Firmware extraction method, device and equipment based on electromagnetic burrs

Abstract

The invention is applicable to the technical field of software testing, and particularly relates to a firmware extraction method, device and equipment based on electromagnetic glitches, and the method comprises the following steps: establishing communication with target Internet of Things equipment and sending a first instruction to the target Internet of Things equipment to obtain first return data of the target Internet of Things equipment; the first return data of the target Internet of Things equipment is analyzed, and the electromagnetic burr parameters corresponding to the target Internet of Things equipment are set, so that the operation accuracy is improved; controlling a burr injection device to perform burr injection on the target Internet of Things equipment according to the electromagnetic burr parameter corresponding to the target Internet of Things equipment, and determining second return data of the target Internet of Things equipment; and based on the second return data of the target Internet of Things device, sending the second instruction to the target Internet of Things device, determining the firmware information of the target Internet of Things device, effectively bypassing protection measures such as read protection of the target device, accurately capturing the firmware data, and improving the accuracy and real-time performance of the test.

Description

Technical Field

[0001] The present application belongs to the field of software testing technology, and in particular, relates to a firmware extraction method, device and equipment based on electromagnetic burrs. Background Art

[0002] With the rapid development of IoT technology, more and more devices integrate complex hardware and software systems to achieve diverse functions. However, the security issues of these devices are becoming increasingly prominent, especially the security issues of firmware. Firmware is the underlying software running in embedded devices, which directly controls the hardware and manages the basic functions of the device. Therefore, the extraction and analysis of firmware is crucial to assessing the security of the device.

[0003] Existing firmware extraction testing methods often rely on physical access or complex debugging interfaces to obtain firmware by directly reading data on storage media. For devices with advanced encryption and anti-tampering mechanisms, traditional methods often find it difficult to bypass these protection mechanisms, which not only limits the efficiency of extraction testing but may also cause physical damage to the device. Summary of the invention

[0004] The embodiments of the present application provide a firmware extraction method, device and equipment based on electromagnetic burrs, which can solve the problem of low extraction efficiency and physical damage to the equipment during traditional firmware extraction testing.

[0005] In a first aspect, an embodiment of the present application provides a firmware extraction method based on electromagnetic burrs, comprising:

[0006] Establishing communication with a target IoT device and sending a first instruction to the target IoT device to obtain first return data from the target IoT device;

[0007] Analyze the first return data of the target IoT device and set electromagnetic burr parameters corresponding to the target IoT device; wherein the electromagnetic burr parameters are used to capture firmware data of the target IoT device;

[0008] According to the electromagnetic burr parameter corresponding to the target IoT device, control the burr injection device to inject burrs into the target IoT device, and determine the second return data of the target IoT device;

[0009] Based on the second returned data of the target IoT device, a second instruction is sent to the target IoT device to determine the firmware information of the target IoT device.

[0010] The electromagnetic burr-based firmware extraction method provided in the embodiment of the present application establishes communication with the target IoT device and sends a first instruction to the target IoT device to obtain the first return data of the target IoT device for subsequent analysis. The first return data of the target IoT device is analyzed, and the electromagnetic burr parameters corresponding to the target IoT device are set, and the burr parameters are accurately controlled to improve the accuracy of the operation. According to the electromagnetic burr parameters corresponding to the target IoT device, the burr injection device is controlled to inject burrs into the target IoT device, the second return data of the target IoT device is determined, and the response status of the target IoT device is monitored. Based on the second return data of the target IoT device, a second instruction is sent to the target IoT device to determine the firmware information of the target IoT device, effectively bypassing the read protection and other protective measures of the target device, and accurately capturing the firmware data to improve the accuracy and real-time performance of the test.

[0011] In a second aspect, an embodiment of the present application provides a firmware extraction device based on electromagnetic burrs, comprising:

[0012] A communication unit, establishing communication with a target IoT device and sending a first instruction to the target IoT device to obtain first return data from the target IoT device;

[0013] An analysis unit, configured to analyze the first return data of the target IoT device and set electromagnetic burr parameters corresponding to the target IoT device; wherein the electromagnetic burr parameters are used to capture firmware data of the target IoT device;

[0014] An injection unit, configured to control a burr injection device to perform burr injection on the target IoT device according to the electromagnetic burr parameter corresponding to the target IoT device, and determine second return data of the target IoT device;

[0015] An extraction unit is used to send a second instruction to the target Internet of Things device based on the second returned data of the target Internet of Things device to determine the firmware information of the target Internet of Things device.

[0016] In a third aspect, an embodiment of the present application provides a firmware extraction device based on electromagnetic burrs, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a method as described in any one of the first aspects above when executing the computer program.

[0017] In a fourth aspect, an embodiment of the present application provides a computer program product, which, when executed on a terminal device, enables the terminal device to execute any of the methods described in the first aspect.

