A method and system for security detection of smart IoT device firmware based on decompilation

Abstract

The present invention belongs to the field of IoT device firmware security, and provides a method and system for intelligent IoT device firmware security detection based on decompilation. It determines whether the firmware is a firmware with an operating system according to a firmware file to be detected. If so, the firmware is unpacked, and the operating system of the firmware is multi-classified to obtain a classification result. The firmware information is identified according to the characteristics of the firmware file corresponding to the category. Otherwise, the firmware information is directly identified, and decompilation is performed based on the identified firmware information. The binary instructions of the firmware are disassembled into assembly language, and then the assembly language is parsed into a high-level language. The firmware security detection is performed based on the high-level language to obtain the firmware security detection result.

Description

Technical Field

[0001] The present invention belongs to the field of IoT device firmware security, and in particular relates to a decompilation-based smart IoT device firmware security detection method and system. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In the era of "Internet of Everything", with the country's emphasis on the Industrial Internet and the Internet of Things, as well as the rapid development of application fields such as the Internet of Vehicles and smart homes, embedded software security issues are receiving more and more attention. Compared with computing and mobile devices, a considerable number of embedded devices are considered specialized and rarely undergo firmware code audits, security testing and other processes before product launch. In addition, the system architecture of embedded devices is different from that of general devices, and they often lack responsive security mechanisms.

[0004] Currently, most manufacturers who value firmware security rely on manual security analysis and testing. Although automated testing has a certain false positive rate, it can assist security researchers in security testing on the one hand, and can quickly, streamline and save costs to discover the most possible security issues on the other hand. The industry has tried to apply the automated vulnerability mining methods of general computing systems with relatively good applications to embedded devices, but the application effect has always been limited by the following problems of embedded devices: 1. Complex heterogeneity of the underlying hardware platform; 2. Strong specialization, source code and documents are not open; 3. Limited operating environment; 4. Embedded device programs are different from general PC programs.

[0005] The invention patent with publication number CN 111680295 A discloses a method for constructing firmware security detection for IoT terminal devices. Since the operating efficiency is low due to the complexity of firmware stripping, it provides efficient security detection by automation compared with manual detection. However, it does not propose a general security detection solution (supporting most firmware types) for embedded devices, such as complex heterogeneity of the underlying platform and specialized customization. Summary of the invention

[0006] In order to solve at least one technical problem existing in the above-mentioned background technology, the present invention provides a method and system for security detection of intelligent IoT device firmware based on decompilation, which solves the problem of difficulty in program automated security analysis caused by the complex heterogeneity and specialized customization of the underlying platform of IoT firmware, and can automatically unpack and perform security analysis on all types of firmware to the greatest extent. Among them, the security detection of firmware code solves the problems of low efficiency of manual analysis and slow location of security issues, and can also be used as an efficient tool to assist manual code security audit.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] The first aspect of the present invention provides a method for security detection of smart IoT device firmware based on decompilation, comprising the following steps:

[0009] Get the firmware file to be tested of the smart IoT device;

[0010] According to the firmware file to be detected, determine whether the firmware is a firmware with an operating system. If so, unpack the firmware, perform multi-level classification of the firmware's operating system to obtain a classification result, and identify the firmware information according to the characteristics of the corresponding category of the firmware file. Otherwise, directly identify the firmware information, decompile based on the identified firmware information, deassemble the firmware's binary instructions into assembly language, and then parse the assembly language into a high-level language. Perform firmware security detection based on the high-level language to obtain a firmware security detection result.

[0011] A second aspect of the present invention provides a smart IoT device firmware security detection system based on decompilation, comprising:

[0012] The firmware acquisition module is configured to: acquire the firmware file to be detected of the smart IoT device;

[0013] The firmware security detection module is configured to: determine whether the firmware is an operating system-type firmware based on the firmware file to be detected; if so, unpack the firmware, perform multi-level classification of the firmware's operating system to obtain a classification result, identify the firmware information based on the characteristics of the firmware file corresponding to the category, otherwise directly identify the firmware information, decompile based on the identified firmware information, deassemble the firmware's binary instructions into assembly language, and then parse the assembly language into a high-level language, and perform firmware security detection based on the high-level language to obtain a firmware security detection result.

[0014] A third aspect of the present invention provides a computer-readable storage medium.

