Reverse-enigneering embedded         MIPS devices   Case study: Draytek SOHO routers            Nikita Abdullin         na...
Reverse-enigneering embedded MIPS              devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: R...
Reverse-enigneering embedded MIPS              devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: R...
Embedded systems: overview•   Everywhere: mobile, media, CPE, …•   High level of integration: mostly SoC•   Compact size, ...
Embedded systems: overviewWhy ever reverse a MIPS box ?• Ubiquitous devices – especially network & CPE• A well-known RISC ...
Reverse-enigneering embedded MIPS              devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: R...
Firmware researchFirmware – how to get it?• Download from device …  – JTAG  – Serial / UART console / other ports  – read ...
Firmware researchTypical firmware binary:• Bootloader• Code• Filesystem imageHow to extract them?• Manual review• Tools
Firmware research :: Tools• Signature search  – binwalk  – signsrch, offzip  – trid• Scriptable hex editor  – <Your favour...
Firmware research :: Manual review•   Sequences of 0x00’s and 0xFF’s•   First byte/word may be block size•   Last byte/wor...
Firmware research :: Manual review• Filesystem extraction  – Use binwalk  – Or look for magic headers     •   JFFS2       ...
Reverse-enigneering embedded MIPS              devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: R...
MIPS: Introduction•   RISC ISA (instruction set architecture)•   Fixed 4-byte length instructions•   32-bit and 64-bit•   ...
MIPS: registers Name      Number           Purpose $zero       $0            Const = 0  $at        $1           Temporary$...
MIPS: delay slot• MIPS is a pipelined architecture• So not all instructions are safe to be executed  right after others   ...
MIPS: memory layout
MIPS: memory layout
Reverse-enigneering embedded MIPS              devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: R...
MIPS: Reversing and exploitation• objdump / disasmips / radare• IDA  – IDAPython  – QEMU-MIPS• MIPS emulator  – SPIM  – OV...
MIPS: Reversing and exploitation• Delay slots
MIPS: Reversing and exploitation• Finding code patterns   –   03   E0   00   08   (jr $ra -- return)   –   0C   xx   xx   ...
MIPS: Reversing and exploitation• Finding more details about the target system is a key to  understanding kernel procedure...
MIPS: Reversing and exploitation• Basic buffer overflow  – Owerwrite the old $ra stored on stack  – ret2libc  –…
MIPS: Reversing and exploitation• Exploitation is more difficult than on x86 and  ARM   –   Fixed-length instructions with...
Reverse-enigneering embedded MIPS              devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: R...
Case study: DrayTek SOHO routers
Case study: DrayTek SOHO routers• DrayTek Vigor V2xxx series – network devices  – Over 35 models, widely deployed by ISP’s...
Case study: DrayTek SOHO routers• Router Web UI allows to download obviously  obfuscated binary config for further reloadi...
Case study: DrayTek SOHO routersResearch steps.  1. Config file – decrypt  2. UART console and debug menu       1.   Firmw...
Config file1. A way to get encrypted and unencrypted configs   simultaneously was discovered  1. Immediate result – a ciph...
Config file• The config file content itself is a slice of memory
Config file
Config file
Firmware file[4 bytes   ] =     the size of (loader code + main code).[4 bytes   ] =     currently unknown purpose[248 byt...
Filesystem[16 bytes   ] = filesystem header block[N*44 bytes ] = file nodes block, 44 bytes in each node[N*variable ] = co...
Master key•   Derived from local interface MAC address•   8-byte, alternating case letters , e.g. ‘AaBbCcDd’•   Login allo...
Strange findings
Keywords & linksbinwalk , signsrch, SPIM, disasmips, OVPsim,  QEMU-mipsMIPS linux wiki        www.linux-mips.orgCase study...
Nikita Abdullin - Reverse-engineering of embedded MIPS devices. Case Study - DrayTek SOHO-class routers
Upcoming SlideShare
Loading in...5
×

Nikita Abdullin - Reverse-engineering of embedded MIPS devices. Case Study - DrayTek SOHO-class routers

4,328

Published on

International Security Conference "ZeroNights 2011" - http://www.zeronights.org/

Published in: Technology, Business
0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
4,328
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
112
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

Nikita Abdullin - Reverse-engineering of embedded MIPS devices. Case Study - DrayTek SOHO-class routers