[0018] It can be understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 It is a flowchart of a firmware extraction method based on electromagnetic burrs provided in one embodiment of the present application;

[0021] Figure 2 It is a schematic diagram of the operation of a firmware extraction method based on electromagnetic burrs provided in an embodiment of the present application;

[0022] Figure 3 It is a control schematic diagram of a firmware extraction method based on electromagnetic burrs provided in one embodiment of the present application;

[0023] Figure 4 It is a structural schematic diagram of a firmware extraction device based on electromagnetic burrs provided in one embodiment of the present application;

[0024] Figure 5 It is a structural schematic diagram of a firmware extraction device based on electromagnetic burrs provided in one embodiment of the present application. DETAILED DESCRIPTION

[0025] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0026] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0027] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0028] As used in the specification of this application and the appended claims, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting" depending on the context. Similarly, the phrase "if it is determined" or "if the described condition or event is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce the described condition or event is detected" or "in response to detecting the described condition or event" depending on the context.

[0029] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0030] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0031] Existing firmware extraction testing methods often rely on physical access or complex debugging interfaces to obtain firmware by directly reading data on storage media. For devices with advanced encryption and anti-tampering mechanisms, traditional methods often find it difficult to bypass these protection mechanisms, which not only limits the efficiency of extraction testing but may also cause physical damage to the device.

[0032] To solve the above problems, the embodiments of the present application provide a firmware extraction method, device and equipment based on electromagnetic burrs. In this method, by establishing communication with the target IoT device and sending a first instruction to the target IoT device, the first return data of the target IoT device is obtained for subsequent analysis. The first return data of the target IoT device is analyzed, the electromagnetic burr parameters corresponding to the target IoT device are set, and the burr parameters are accurately controlled to improve the accuracy of the operation. According to the electromagnetic burr parameters corresponding to the target IoT device, the burr injection device is controlled to inject burrs into the target IoT device, the second return data of the target IoT device is determined, and the response status of the target IoT device is monitored. Based on the second return data of the target IoT device, a second instruction is sent to the target IoT device to determine the firmware information of the target IoT device, effectively bypassing the read protection and other protective measures of the target device, and accurately capturing the firmware data to improve the accuracy and real-time performance of the test.

[0033] The electromagnetic burr-based firmware extraction method provided in the embodiment of the present application can be applied to a terminal device. In this case, the terminal device is the executor of the electromagnetic burr-based firmware extraction method provided in the embodiment of the present application. The embodiment of the present application does not impose any restrictions on the specific type of the terminal device.

[0034] For example, the terminal device may be a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a desktop computer, a smart large screen, etc.

[0035] In order to better understand the firmware extraction method based on electromagnetic burrs provided in the embodiment of the present application, the specific implementation process of the firmware extraction method based on electromagnetic burrs provided in the embodiment of the present application is exemplarily introduced below.

[0036] Figure 1 A schematic flow chart of a firmware extraction method based on electromagnetic burrs provided in an embodiment of the present application is shown. Figure 2 The operational flow chart of the firmware extraction method based on electromagnetic burrs provided in the embodiment of the present application is shown. Figure 3 The control flow chart of the firmware extraction method based on electromagnetic burrs provided in an embodiment of the present application is shown. The firmware extraction method based on electromagnetic burrs includes:

[0037] S100, establishing communication with a target IoT device and sending a first instruction to the target IoT device to obtain first return data from the target IoT device.

[0038] It can be understood that the use of IO (input / output) devices to communicate with the target IoT device usually includes steps such as setting up a communication protocol, sending control or query instructions, and obtaining device status information or data. IO devices act as a bridge between IoT devices, and communication is achieved through the interface of IO devices (such as GPIO, UART, SPI, I2C, etc.), providing support for monitoring, control or data transmission. After the communication channel is established, the first instruction that can be sent to the target IoT device is used to request preliminary information from the device. The first instruction is a command preset by the device, requiring the return of certain initial data. The initial data may include the system status, firmware information or other important parameters of the device, and the returned initial data is the first return data. The response of the device may be a simple status confirmation, or it may contain detailed device data, which varies depending on the device design and the protocol used.

[0039] Before establishing communication with the target IoT device and sending the first instruction to the target IoT device, the method further includes:

[0040] S110, identifying the target IoT device and determining device information of the target IoT device.

[0041] It is understood that the target device can be identified to clarify the device type, model, system version and other device information. The device identification process can include multi-level protocol handshakes and hardware feature verification. The identification process can include unique identifiers (such as MAC addresses), serial numbers, firmware versions and other information, which are important signs that distinguish IoT devices from other devices. In addition, device identification can also scan the physical characteristics and network characteristics of the hardware to confirm the identity of the device.

[0042] S120, determining a first instruction corresponding to the target IoT device based on the device information of the target IoT device; wherein the first instruction is used to access firmware information of the target IoT device.