[0015] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps in the above-mentioned method for security detection of firmware of smart IoT devices based on decompilation.

[0016] A fourth aspect of the present invention provides a computer device.

[0017] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the above-mentioned method for firmware security detection of smart IoT devices based on decompilation are implemented.

[0018] Compared with the prior art, the present invention has the following beneficial effects:

[0019] The decompiled firmware security detection method of the present invention classifies and detects the firmware types to support as many firmwares as possible, implements the automatic acquisition technology of the firmware loading address for RTOS-type systems, and implements the automatic white-box security audit technology for the firmware code after decompilation, which solves the problem of difficulty in program automation security analysis caused by the complex heterogeneity and specialized customization of the underlying platform of the Internet of Things firmware to a certain extent, and can automatically unpack and perform security analysis on all types of firmware to the greatest extent. Among them, the security detection of the firmware code solves the problems of low efficiency of manual analysis and slow location of security issues, and can also be used as an efficient tool to assist manual code security audits. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0021] Figure 1 It is a flowchart of the program execution of the firmware security detection method based on decompilation;

[0022] Figure 2 Schematic diagram of IDA Pro decompiling and security checking firmware code. DETAILED DESCRIPTION

[0023] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0025] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0026] Embodiment 1

[0027] This embodiment provides a universal firmware security detection method for all types of firmware as much as possible, without the need for source code, without relying on Agent, and black box scanning of binary files. One-step submission, fully automated detection and report display. The highlights are: the classification detection of firmware types is realized to support as many firmwares as possible, the automatic acquisition technology for firmware loading addresses of RTOS-type systems, and the automatic white box security audit technology for firmware code after decompilation.

[0028] like Figure 1 As shown, this embodiment provides a smart IoT device firmware security detection method based on decompilation, including the following steps:

[0029] Step 1: Get the firmware file to be tested of the smart IoT device;

[0030] Step 2: Determine whether the firmware is an operating system-type firmware based on the firmware file to be detected. If so, unpack the firmware, perform multi-level classification of the firmware's operating system to obtain a classification result, and identify the firmware information based on the characteristics of the firmware file corresponding to the category. Otherwise, directly identify the firmware information, decompile based on the identified firmware information, deassemble the firmware's binary instructions into assembly language, and then parse the assembly language into a high-level language. Perform firmware security detection based on the high-level language to obtain a firmware security detection result.

[0031] Step 3: All firmware information identification results and firmware security detection results are persistently stored and rendered for display.

[0032] In step 1, the firmware file to be detected of the smart IoT device is uploaded to the firmware detection designated directory, and only .bin and .zip firmware files are supported.

[0033] In step 2, the firmware is unpacked and the operating system of the firmware is classified into multiple levels, including: the first level classification is to determine whether the type of the operating system is a firmware with an operating system or a firmware without an operating system based on the system level; if the first level operating system is a firmware with an operating system, a second level classification is performed, and the second level classification is classified according to the file system, which can be Squashfs, YAFFS2, JFFS2, etc.; after determining the type of the file system, a third level classification is performed, and the third level classification is performed again according to the architecture of the executable binary file in the file system (instruction architecture, data size end, etc.) to obtain the final classification result.

[0034] Among them, in the first level classification, the type of the operating system of the firmware is determined based on the echoed significant features, whether it is a firmware with an operating system or a firmware without an operating system;

[0035] Run the Linux command File-i xxxx.bin. Based on the prominent features in the command output, you can distinguish application / x-executable from executable file firmware without an operating system and application / octet-stream from firmware with an operating system.

[0036] Among them, the firmware without operating system, that is, the single file is an executable file firmware, and the firmware with operating system includes: general operating system firmware (Unix / Linux, openwrt, Win-CE, WinXp-Embedded) and real-time operating system firmware (VxWorks, FreeRTOS, uC / OS, RT-Thread, eCos, etc.), and different types of firmware processing flow classification are classified and processed by features.

[0037] In step 2, use binwalk and firmware-mod-kit to unpack the firmware;

[0038] In the above process, the following situations often occur:

[0039] 1) The firmware is a single executable file with no other compressed data;

[0040] 2) The firmware file is encrypted or the firmware itself is incremental update data, which makes it impossible to analyze;

[0041] 3) The magic number in the firmware is found and cannot be analyzed.