  1. 1. Reverse-enigneering embedded MIPS devices Case study: Draytek SOHO routers Nikita Abdullin nabdullin@gmail.com 25.11.2011
  2. 2. Reverse-enigneering embedded MIPS devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: Reversing and exploitationCase study: DrayTek SOHO routers
  3. 3. Reverse-enigneering embedded MIPS devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: Reversing and exploitationCase study: DrayTek SOHO routers
  4. 4. Embedded systems: overview• Everywhere: mobile, media, CPE, …• High level of integration: mostly SoC• Compact size, low power consumption• ARM, MIPS, xScale, …• A real challenge for a reverser – Variety of models – Variety of architectures, conventions and APIs – Lack of information
  5. 5. Embedded systems: overviewWhy ever reverse a MIPS box ?• Ubiquitous devices – especially network & CPE• A well-known RISC platform• Surprisingly, a little of security research:
  6. 6. Reverse-enigneering embedded MIPS devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: Reversing and exploitationCase study: DrayTek SOHO routers
  7. 7. Firmware researchFirmware – how to get it?• Download from device … – JTAG – Serial / UART console / other ports – read EEPROM directly, etc.• … or simply find a firmware upgrade – Single file, several MB’s in size – Encrypted / compressed
  8. 8. Firmware researchTypical firmware binary:• Bootloader• Code• Filesystem imageHow to extract them?• Manual review• Tools
  9. 9. Firmware research :: Tools• Signature search – binwalk – signsrch, offzip – trid• Scriptable hex editor – <Your favourite here>• A set of archivers / unpackers – <Your favourite here>• %script_lang_name%
  10. 10. Firmware research :: Manual review• Sequences of 0x00’s and 0xFF’s• First byte/word may be block size• Last byte/word may be block checksum• Magic signatures• Text strings – Extract, sort, guess and google• Entropy
  11. 11. Firmware research :: Manual review• Filesystem extraction – Use binwalk – Or look for magic headers • JFFS2 = 85 19 (for FS nodes) • cramfs = 45 3D CD 28 • YAFFS = 03 00 00 00 01 00 00 00 FF FF • SquashFS = "hsqs" • VFAT, etc. …
  12. 12. Reverse-enigneering embedded MIPS devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: Reversing and exploitationCase study: DrayTek SOHO routers
  13. 13. MIPS: Introduction• RISC ISA (instruction set architecture)• Fixed 4-byte length instructions• 32-bit and 64-bit• Both big-endian and little-endian• Popular and even more promising with multi- core Loongson series from China
  14. 14. MIPS: registers Name Number Purpose $zero $0 Const = 0 $at $1 Temporary$v0—$v1 $2-$3 Return values$a0—$a3 $4-$7 Function args$t0—$t7 $8-$15 Temporary$s0—$s7 $16-$23 Saved values$t8—$t9 $24-$25 Temporary$k0—$k1 $26-$27 Reserved for OS kernel $gp $28 Global pointer $sp $29 Stack pointer $fp $30 Frame pointer $ra $31 Return address
  15. 15. MIPS: delay slot• MIPS is a pipelined architecture• So not all instructions are safe to be executed right after others – branches & jumps (bne beq j jr jal) – Loads (lb lw ld)
  16. 16. MIPS: memory layout
  17. 17. MIPS: memory layout
  18. 18. Reverse-enigneering embedded MIPS devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: Reversing and exploitationCase study: DrayTek SOHO routers
  19. 19. MIPS: Reversing and exploitation• objdump / disasmips / radare• IDA – IDAPython – QEMU-MIPS• MIPS emulator – SPIM – OVPsim
  20. 20. MIPS: Reversing and exploitation• Delay slots
  21. 21. MIPS: Reversing and exploitation• Finding code patterns – 03 E0 00 08 (jr $ra -- return) – 0C xx xx xx (jal) – 3C xx xx xx (load – lui, la, ...) – 1x xx xx xx (branches)
  22. 22. MIPS: Reversing and exploitation• Finding more details about the target system is a key to understanding kernel procedures14000000 14000FFF external bus general purpose i/o18000300 180003FF general purpose timer1E100400 1E1007FF first serial port...1E103100 1E1031FF hardware crypto1E104100 1E1041FF dma controller1E105300 1E1053FF external bus controller1E105400 1E1057FF PCI bus controller1E116000 1E117000 DSL interface1E180000 1E1BFFFF ethernet controller1F101000 1F101FFF external interrupt controller...1F203000 1F203FFF reset controller1F880200 1F8802FF interrupt controller1F8803F0 1F8803FF watchdog timer