[0043] It can be understood that the first instruction refers to a data command sent after establishing initial communication with the target IoT device to read the firmware-related information or specific parameters of the device, with the purpose of obtaining the basic data or status information of the device to determine the response characteristics of the device, identify the device model, or retrieve the operating status of the device. The first instruction provides basic data for subsequent detection and analysis by reading basic information or requesting basic feedback. The determination of the first instruction can be based on a set of predefined rules or an instruction mapping table. The instruction mapping table can match different operation instructions according to the device information of the target IoT device, such as model and configuration.

[0044] In a possible implementation, S100, establishing communication with a target IoT device and sending a first instruction to the target IoT device, and obtaining first return data from the target IoT device, includes:

[0045] S130, establishing communication with a target IoT device and sending a corresponding first instruction to the target IoT device to obtain first return data from the target IoT device.

[0046] It can be understood that the generated first instruction can be transmitted to the target IoT device in the form of a data packet, and this data packet contains the instruction body. After the instruction is successfully transmitted, the target IoT device will parse it after receiving the instruction, and perform corresponding operations according to the instruction response mechanism of the device, and finally generate and return the first return data. The first return data may include basic information of the device, firmware status, operation log or other device status parameters. After receiving the first return data, the data can be decoded and parsed to extract key parameters. The parsing process includes data format conversion, verification and information extraction to ensure that the returned data accurately reflects the current status of the target IoT device.

[0047] S200, analyzing the first return data of the target IoT device, and setting electromagnetic burr parameters corresponding to the target IoT device; wherein the electromagnetic burr parameters are used to capture firmware data of the target IoT device.

[0048] It can be understood that the first return data refers to the information returned by the target IoT device after receiving the command, which reflects the status of the device, the processing capability and its response to the input signal. The purpose of analyzing the first return data is to understand the protection mechanism of the device and its vulnerability, so as to set appropriate electromagnetic burr parameters to bypass the normal operation of the target IoT device. The first return data may include response status, delay time, error information, etc. Features can be extracted from the first return data to analyze the protection mechanism of the target IoT device. For example, by comparing the successful and failed response states, the vulnerable links of the device under specific input can be identified. By analyzing the first return data, a basis can be provided for the parameter setting of electromagnetic burrs. Electromagnetic burr parameters refer to the characteristics of electromagnetic interference signals used to affect the normal operation of the target device.

[0049] In a possible implementation, S200, analyzing the first return data of the target IoT device and setting the electromagnetic burr parameters corresponding to the target IoT device, includes:

[0050] S210, extracting features from first return data of the target IoT device, and determining a data response curve corresponding to the first return data; wherein the data response curve is used to reflect a response status of the target IoT device.

[0051] It can be understood that the first returned data can be feature extracted, that is, representative or relevant feature indicators can be screened out from the returned device information, firmware status, operating parameters and other data. These feature indicators may include response time, signal strength, response stability, etc., and the specific content varies depending on the device type and instruction content. The feature extraction process can use statistical analysis or signal processing algorithms to ensure that the extracted features can truly reflect the state of the device. After the feature extraction is completed, by plotting these features into a data response curve according to time or other dimensions, the state change of the device after receiving the instruction can be intuitively displayed. The construction process of the data response curve involves sampling and timing arrangement of various features, and the dynamic response of the device is observed by the change trend of the feature points. For example, if the target IoT device fluctuates multiple times in a short period of time, the data response curve will show corresponding peak and valley characteristics, thereby reflecting the instability of the device response. The data response curve not only helps to visualize the device status, but also can further analyze the operating law and response characteristics of the device through the curve shape. Through the curve feature analysis, the response ability of the target IoT device under different operating conditions can be evaluated, so as to set more accurate parameters for subsequent electromagnetic burr injection. According to the analysis results, the preliminary parameters of the electromagnetic burr, such as pulse intensity, width and frequency, are set to ensure that the interference can effectively reach the firmware part of the target device.

[0052] S220, determining an initial electromagnetic burr parameter group corresponding to the target Internet of Things device based on a data response curve corresponding to the first returned data.

[0053] It can be understood that when determining the initial electromagnetic burr parameter group, an optimized electromagnetic burr parameter space can be defined, including frequency, amplitude, pulse width, etc. The relationship between the data response curve and the parameter range of the target IoT device response can be predefined by mapping, and the parameter range of the target IoT device response can be determined according to the data response curve corresponding to the first return data. In the defined parameter space, a set of initial parameter combinations is generated, which is the initial electromagnetic burr parameter group. The surrounding parameters can be randomly generated around the center of the mapping parameter range obtained by analyzing the data response curve. According to the extracted features, the parameters of certain particles are set as priority, for example, the frequency should be concentrated near the peak of the curve.

[0054] S230, obtaining a function response value curve and multiple initial electromagnetic burr parameter update groups according to the initial electromagnetic burr parameter group corresponding to the target IoT device.

