It's highly recommended to install FAT inside a Virtual Machine.

To install just clone the repository and run the script ./setup.sh.

git clone https://github.com/attify/firmware-analysis-toolkit
cd firmware-analysis-toolkit
./setup.sh

After installation is completed, edit the file fat.config and provide the sudo password as shown below. Firmadyne requires sudo privileges for some of its operations. The sudo password is provided to automate the process.

[DEFAULT]
sudo_password=attify123
firmadyne_path=/home/attify/firmadyne

Running FAT

$ ./fat.py <firmware file>

Congrats! The firmware is finally emulated.

To remove all analyzed firmware images, run

$ ./reset.py

Example 1

$ ./fat.py DIR-601_REVB_FIRMWARE_2.01.BIN 

                               __           _   
                              / _|         | |  
                             | |_    __ _  | |_ 
                             |  _|  / _` | | __|
                             | |   | (_| | | |_ 
                             |_|    \__,_|  \__|                    
                    
                Welcome to the Firmware Analysis Toolkit - v0.3
    Offensive IoT Exploitation Training http://bit.do/offensiveiotexploitation
                  By Attify - https://attify.com  | @attifyme
    
[+] Firmware: DIR-601_REVB_FIRMWARE_2.01.BIN
[+] Extracting the firmware...
[+] Image ID: 1
[+] Identifying architecture...
[+] Architecture: mipseb
[+] Building QEMU disk image...
[+] Setting up the network connection, please standby...
[+] Network interfaces: [('br0', '192.168.0.1')]
[+] All set! Press ENTER to run the firmware...
[+] When running, press Ctrl + A X to terminate qemu

Asciicast

asciicast

Example 2

$ ./fat.py DIR890A1_FW103b07.bin --qemu 2.5.0

                               __           _
                              / _|         | |
                             | |_    __ _  | |_
                             |  _|  / _` | | __|
                             | |   | (_| | | |_
                             |_|    \__,_|  \__|

                Welcome to the Firmware Analysis Toolkit - v0.3
    Offensive IoT Exploitation Training http://bit.do/offensiveiotexploitation
                  By Attify - https://attify.com  | @attifyme

[+] Firmware: DIR890A1_FW103b07.bin
[+] Extracting the firmware...
[+] Image ID: 2
[+] Identifying architecture...
[+] Architecture: armel
[+] Building QEMU disk image...
[+] Setting up the network connection, please standby...
[+] Network interfaces: [('br0', '192.168.0.1'), ('br1', '192.168.7.1')]
[+] Using qemu-system-arm from /home/attify/firmware-analysis-toolkit/qemu-builds/2.5.0
[+] All set! Press ENTER to run the firmware...
[+] When running, press Ctrl + A X to terminate qemu

Additional Notes

Known Issues

Building static Qemu

The repository already includes a static builds of qemu 2.0.0, 2.5.0 & 3.0.0 (in releases) but if you want to build your own follow the steps below.

On a clean Ubuntu 16.04 VM run. (It's important to use 16.04, later versions have issues with static compilation).

Qemu 2.0.0

sudo apt update && sudo apt build-dep qemu -y
wget https://download.qemu.org/qemu-2.0.0.tar.bz2
tar xf qemu-2.0.0.tar.bz2
mkdir qemu-2.0.0-build
cd qemu-2.0.0
./configure --prefix=$(realpath ../qemu-2.0.0-build) --static --target-list=arm-softmmu,mips-softmmu,mipsel-softmmu --disable-smartcard-nss --disable-spice --disable-libusb --disable-usb-redir
make
make install

The compiled binaries can be found in qemu-2.0.0-build directory.

Qemu 2.5.0

sudo apt update && sudo apt build-dep qemu -y
wget https://download.qemu.org/qemu-2.5.0.tar.bz2
tar xf qemu-2.5.0.tar.bz2
mkdir qemu-2.5.0-build
cd qemu-2.5.0
./configure --prefix=$(realpath ../qemu-2.5.0-build) --static --target-list=arm-softmmu,mips-softmmu,mipsel-softmmu --disable-smartcard --disable-libusb --disable-usb-redir
make 
make install

The compiled binaries can be found in qemu-2.5.0-build directory.

Qemu 3.0.0

sudo apt update && sudo apt build-dep qemu -y
wget https://download.qemu.org/qemu-3.0.0.tar.bz2
tar xf qemu-3.0.0.tar.bz2
mkdir qemu-3.0.0-build
cd qemu-3.0.0
./configure --prefix=$(realpath ../qemu-3.0.0-build) --static --target-list=arm-softmmu,mips-softmmu,mipsel-softmmu --disable-smartcard --disable-libusb --disable-usb-redir
make 
make install

The compiled binaries can be found in qemu-3.0.0-build directory.

Note: It should also be possible to compile qemu statically on an alpine system but this hasn't been tested. In general compiling on alpine is preferred to Ubuntu as the former comes with musl libc which is better at static linkage than glibc on Ubuntu.