[0042] Except for abnormal situations, an .extracted folder will be generated after unpacking, which includes the unpacked firmware files. According to different file systems, they are divided into Squashfs, Cramfs and other file systems, and then judgment can be made based on different characteristics.

[0043] In step 2, the firmware information identification process includes: judging whether the firmware is an executable file firmware according to the firmware file to be detected, if so, detecting the CPU arch, endian and other information through binwalk, otherwise there is an operating system, and detecting related information through feature matching retrieval of the firmware file, including the type and version of the operating system, file system, firmware loading address, symbol table location, kernel, CPU arch, endian and other information.

[0044] The automated acquisition of operating system firmware loading addresses is a difficult problem that is currently difficult to solve automatically. If the firmware loading address cannot be identified, the decompilation process cannot be performed, and the subsequent code security audit process cannot be carried out.

[0045] The detecting of the operation class firmware loading address by feature matching retrieval of the firmware file includes:

[0046] (1) Use the switch jump table positioning method to determine the firmware loading address. Use IDAPro to search for the string switch and find the appropriate jump table. The loading address is: (searched address - 0x8110) & 0xfffff000;

[0047] 2) Magic positioning method mainly uses some characteristic numbers to locate related functions, find strings from related functions, and determine the loading address of the firmware by the positive value of the string address. The essence is to use the reference address of the string: find features, such as a constant being referenced more than once, and then calculate the difference through the reference address of the string to determine the loading address. For example, 0xA082012C is the address of the string, and the offset address of the file is 0x2F12C, then the loading address of the firmware is: 0xA082012C-0x2F12C=0xA07F1000;

[0048] 3) Instruction location method, using strings, but looking for instructions, for example: r0 is the first parameter of arm parameter transfer, the first string is often a constant area string, then use this feature to locate the corresponding string and its address, first search for qualified instructions: randomly find an "LDR R0, = 0x23E1B571", temporarily assume that there is a string at the address 0x23E1B571, the IDA string search address after the 3-bit value: 517, the loading address is: 0x23E1B571-0x1B571 = 0x23E00000. In general, this method is relatively fast, and manual analysis can produce results in about 1 minute. Not only arm, mips, and ppc can use this method to find the loading address of the firmware.

[0049] The firmware security detection includes:

[0050] 1) Firmware integrity check;

[0051] 2) System vulnerability detection, CVE detection;

[0052] 3) The firmware executable file is decompiled using IDA Pro and then IDA Python is called to perform code security audit (dangerous function detection, memory corruption vulnerabilities, etc.);

[0053] 4) Password security testing, algorithm security, whether it is an insecure algorithm, whether a secure algorithm is misused, certificate security testing, key management security, password testing, etc.;

[0054] 5) Protocol security testing;

[0055] 6) Configuration safety detection, self-starting risks and other configuration risks;

[0056] 7) Leakage of sensitive information, source code, and detection of IP and Email leaks;

[0057] 8) Web background security detection.

[0058] Among them, decompilation is performed based on the identified firmware information, the binary instructions of the firmware are deassembled into assembly language, and then the assembly language is parsed into a high-level language, and the firmware security detection is performed based on the high-level language to obtain the firmware security detection result.

[0059] Decompilation is done using IDA Pro, but certain feature information is required for accurate decompilation, that is, the identified firmware feature information needs to be passed into IDA Pro. After that, IDA Pro will decompile the firmware binary instructions into assembly code based on the passed information, and the assembly code will be parsed into a high-level language such as C-like language, which is convenient for human reading and auditing, that is, security code auditing, but here we use technically automated security code auditing.

[0060] like Figure 2 As shown, the method of decompiling the firmware executable file using IDA Pro and then calling IDAPython to perform code security audit is as follows:

[0061] Use IDA's command interface idat, -S to specify the IDA Python analysis script, pass in the symbol table and ELF IDA can automatically analyze the CPU arch, endian and other information, and decompile it.

[0062] Define the dangerous function list. Since IDA often automatically adds an "_" sign before the function during analysis, merge the two dangerous function lists before testing.

[0063] All functions are called by the idautils interface, and each function name is checked cyclically to see if it is included in the dangerous function list. If it exists in the dangerous function list, the call address of each dangerous function is backtracked and output.