[0055] It can be understood that the Particle Swarm Optimization (PSO) algorithm can be used to iteratively update the electromagnetic burr parameters to obtain the best parameter combination that can maximize the response value of the target IoT device. Particle Swarm Optimization is a group intelligence optimization algorithm that simulates the foraging behavior of bird flocks. Each particle represents a potential solution, and the optimal solution is found by continuously updating the position and speed. Each particle is adjusted according to its own historical optimal position and the historical optimal position of the group in order to search for the optimal parameter combination in the solution space, that is, the initial electromagnetic burr parameter group is iteratively updated to obtain multiple updated electromagnetic burr parameter groups, that is, multiple initial electromagnetic burr parameter update groups are obtained, so as to search for the optimal electromagnetic burr parameter update group in the solution space.

[0056] Optionally, S230, obtaining a function response value curve and a plurality of initial electromagnetic burr parameter update groups according to the initial electromagnetic burr parameter group corresponding to the target IoT device, includes:

[0057] S231, calculating a function response value of the initial electromagnetic burr parameter group to a preset fitness function according to the initial electromagnetic burr parameter group corresponding to the target IoT device.

[0058] It can be understood that the fitness function is used to evaluate the impact of electromagnetic interference signals on the target device, and can be composed of multiple performance indicators. The initial electromagnetic burr parameter group can be used as input and substituted into the fitness function to obtain the response value of each group of parameters. The response value corresponding to each group of parameters is recorded to provide data basis for subsequent optimization. A response model can be defined to describe the response of the device to electromagnetic burrs. For example, it can be established through experimental data or theoretical models, and the model can calculate the output characteristics of the device under specific parameters. For each group of initial electromagnetic burr parameters, input them into the response model to obtain the corresponding response value.

[0059] Exemplarily, the fitness function may be expressed in the following form: F(x)=F1(x)+F2(x), where F1(x) may be the stability of the interference signal, and F2(x) may be the strength of the interference signal.

[0060] S232, updating the initial electromagnetic burr parameter group according to the function response value of the initial electromagnetic burr parameter group to the preset fitness function, and calculating the function response value of the initial electromagnetic burr parameter group to the preset fitness function after each update, to obtain a function response value curve and multiple initial electromagnetic burr parameter update groups.

[0061] It can be understood that according to the response values ​​of all initial electromagnetic burr parameter groups, a function response value curve can be drawn. The function response value curve shows the change of the possible response of the device under different initial electromagnetic burr parameter update groups, which is used to analyze the sensitivity of the electromagnetic burr parameter group to the device response. The function response value curve can be presented in a two-dimensional chart, where one axis is the parameter initial electromagnetic burr parameter update group and the other axis is the response value. Visualization helps to quickly identify the optimal parameter area.

[0062] S240, determining an optimal electromagnetic burr parameter group according to the function response value curve and a plurality of initial electromagnetic burr parameter update groups.

[0063] It can be understood that after obtaining the function response value curve and multiple initial electromagnetic burr parameter update groups, it is possible to determine whether the particle group converges to the global optimal solution by determining the change in fitness value. After the iteration is completed, the electromagnetic burr parameter group corresponding to the particle with the highest fitness value is output as the final result, that is, the optimal electromagnetic burr parameter group is determined.

[0064] Optionally, S240, determining an optimal electromagnetic burr parameter group according to the function response value curve and a plurality of initial electromagnetic burr parameter update groups, includes:

[0065] S241, calculating the change rate of the function response value curve to determine the function response value change rate corresponding to the function response value curve.

[0066] It can be understood that the change trend of the function response value under different parameter conditions can be obtained by calculating the change rate of the function response value curve. The calculation of the function response value change rate can use the discrete difference method or the derivative method to analyze the sensitivity and stability of the function response value with the change of the electromagnetic burr parameters. For example, the average change rate of the response value within a certain parameter change range can be calculated, which is helpful to judge the effectiveness of the current parameter setting and the impact on the response of the target IoT device. The value of the change rate can determine whether it is necessary to continue adjusting the parameters or stop updating to find the optimal solution.

[0067] S242, based on the function response value change rate corresponding to the function response value curve, stop updating the initial electromagnetic burr parameter group, and compare the function response values ​​corresponding to all the initial electromagnetic burr parameter update groups.

[0068] It can be understood that a threshold value of the function response value change rate can be preset. By analyzing the function response value change rate, if the change rate is lower than the preset threshold value, it means that the current parameter setting is close to the optimal state, and the update of the initial electromagnetic burr parameter group can be stopped. The function response values ​​of all recorded initial electromagnetic burr parameter update groups are compared to evaluate the effect of each group of parameters and identify the best performing parameter settings for further analysis and application.

[0069] S243, according to the result of comparing the function response values ​​corresponding to all the initial electromagnetic burr parameter update groups, determine the initial electromagnetic burr parameter update group with the largest function response value as the optimal electromagnetic burr parameter group.