  23. 23. MIPS: Reversing and exploitation• Basic buffer overflow – Owerwrite the old $ra stored on stack – ret2libc –…
  24. 24. MIPS: Reversing and exploitation• Exploitation is more difficult than on x86 and ARM – Fixed-length instructions with a lot of ull bytes – Word-aligned instructions (32 bit) – Word-aligned memory words (32 bit) – I-Cache vs. D-Cache (exploit has no effect, data & code is read & executed from cache)• But protection techniques are still rather new – ASLR (MIPS Linux > 2.6.23) – Stack canaries (GCC > 4.5) – W ^ X not standardized and rarely implemented
  25. 25. Reverse-enigneering embedded MIPS devicesEmbedded systems: overviewFirmware researchMIPS: IntroductionMIPS: Reversing and exploitationCase study: DrayTek SOHO routers
  26. 26. Case study: DrayTek SOHO routers
  27. 27. Case study: DrayTek SOHO routers• DrayTek Vigor V2xxx series – network devices – Over 35 models, widely deployed by ISP’s over Australia, Germany, UK • Routers • ADSL-modems • CPE & combo devices (dual wan + VoIP + … )• MIPS and ARM platforms – POI: Infineon Danube-S (MIPS, dual-core, HW crypto)• Proprietary closed-source OS: DrayOS – Single static non-relocatable binary – Capable of loading Linux drivers
  28. 28. Case study: DrayTek SOHO routers• Router Web UI allows to download obviously obfuscated binary config for further reloading• Firmware upgrades available from vendor, but they are compressed using unknown algorithm• Rumours are that a master key based on MAC address exist
  29. 29. Case study: DrayTek SOHO routersResearch steps. 1. Config file – decrypt 2. UART console and debug menu 1. Firmware dumped through UART hexdump 100 bytes at a time  3. Firmware reversing 4. Config file – decompress 5. Firmware – decompress 6. Filesystem – decompress & extract 7. Master password generation algorithm discovered
  30. 30. Config file1. A way to get encrypted and unencrypted configs simultaneously was discovered 1. Immediate result – a cipher used is definitely in ECB mode, bytewise substitution table is made 2. Substitution table shows strong symmetry, the cipher is extremely weak2. Now try to uncompress – firmware research suggests to try LZO algorithm3. Success!4. Passwords offsets are found to be constant in the config file
  31. 31. Config file• The config file content itself is a slice of memory
  32. 32. Config file
  33. 33. Config file
  34. 34. Firmware file[4 bytes ] = the size of (loader code + main code).[4 bytes ] = currently unknown purpose[248 bytes ] = rest of header, zeroes[varies ] = firmware loader code (uncompressed)[8 bytes ] = loader end signature - 8 bytes ending in A55AA55A, XXA5A5A55AA55A or XX5A5AA55AA55A[4 bytes ] = compressed code size[varies ] = compressed firmware code[4 bytes ] = compressed filesystem image total size[4 bytes ] = compressed filesystem image data size[varies ] = compressed filesystem image[varies ] = garbage or padding at the end
  35. 35. Filesystem[16 bytes ] = filesystem header block[N*44 bytes ] = file nodes block, 44 bytes in each node[N*variable ] = compressed files block, all files are simply concatenated, no padding or alignmentstruct FS_HEAD { char magic [8]; // "PFS/1.0x00" byte unused [6]; // zeroes uint16 num_files; // number of files}struct FS_ENTRY { char fname [32]; // file name, right zero-padded uint32 hash; // some hash, not researched yet uint32 offset; // offset from the beginning of common compressed file block uint32 size; // compressed file size}
  36. 36. Master key• Derived from local interface MAC address• 8-byte, alternating case letters , e.g. ‘AaBbCcDd’• Login allowed only from local addresses to FTP• The same algorithm for all V2xxx devices (from 2002 to 2012) – Compute a simple polynom over MAC address bytes – Divide by 26 and map result to reordered alphabet – Repeat until all chars filled
  37. 37. Strange findings
  38. 38. Keywords & linksbinwalk , signsrch, SPIM, disasmips, OVPsim, QEMU-mipsMIPS linux wiki www.linux-mips.orgCase study reference:draytools github.com/ammonium
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×