[0064] The following is the pseudo code for dangerous function detection:

[0065]

[0066] Embodiment 2

[0067] This embodiment provides a smart IoT device firmware security detection system based on decompilation, including:

[0068] The firmware acquisition module is configured to: acquire the firmware file to be detected of the smart IoT device;

[0069] The firmware security detection module is configured to: determine whether the firmware is a firmware with an operating system based on the firmware file to be detected. If so, unpack the firmware, perform multi-level classification of the firmware's operating system to obtain a classification result, identify the firmware information based on the characteristics of the firmware file corresponding to the category, otherwise directly identify the firmware information, decompile based on the identified firmware information, deassemble the firmware's binary instructions into assembly language, and then parse the assembly language into a high-level language, and perform firmware security detection based on the high-level language to obtain a firmware security detection result.

[0070] Embodiment 3

[0071] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the above-mentioned smart IoT device firmware security detection based on decompilation are implemented.

[0072] Embodiment 4

[0073] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the above-mentioned smart IoT device firmware security detection based on decompilation are implemented.

[0074] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0075] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0076] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0077] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0078] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0079] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for security detection of smart IoT device firmware based on decompilation, characterized in that: The steps include: Get the firmware file to be tested of the smart IoT device; Determine whether the firmware is a firmware with an operating system according to the firmware file to be detected. If so, unpack the firmware, perform multi-level classification on the operating system of the firmware to obtain a classification result, identify the firmware information according to the characteristics of the corresponding category of the firmware file, otherwise directly identify the firmware information, decompile based on the identified firmware information, deassemble the binary instructions of the firmware into assembly language, and then parse the assembly language into a high-level language, perform firmware security detection based on the high-level language to obtain a firmware security detection result; The firmware information identification process includes: judging whether the firmware is an executable file firmware according to the firmware file to be detected, if so, detecting it through binwalk, otherwise there is an operating system, detecting related information through feature matching retrieval of the firmware file, including the type and version of the operating system, the file system, the firmware loading address, the symbol table location, the kernel, the cpu arch and the endian information; The firmware loading address detected by feature matching retrieval of the firmware file includes: Use the switch jump table positioning method to determine the firmware loading address, use IDAPro to search the string switch, and find the appropriate jump table; Or, use the feature number to locate the relevant function, find the string from the relevant function, and determine the loading address of the firmware through the positive value of the string address.

2. A method for security detection of smart IoT device firmware based on decompilation as claimed in claim 1, characterized in that: The unpacking of the firmware and the multi-level classification of the operating system of the firmware include: Based on the system level, determine whether the type of the operating system is a firmware with an operating system or a firmware without an operating system; If it is a firmware with operating system, the firmware with operating system will be classified according to the file system; After determining the type of file system, it is further classified according to the architecture of the executable binary files within the file system.

3. A method for security detection of smart IoT device firmware based on decompilation as claimed in claim 1, characterized in that: The firmware information identification result and the firmware security detection result are stored in JSON format.

4. A method for security detection of smart IoT device firmware based on decompilation as claimed in claim 1, characterized in that: The firmware file to be detected of the smart IoT device is uploaded to the firmware detection designated directory.

5. A method for security detection of smart IoT device firmware based on decompilation as claimed in claim 1, characterized in that: Based on the identified firmware information, IDA Pro is used for decompilation, which includes: using IDA's command interface, specifying the IDAPython analysis script, and passing in the symbol table and ELF IDA for analysis.

6. A smart IoT device firmware security detection system based on decompilation, characterized in that: A method for security detection of smart IoT device firmware based on decompilation as described in any one of claims 1 to 5 is adopted, comprising: The firmware acquisition module is configured to: acquire the firmware file to be detected of the smart IoT device; The firmware security detection module is configured to: determine whether the firmware is an operating system-type firmware based on the firmware file to be detected; if so, unpack the firmware, perform multi-level classification of the firmware's operating system to obtain a classification result, identify the firmware information based on the characteristics of the firmware file corresponding to the category, otherwise directly identify the firmware information, decompile based on the identified firmware information, deassemble the firmware's binary instructions into assembly language, and then parse the assembly language into a high-level language, and perform firmware security detection based on the high-level language to obtain a firmware security detection result.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of a smart IoT device firmware security detection method based on decompilation as described in any one of claims 1 to 5 are implemented.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps in the smart IoT device firmware security detection method based on decompilation as described in any one of claims 1 to 5 are implemented.

Images