[0070] It can be understood that comparing the function response values ​​corresponding to all initial electromagnetic burr parameter update groups can be achieved through traversal comparison, that is, checking the response value of each group of parameters one by one, and tracking the current maximum value and its corresponding parameter setting. A data structure (such as an array or a list) can be used to store these response values ​​and their corresponding parameter groups. Once the parameter group with the highest function response value is found, it is marked as the "optimal electromagnetic burr parameter group" and the specific value of the parameter group is recorded for subsequent application.

[0071] S250, setting electromagnetic burr parameters corresponding to the target IoT device according to the optimal electromagnetic burr parameter group.

[0072] It can be understood that after determining the optimal electromagnetic glitch parameter group, the optimal electromagnetic glitch parameter mapping can be transmitted to the signal integration controller, and the signal integration controller will drive the electromagnetic source at a specified time after receiving the injection parameter, so as to accurately control the subsequent electromagnetic interference process. The electromagnetic source is driven to emit a precisely controllable positive or negative glitch interference signal so that the chip can skip the protection measures and successfully read the firmware content.

[0073] S300, controlling a burr injection device to inject burrs into the target IoT device according to electromagnetic burr parameters corresponding to the target IoT device, and determining second return data of the target IoT device.

[0074] It can be understood that according to the electromagnetic burr parameters corresponding to the target IoT device, the target IoT device can be interfered with by the control signal integrated controller according to the set electromagnetic burr parameters, and the burr injection process can be monitored to obtain the data of the target IoT device during the burr injection process, that is, the second return data of the target IoT device is obtained.

[0075] Before controlling the glitch injection device to inject glitch into the target IoT device, the method further includes:

[0076] S310, obtaining electromagnetic susceptibility data of the target IoT device, and determining the injection physical location of the target IoT device based on the electromagnetic susceptibility data.

[0077] It can be understood that the physical location of injection refers to the specific point where the electromagnetic burr will be injected into the target IoT device. The injection location that can maximize the interference effect can be found by analyzing the sensitivity of the target device to electromagnetic interference. Multiple test locations can be delineated around the target IoT device, including different directions such as the front, side and rear of the device. Electromagnetic waves of different intensities, frequencies and pulse widths are applied at each test location, and the response of the target device is monitored at the same time. The electromagnetic susceptibility data of each location can be evaluated and recorded and stored by drawing response curves, calculating average response values, etc. The stored electromagnetic susceptibility data can be obtained through the API interface or network upload. Obtaining the electromagnetic susceptibility data of the target IoT device can determine the sensitivity of the device at each location through statistical analysis. The average response value, peak response, rate of change, etc. can be calculated to find the location where the device is most sensitive to electromagnetic interference, and the location with the strongest response can be selected for subsequent electromagnetic burr injection.

[0078] S320, calculating the physical movement amount of the preset mobile station according to the injection physical position of the target IoT device; wherein the preset mobile station is used to move the electromagnetic burr injection device, and the physical movement amount is used to reflect the distance the preset mobile station moves to the injection physical position.

[0079] It can be understood that the preset mobile station is used to fix the electromagnetic burr injection device, which can accurately move the physical injection position and provide safe, efficient and accurate burr support. The physical movement of the preset mobile station can be calculated by recording the current position coordinates of the preset mobile station (for example, X, Y, Z axis coordinates) and determining the coordinates of the physical injection position. The movement amount is calculated by the coordinate difference. The movement amount can be calculated by the following formula: In, x 1 ,y 1 , z 1 are the coordinates of the injected physical location, and x, y, z are the current location of the mobile station.

[0080] In a possible implementation, S300, according to the electromagnetic burr parameters corresponding to the target IoT device, controls the burr injection device to inject burrs into the target IoT device, and determines the second return data of the target IoT device, including:

[0081] S340, controlling a preset physical movement amount of the mobile station, and controlling a burr injection device to inject burrs into the target IoT device according to electromagnetic burr parameters corresponding to the target IoT device, to determine second return data of the target IoT device.

[0082] It can be understood that, based on the calculated physical movement amount, an instruction can be sent to the preset mobile station, instructing it to move to the injection physical position of the target IoT device according to the set path and speed. After moving to the injection position, the parameters of the burr injection device have been set, and the burr injection process can be started. It can include activating an electromagnetic source to generate strong electromagnetic interference in a short period of time, thereby affecting the target IoT device. During the burr injection process, the response of the target device can be monitored in real time, and the data returned by it, i.e., the second return data, can be recorded. The second return data includes the status of the device, an error code, or other information that may reflect the behavior of the device.

[0083] Optionally, S340, controlling a preset mobile station to move a physical movement amount, controlling a burr injection device to inject burrs into the target IoT device according to an electromagnetic burr parameter corresponding to the target IoT device, and determining second return data of the target IoT device, including:

[0084] S341, controlling the preset mobile station to move a physical movement amount so that the preset mobile station reaches the injection physical position of the target Internet of Things device.

