Reverse a BFLT file

Question

A couple of days ago I bought an air conditioner. The system has a wireless module. By analyzing the ports, I could see that port 22 is open.

I have obtained the file that is responsible for managing the connection with the outside and internally (the interface).

The file is of type BFLT executable - version 4 ram. Here is more detailed information. (extracted from radare)

type    bFLT (Executable file)      class      bflt
file    backupServer                arch       arm
fd          6                       bits        32
size     0x3d804                    machine   unknown
iorw t     true                     os         Linux
blksz      0x0                      minopsz     4
mode       -r--                     maxopsz     4
block     0x100                     pcalign     4
format    bflt                      subsys     Linux
havecode  true                      endian    little
pic       false                     stripped   false
canary    false                     static     true
nx        false                     linenum    false
crypto    false                     lsyms      false
va        false                     relocs     false
bintype   bflt                      binsz     251908

This file I have been able to virtualize with qemu-arm.

In the BFLT files there is a section containing all the string and using IDA Pro with the bfltldr plugin to relocate the strings. For debugging I have used the architecture arm litte endian generic

Analyzing the application with IDA Pro, I was able to observe that it expects from the outside some commands with a format and some parameters.

The parameters I have but the arguments do not as it is complicated to debug without having any kind of information about the name of each function.

The operating system used by the application I think is GNU/Linux or a variant.

My goal is to analyze the arguments and parameters that are passed via socket to try to find some vulnerability (buffer overflow, ...) and inject a shell to open a backdoor.

The problem I have is that I find it costly to debug the application since in IDA Pro are the memory addresses in the functions and I would like to know if there is any change memory addresses, by the names of known functions of the GNU/Linux.

Answer 1

bFLT format is used in uCLinux systems and its executables use one of two approaches to make system calls:

1. Statically linked libc (uClibc). In this case you should see explicit syscalls (SVC instructions) in the code. Depending on the age of the system the will be using either Old ABI (with syscall number encoded as the operand of the SVC instruction) or the new ABI(EABI) with syscall number in R7. You can look up syscall numbers e.g. here.

2. Libc in a shared library. I have never seen it myself but it seems uCLinux does support shared libraries loaded at fixed addresses. So you may see calls to apparently unmapped addresses where the libc is supposed to be loaded. In this case you may need to disassemble the libc binary as well to label the functions using syscalls and then match against the calls in the binary.

In either case I would suggest you installing or building an uCLinux toolchain and compiling a few helloworld binaries with it. The nice thing about it is that the bFLT is produced from an ELF as the final step so you can compare the ELF with all symbols against the bFLT which should give you some clues how to handle your target.