基于结构化特征库的递进式固件格式解析

Structured Feature Library-Based Progressive Firmware Format Parsing

提出了一种基于结构化特征库的递进式固件格式解析方法,通过建立常见固件格式结构化特征库,采用递进式的特征匹配算法,对固件格式进行自动化解析,能够获取指令集、引导代码、内核、文件系统、压缩算法、校验机制等关键信息,并剥离出固件的各部分代码,提取固件提供的函数库、交叉编译器版本等有用信息.对10款不同设备固件进行了自动化分析,均能够准确识别固件的各项关键信息,实验结果表明该方法具有较好的适用性.

In this paper, we construct a structured feature library of common firmware format and propose a progressive feature matching method which parses the format of a firmware automatically. It can obtain the instruction set, bootloader, kernel, filesystem, compression algorithm and verification mechanism. Furthermore, it also can extract several parts of the firmware to get useful information, e. g. , the function library, and cross-compiler version. In the end, we analyze ten kinds of firmware from different devices automatically. The experimental result shows that the proposed method is effective and feasible.