[0085] It can be understood that, according to the calculated physical movement amount, an instruction can be sent to the preset mobile station, instructing it to move to the injection physical position of the target IoT device according to the set path and speed. The position confirmation of the preset mobile station can be achieved through sensor feedback, so that the injection is performed at the determined injection physical position to avoid the influence of deviation.

[0086] S342, at the injection physical location of the target IoT device, according to the electromagnetic burr parameters corresponding to the target IoT device, control the burr injection device to inject burrs into the target IoT device, and monitor the burr injection process.

[0087] It is understood that the glitch injection device can be controlled using preset electromagnetic glitch parameters (such as frequency, amplitude, and pulse width) at the physical location of the injection of the target IoT device. The electromagnetic glitch parameters are set based on previous analysis and optimization to maximize the impact on the protection mechanism of the target device. The operating instructions of the electromagnetic source can be transmitted to the glitch injection device through predefined control logic and interfaces. The electromagnetic glitch injection device will be activated at the specified time and conditions to send an electromagnetic interference signal to the target device. The interference signal will temporarily disrupt the normal operation of the target device, especially the protection mechanism of its firmware. At the same time, the response data of the target IoT device during the electromagnetic injection process can be monitored and tracked in real time.

[0088] S343, based on the result of monitoring the burr injection process, determine the second return data of the target IoT device.

[0089] It can be understood that the behavior of the target device during the glitch injection process can be continuously tracked, and all possible reactions can be recorded, including device failure, reset, or any abnormal state. This can be achieved by collecting the device's status signal, output data, etc., and obtaining the second return data of the target IoT device. The second return data can include the device's state changes, response time, error information, etc. under the influence of electromagnetic interference, reducing the potential risk of damage to the hardware and ensuring the recoverability of the device after firmware extraction.

[0090] S400, based on the second returned data of the target IoT device, sending a second instruction to the target IoT device to determine the firmware information of the target IoT device.

[0091] It can be understood that the response to electromagnetic glitch injection can be determined by analyzing the second return data of the target IoT device, reflecting the stability and anti-interference ability of the target IoT device under different conditions. Based on the second return data, it is possible to evaluate whether the target device is in a safe state and analyze the accessibility of its firmware. Once it is determined that the target device can safely access the firmware information, a second instruction can be constructed and sent. The second instruction content may include a request to read the firmware version, configuration, or other related information, read the firmware data from the storage medium of the device, effectively bypassing the read protection and other protective measures of the target device, and realizing efficient and accurate capture of firmware data without the need for expensive physical access rights or special equipment, thereby reducing operating costs.

[0092] In a possible implementation, S400, based on the second return data of the target IoT device, sending a second instruction to the target IoT device to determine the firmware information of the target IoT device includes:

[0093] S410: Determine a firmware protection state of the target IoT device based on second returned data of the target IoT device.

[0094] It can be understood that whether the device has enabled the firmware protection function, such as password protection, encryption mechanism, etc., can be determined based on the information in the second return data. This can be done by checking whether the format of the second return data conforms to the expected protocol structure. The firmware protection function is usually identified in a specific field, such as the firmware version number, status flag, etc. For example, look for fields related to the firmware protection status, such as "Protection Status", "Firmware Lock", etc. These fields may clearly indicate whether the device has enabled the protection function. The return data may contain a status code to indicate the current status of the device. If the status code indicates "Locked" or "Protected", it means that the firmware protection function is enabled. If the firmware protection function is triggered, the device may return specific error information, such as "Access Denied" or "Firmware Locked", which can help determine the protection status.

[0095] S420: When the firmware protection status of the target IoT device fails, send a second instruction to the target IoT device to determine the firmware information of the target IoT device.

[0096] It is understandable that after confirming that the firmware protection state of the target IoT device is invalid, a second instruction can be sent to the target IoT device. The main purpose of the second instruction is to extract the firmware data of the target IoT device for further analysis and evaluation.

[0097] After confirming that the firmware protection status of the target IoT device has failed, a second instruction can be constructed, which may include device identification information, requested firmware data type, and possible security verification information. After sending the second instruction to the target IoT device, it will enter a listening state and wait for the response of the target IoT device. The response of the target IoT device will contain the firmware data of the target device, including but not limited to the firmware version number, functional modules, configuration parameters, and possible patch information, etc., so as to read the firmware data, effectively bypass the read protection and other protective measures of the target IoT device, and achieve efficient and accurate capture of firmware data, reduce the potential risk of damage to the hardware, ensure the recoverability of the target device after firmware extraction, and reduce the cost of software testing.

