forked from fkie-cad/fact_extractor
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request fkie-cad#12 from m-1-k-3/pre-checker
Binary blob testing
- Loading branch information
Showing
8 changed files
with
229 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| #!/bin/bash | ||
|
|
||
| # emba - EMBEDDED LINUX ANALYZER | ||
| # | ||
| # Copyright 2020 Siemens Energy AG | ||
| # | ||
| # emba comes with ABSOLUTELY NO WARRANTY. This is free software, and you are | ||
| # welcome to redistribute it under the terms of the GNU General Public License. | ||
| # See LICENSE file for usage of this software. | ||
| # | ||
| # emba is licensed under GPLv3 | ||
| # | ||
| # Author(s): Michael Messner, Pascal Eckmann | ||
|
|
||
| P02_firmware_bin_file_check() { | ||
| module_log_init "firmware_bin_file_log" | ||
| module_title "Binary firmware file analyzer" | ||
|
|
||
| local FILE_BIN_OUT | ||
| FILE_BIN_OUT=$(file "$FIRMWARE_PATH") | ||
| local FILE_LS_OUT | ||
| FILE_LS_OUT=$(ls -lh "$FIRMWARE_PATH") | ||
|
|
||
| print_output "[*] Details of the binary file:" | ||
| print_output "$(indent "$FILE_LS_OUT")" | ||
| print_output "$(indent "$FILE_BIN_OUT")" | ||
|
|
||
| # probably we can do a lot more stuff in the future ... | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| #!/bin/bash | ||
|
|
||
| # emba - EMBEDDED LINUX ANALYZER | ||
| # | ||
| # Copyright 2020 Siemens Energy AG | ||
| # | ||
| # emba comes with ABSOLUTELY NO WARRANTY. This is free software, and you are | ||
| # welcome to redistribute it under the terms of the GNU General Public License. | ||
| # See LICENSE file for usage of this software. | ||
| # | ||
| # emba is licensed under GPLv3 | ||
| # | ||
| # Author(s): Michael Messner, Pascal Eckmann | ||
|
|
||
| P05_firmware_bin_extractor() { | ||
| module_log_init "firmware_bin_extractor_log" | ||
| module_title "Binary firmware extractor" | ||
|
|
||
| binwalking | ||
| # probably we can do something more in the future | ||
| } | ||
|
|
||
| binwalking() { | ||
| sub_module_title "Analyze binary firmware blob with binwalk" | ||
|
|
||
| local MAIN_BINWALK | ||
| print_output "[*] basic analysis with binwalk" | ||
| MAIN_BINWALK=$(binwalk "$FIRMWARE_PATH") | ||
| echo "$MAIN_BINWALK" | ||
|
|
||
| echo | ||
| print_output "[*] Entropy testing with binwalk ... " | ||
| print_output "$(binwalk -E -F -J "$FIRMWARE_PATH")" | ||
| mv "$(basename "$FIRMWARE_PATH".png)" "$LOG_DIR"/"$(basename "$FIRMWARE_PATH"_entropy.png)" 2> /dev/null | ||
|
|
||
| # This test takes a long time and so I have removed it | ||
| # we come back to this topic later on - leave it here for the future | ||
| #print_output "\n[*] Architecture testing with binwalk ... could take a while" | ||
| #binwalk -Y "$FIRMWARE_BIN_PATH" | ||
|
|
||
| OUTPUT_DIR=$(basename "$FIRMWARE_PATH") | ||
| OUTPUT_DIR="$LOG_DIR"/"$OUTPUT_DIR"_binwalk_emba | ||
|
|
||
| echo | ||
| print_output "[*] Extracting firmware to directory $OUTPUT_DIR" | ||
| print_output "$(binwalk -e -M -C "$OUTPUT_DIR" "$FIRMWARE_PATH")" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| #!/bin/bash | ||
