This document introduces ARM-X, an ARM firmware emulation framework being developed by Saumil Shah. The goals of ARM-X include creating an IoT virtual machine to enable runtime analysis, reverse engineering, fuzzing, and exploit development of IoT devices. It discusses challenges with emulating IoT device firmware using QEMU and matching the kernel and drivers to the actual device. Extraction of firmware from IoT devices directly from flash memory or via hidden UART interfaces and serial consoles is also covered. A preview release of ARM-X is announced for October 23, 2019.

1. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
Introducing
ARM-X
Saumil Shah
@therealsaumil
16 October 2019

2. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
# WHO AM I
Saumil Shah
CEO, Net Square
@therealsaumil
educating, entertaining
and exasperating
audiences since 1999

3. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
Introducing ARM-X
• An ARM Firmware Emulation Framework.
• Ultimate Goal - create an IoT VM!
• A Virtual IoT device makes for easy
– runtime analysis
– reverse engineering
– fuzzing
– exploit development
• Great insight into embedded hardware by
trying to emulate it.

4. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE

5. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE

6. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
Take a look at an IoT device...

7. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
CPU and
Hardware
Kernel
Drivers
File System
nvram
User Processes
API
UI
libnvram
JTAG
UART
SPI
...it is a special computer...

8. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
compressed FS
CPU
Kernel
Boot Loader
mounted
FS
nvram
init
scripts
Services
Apps
libnvram
The IoT Boot Up Process
conf
conf
conf
conf
firmware
Loads Kernel.
Uncompresses FS to ramdisk,
invokes init process.
ramdiskuserland
Reads config from nvram.
Builds system config files on
the fly.
Starts up system services.
Invokes Applications and
Application services.
READY
POWER ON

9. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
QEMU
CPU and
Limited
Hardware
Kernel
Drivers
uncompressed
Filesystem
emulated
nvram
init scripts
Services
Apps
libnvram
Emulation: Goals and Challenges
x
x
x
x
BUILDROOT
Match the kernel with the
one on the device
chroot environment
Implemented as an INI file,
preloaded before "boot up"
conf
conf
Fix to match QEMU environment
Not all drivers load successfully

10. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
QEMU
CPU and
Limited
Hardware
Kernel
The ARM-X Startup Process

11. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE

12. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE

13. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
QEMU
CPU and
Limited
Hardware
Kernel
Drivers
uncompressed
Filesystem
emulated
nvram
Emulation: Goals and Challenges
conf
conf

14. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE

15. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE

16. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
QEMU
CPU and
Limited
Hardware
Kernel
Drivers
uncompressed
Filesystem
emulated
nvram
init scripts
libnvram
Emulation: Goals and Challenges
conf
conf

17. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE

18. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
QEMU
CPU and
Limited
Hardware
Kernel
Drivers
uncompressed
Filesystem
emulated
nvram
init scripts
Services
Apps
libnvram
Emulation: Goals and Challenges
x
x
x
x
conf
conf

19. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE

20. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
Obtaining the Firmware
Firmware
rootfs
Firmware .bin
file
rootfs+nvram
Serial Console
Direct from
Flash memory

21. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
1: Web/FTP site

22. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
2: Hidden UART interfaces
Vcc (+3.3V) GND
The other
two pins
have to
be TX, RX.
GND
Verify continuity across GND

23. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
Serial Console
Device
GND
TX
RX
GND
TX
RX
minicom
Serial Port = /dev/ttyUSB0
115200 baud
8N1
Vcc

24. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
Serial Console - working

25. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
Finished Serial Port Projects

26. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
# cat /proc/partitions
major minor #blocks name
31 0 256 mtdblock0
31 1 64 mtdblock1
31 2 64 mtdblock2
31 3 1472 mtdblock3
31 4 128 mtdblock4
31 5 64 mtdblock5
31 6 2048 mtdblock6
31 7 32768 mtdblock7
31 8 30975 mtdblock8
31 9 131072 mtdblock9
31 10 98304 mtdblock10
Firmware Extraction
# cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "devconf"
mtd2: 00010000 00010000 "devdata"
mtd3: 00170000 00010000 "mydlink"
mtd4: 00020000 00010000 "langpack"
mtd5: 00010000 00010000 "nvram"
mtd6: 00200000 00010000 "flash"
mtd7: 02000000 00020000 "upgrade"
mtd8: 01e3ffa0 00020000 "rootfs"
mtd9: 08000000 00020000 "nflash"
mtd10: 06000000 00020000 "storage"
dd if=/dev/mtdblock8 …

27. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
3: Take it directly from the chip!

28. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
DEMO TIME!

29. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
WATCH THIS SPACE
Downloads: https://armx.exploitlab.net/
!
Announcements: @therealsaumil
Expect PREVIEW RELEASE 23 October 2019

30. NETSQUARE (c) SAUMIL SHAHHITB Cyberweek 2019 UAE
Thank you
and … QUESTIONS?
@therealsaumil
16 October 2019