[0098] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0099] Corresponding to the firmware extraction method based on electromagnetic burrs described in the above embodiment, the embodiment of the present application further provides a firmware extraction device based on electromagnetic burrs, and each unit of the device can implement each step of the firmware extraction method based on electromagnetic burrs. Figure 4 A structural block diagram of a firmware extraction device based on electromagnetic burrs provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0100] Reference Figure 4 , the firmware extraction device based on electromagnetic burrs comprises:

[0101] A communication unit, establishing communication with a target IoT device and sending a first instruction to the target IoT device to obtain first return data from the target IoT device;

[0102] An analysis unit, configured to analyze the first return data of the target IoT device and set electromagnetic burr parameters corresponding to the target IoT device; wherein the electromagnetic burr parameters are used to capture firmware data of the target IoT device;

[0103] An injection unit, configured to control a burr injection device to perform burr injection on the target IoT device according to the electromagnetic burr parameter corresponding to the target IoT device, and determine second return data of the target IoT device;

[0104] An extraction unit is used to send a second instruction to the target Internet of Things device based on the second returned data of the target Internet of Things device to determine the firmware information of the target Internet of Things device.

[0105] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0106] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit module can exist physically separately, or two or more unit modules can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned device can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0107] The embodiment of the present application also provides a firmware extraction device based on electromagnetic burrs, Figure 5 This is a schematic diagram of the structure of a firmware extraction device based on electromagnetic burrs provided in an embodiment of the present application. Figure 5 As shown, the firmware extraction device 6 based on electromagnetic burrs of this embodiment includes: at least one processor 60 ( Figure 5 Only one is shown), at least one memory 61 ( Figure 5 Only one is shown) and a computer program 62 stored in the at least one memory 61 and executable on the at least one processor 60. When the processor 60 executes the computer program 62, the firmware extraction device 6 based on electromagnetic burrs implements the steps in any of the above-mentioned firmware extraction method embodiments based on electromagnetic burrs, or implements the functions of each unit in the above-mentioned device embodiments.

[0108] Exemplarily, the computer program 62 may be divided into one or more units, which are stored in the memory 61 and executed by the processor 60 to complete the present application. The one or more units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 62 in the electromagnetic burr-based firmware extraction device 6.

[0109] The firmware extraction device 6 based on electromagnetic burrs can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The firmware extraction device based on electromagnetic burrs can include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art can understand that Figure 5 It is only an example of the firmware extraction device 6 based on electromagnetic burrs, and does not constitute a limitation of the firmware extraction device 6 based on electromagnetic burrs. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components, for example, it may also include input and output devices, network access devices, buses, etc.

[0110] The processor 60 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0111] In some embodiments, the memory 61 may be an internal storage unit of the electromagnetic burr-based firmware extraction device 6, such as a hard disk or memory of the electromagnetic burr-based firmware extraction device 6. In other embodiments, the memory 61 may also be an external storage device of the electromagnetic burr-based firmware extraction device 6, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electromagnetic burr-based firmware extraction device 6. Further, the memory 61 may also include both the internal storage unit of the electromagnetic burr-based firmware extraction device 6 and an external storage device. The memory 61 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program, etc. The memory 61 may also be used to temporarily store data that has been output or is to be output.

[0112] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0113] An embodiment of the present application provides a computer program product. When the computer program product runs on a firmware extraction device based on electromagnetic burrs, the firmware extraction device based on electromagnetic burrs implements the steps in any of the above method embodiments.

[0114] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the firmware extraction device based on electromagnetic burrs, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, U disk, mobile hard disk, disk or optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0115] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0116] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0117] In the embodiments provided in the present application, it should be understood that the disclosed electromagnetic burr-based firmware extraction device / electromagnetic burr-based firmware extraction equipment and method can be implemented in other ways. For example, the electromagnetic burr-based firmware extraction device / electromagnetic burr-based firmware extraction device embodiment described above is only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0118] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0119] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A firmware extraction method based on electromagnetic burrs, characterized in that: include: Establishing communication with a target IoT device and sending a first instruction to the target IoT device to obtain first return data from the target IoT device; Analyze the first return data of the target IoT device and set electromagnetic burr parameters corresponding to the target IoT device; wherein the electromagnetic burr parameters are used to capture firmware data of the target IoT device; According to the electromagnetic burr parameter corresponding to the target IoT device, control the burr injection device to inject burrs into the target IoT device, and determine the second return data of the target IoT device; Based on the second returned data of the target IoT device, a second instruction is sent to the target IoT device to determine the firmware information of the target IoT device.

2. The firmware extraction method based on electromagnetic burrs according to claim 1, characterized in that: Before establishing communication with the target IoT device and sending a first instruction to the target IoT device, the method further includes: Identify the target IoT device and determine device information of the target IoT device; Based on the device information of the target IoT device, determine a first instruction corresponding to the target IoT device; wherein the first instruction is used to access firmware information of the target IoT device; The step of establishing communication with a target IoT device and sending a first instruction to the target IoT device to obtain first return data from the target IoT device includes: Establish communication with a target IoT device and send the corresponding first instruction to the target IoT device to obtain first return data from the target IoT device.