|
|
||
| # emba - EMBEDDED LINUX ANALYZER | ||
| # | ||
| # Copyright 2020 Siemens Energy AG | ||
| # | ||
| # emba comes with ABSOLUTELY NO WARRANTY. This is free software, and you are | ||
| # welcome to redistribute it under the terms of the GNU General Public License. | ||
| # See LICENSE file for usage of this software. | ||
| # | ||
| # emba is licensed under GPLv3 | ||
| # | ||
| # Author(s): Michael Messner, Pascal Eckmann | ||
|
|
||
| P07_firmware_bin_base_analyser() { | ||
| module_log_init "firmware_bin_base_analyser_log" | ||
| module_title "Binary firmware OS detection" | ||
|
|
||
| os_identification | ||
| } | ||
|
|
||
| os_identification() { | ||
|
|
||
| # We can improve this search stuff a lot in the future: | ||
| COUNTER_Linux="$(find "$OUTPUT_DIR" -type f -exec strings {} \; | grep -c Linux 2> /dev/null)" | ||
| COUNTER_Linux_FW="$(strings "$FIRMWARE_PATH" | grep -c Linux 2> /dev/null)" | ||
| COUNTER_Linux=$((COUNTER_Linux+COUNTER_Linux_FW)) | ||
|
|
||
| COUNTER_VxWorks="$(find "$OUTPUT_DIR" -type f -exec strings {} \; | grep -c VxWorks 2> /dev/null)" | ||
| COUNTER_VxWorks_FW="$(strings "$FIRMWARE_PATH" | grep -c VxWorks 2> /dev/null)" | ||
| COUNTER_VxWorks=$((COUNTER_VxWorks+COUNTER_VxWorks_FW)) | ||
|
|
||
| COUNTER_FreeRTOS="$(find "$OUTPUT_DIR" -type f -exec strings {} \; | grep -c FreeRTOS 2> /dev/null)" | ||
| COUNTER_FreeRTOS_FW="$(strings "$FIRMWARE_PATH" | grep -c FreeRTOS 2> /dev/null)" | ||
| COUNTER_FreeRTOS=$((COUNTER_FreeRTOS+COUNTER_FreeRTOS_FW)) | ||
|
|
||
| COUNTER_eCos="$(find "$OUTPUT_DIR" -type f -exec strings {} \; | grep -c eCos 2> /dev/null)" | ||
| COUNTER_eCos_FW="$(strings "$FIRMWARE_PATH" | grep -c eCos 2> /dev/null)" | ||
| COUNTER_eCos=$((COUNTER_eCos+COUNTER_eCos_FW)) | ||
|
|
||
| if [[ $((COUNTER_VxWorks+COUNTER_FreeRTOS+COUNTER_eCos)) -gt 0 ]] ; then | ||
| print_output "$(indent "$(orange "Operating system detection:")")" "no_log" | ||
| if [[ $COUNTER_VxWorks -gt 0 ]] ; then print_output "$(indent "$(orange "VxWorks ""$COUNTER_VxWorks")")" "no_log" ; fi | ||
| if [[ $COUNTER_FreeRTOS -gt 0 ]] ; then print_output "$(indent "$(orange "FreeRTOS ""$COUNTER_FreeRTOS")")" "no_log" ; fi | ||
| if [[ $COUNTER_eCos -gt 0 ]] ; then print_output "$(indent "$(orange "eCos ""$COUNTER_eCos")")" "no_log" ; fi | ||
| if [[ $COUNTER_Linux -gt 0 ]] ; then print_output "$(indent "$(orange "Linux ""$COUNTER_Linux")")" "no_log"; fi | ||
| fi | ||
|
|
||
| echo | ||
| print_output "[*] Trying to identify a Linux root path in $OUTPUT_DIR" | ||
| # just to check if there is somewhere a linux filesystem in the extracted stuff | ||
| # emba is able to handle the rest | ||
| LINUX_PATH_COUNTER="$(find "$OUTPUT_DIR" "${EXCL_FIND[@]}" -type d -iname bin -o -type d -iname busybox -o -type d -iname sbin -o -type d -iname etc 2> /dev/null | wc -l)" | ||
| if [[ $LINUX_PATH_COUNTER -gt 0 ]] ; then | ||
| print_output "[+] Found possible Linux system in $OUTPUT_DIR" | ||
| export FIRMWARE=1 | ||
| export FIRMWARE_PATH="$OUTPUT_DIR" | ||
| fi | ||
| } |