3. The firmware extraction method based on electromagnetic burrs according to claim 1, characterized in that: The analyzing the first returned data of the target IoT device and setting electromagnetic burr parameters corresponding to the target IoT device includes: Performing feature extraction on the first return data of the target IoT device to determine a data response curve corresponding to the first return data; wherein the data response curve is used to reflect the response of the target IoT device; Determine an initial electromagnetic burr parameter group corresponding to the target IoT device based on the data response curve corresponding to the first returned data; According to the initial electromagnetic burr parameter group corresponding to the target IoT device, a function response value curve and a plurality of initial electromagnetic burr parameter update groups are obtained; Determine an optimal electromagnetic burr parameter group according to a function response value curve and a plurality of initial electromagnetic burr parameter update groups; According to the optimal electromagnetic burr parameter group, the electromagnetic burr parameters corresponding to the target Internet of Things device are set.

4. The firmware extraction method based on electromagnetic burrs as claimed in claim 3, characterized in that: The method of obtaining a function response value curve and a plurality of initial electromagnetic burr parameter update groups according to the initial electromagnetic burr parameter group corresponding to the target IoT device includes: Calculating a function response value of the initial electromagnetic burr parameter group to a preset fitness function according to the initial electromagnetic burr parameter group corresponding to the target IoT device; According to the function response value of the initial electromagnetic burr parameter group to the preset fitness function, the initial electromagnetic burr parameter group is updated, and the function response value of the initial electromagnetic burr parameter group to the preset fitness function after each update is calculated to obtain a function response value curve and multiple initial electromagnetic burr parameter update groups.

5. The firmware extraction method based on electromagnetic burrs according to claim 4, characterized in that: The method of determining the optimal electromagnetic burr parameter group according to the function response value curve and the multiple initial electromagnetic burr parameter update groups includes: Calculating the change rate of the function response value curve to determine the function response value change rate corresponding to the function response value curve; Based on the function response value change rate corresponding to the function response value curve, stop updating the initial electromagnetic burr parameter group, and compare the function response values ​​corresponding to all the initial electromagnetic burr parameter update groups; According to the result of comparing the function response values ​​corresponding to all the initial electromagnetic burr parameter update groups, the initial electromagnetic burr parameter update group with the largest function response value is determined as the optimal electromagnetic burr parameter group.

6. The method for extracting firmware based on electromagnetic burrs according to claim 1, characterized in that: Before controlling the burr injection device to perform burr injection on the target IoT device, the method further includes: Acquire electromagnetic susceptibility data of the target IoT device, and determine the injection physical location of the target IoT device based on the electromagnetic susceptibility data; According to the injection physical position of the target IoT device, the physical movement amount of the preset mobile station is calculated; wherein the preset mobile station is used to move the electromagnetic burr injection device, and the physical movement amount is used to reflect the distance moved by the preset mobile station to the injection physical position; The step of injecting burrs into the target IoT device according to the electromagnetic burr parameters corresponding to the target IoT device, and determining second return data of the target IoT device, includes: The preset mobile station is controlled to move the physical movement amount, and the burr injection device is controlled to inject burrs into the target Internet of Things device according to the electromagnetic burr parameters corresponding to the target Internet of Things device, so as to determine the second return data of the target Internet of Things device.

7. The firmware extraction method based on electromagnetic burrs according to claim 6, characterized in that: The controlling the preset mobile station to move the physical movement amount, controlling the burr injection device to inject burrs into the target IoT device according to the electromagnetic burr parameter corresponding to the target IoT device, and determining the second return data of the target IoT device, includes: Controlling the preset mobile station to move the physical movement amount so that the preset mobile station reaches the injection physical position of the target Internet of Things device; At the injection physical position of the target IoT device, according to the electromagnetic burr parameters corresponding to the target IoT device, control a burr injection device to inject burrs into the target IoT device, and monitor the burr injection process; Based on the result of monitoring the burr injection process, second return data of the target Internet of Things device is determined.

8. The method for extracting firmware based on electromagnetic burrs according to claim 1, characterized in that: The sending a second instruction to the target IoT device based on the second returned data of the target IoT device to determine the firmware information of the target IoT device includes: Determine the firmware protection status of the target IoT device based on the second returned data of the target IoT device; When the firmware protection state of the target IoT device fails, a second instruction is sent to the target IoT device to determine the firmware information of the target IoT device.

9. A firmware extraction device based on electromagnetic burrs, characterized in that: The firmware extraction device based on electromagnetic burr includes: A communication unit, establishing communication with a target IoT device and sending a first instruction to the target IoT device to obtain first return data from the target IoT device; An analysis unit, configured to analyze the first return data of the target IoT device and set electromagnetic burr parameters corresponding to the target IoT device; wherein the electromagnetic burr parameters are used to capture firmware data of the target IoT device; An injection unit, configured to control a burr injection device to perform burr injection on the target IoT device according to the electromagnetic burr parameter corresponding to the target IoT device, and determine second return data of the target IoT device; An extraction unit is used to send a second instruction to the target Internet of Things device based on the second returned data of the target Internet of Things device to determine the firmware information of the target Internet of Things device.

10. A firmware extraction device based on electromagnetic burrs, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

Images