0

I have tried to use angr, KLEE, S2E to symbolically analyze firmware binaries such as DIR-815(httpd ELF binary).

import claripy
import angr
p = angr.Project('./httpd', load_options={'auto_load_libs':False})
state = p.factory.entry_state(addr=0x40a218)
a = state.solver.BVS('a', 8 * 7)
dummy_addr = 0x401c70
state.memory.store(dummy_addr, a)
state.mem[state.regs.a0-0x10].uint64_t = dummy_addr
sm = p.factory.simulation_manager(state)
sm.explore(find=0x40a3b4)
print(sm)
found_path = sm.found[0]
found_path.se.eval(a, cast_to=bytes)

Output is:

WARNING | 2020-12-03 12:15:15,994 | angr.storage.memory_mixins.default_filler_mixin | Filling register s8 with 4 unconstrained bytes referenced from 0x40a228 (main+0x10 in httpd (0x40a228))
WARNING | 2020-12-03 12:15:15,997 | angr.storage.memory_mixins.default_filler_mixin | Filling register s7 with 4 unconstrained bytes referenced from 0x40a22c (main+0x14 in httpd (0x40a22c))
WARNING | 2020-12-03 12:15:16,002 | angr.storage.memory_mixins.default_filler_mixin | Filling register s6 with 4 unconstrained bytes referenced from 0x40a230 (main+0x18 in httpd (0x40a230))
WARNING | 2020-12-03 12:15:16,004 | angr.storage.memory_mixins.default_filler_mixin | Filling register s5 with 4 unconstrained bytes referenced from 0x40a234 (main+0x1c in httpd (0x40a234))
WARNING | 2020-12-03 12:15:16,006 | angr.storage.memory_mixins.default_filler_mixin | Filling register s4 with 4 unconstrained bytes referenced from 0x40a238 (main+0x20 in httpd (0x40a238))
WARNING | 2020-12-03 12:15:16,008 | angr.storage.memory_mixins.default_filler_mixin | Filling register s3 with 4 unconstrained bytes referenced from 0x40a23c (main+0x24 in httpd (0x40a23c))
WARNING | 2020-12-03 12:15:16,010 | angr.storage.memory_mixins.default_filler_mixin | Filling register s2 with 4 unconstrained bytes referenced from 0x40a240 (main+0x28 in httpd (0x40a240))
WARNING | 2020-12-03 12:15:16,012 | angr.storage.memory_mixins.default_filler_mixin | Filling register s1 with 4 unconstrained bytes referenced from 0x40a244 (main+0x2c in httpd (0x40a244))
WARNING | 2020-12-03 12:15:16,015 | angr.storage.memory_mixins.default_filler_mixin | Filling register s0 with 4 unconstrained bytes referenced from 0x40a248 (main+0x30 in httpd (0x40a248))
WARNING | 2020-12-03 12:15:16,022 | angr.storage.memory_mixins.default_filler_mixin | Filling register a1 with 4 unconstrained bytes referenced from 0x40a254 (main+0x3c in httpd (0x40a254))
WARNING | 2020-12-03 12:15:16,175 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0xff800000 with 4 unconstrained bytes referenced from 0x40a26c (main+0x54 in httpd (0x40a26c))
<SimulationManager with 3 active, 1 found>
b'\x00\x00\x00\x00\x00\x00\x00'

Does this output meaningful? However, the result is finished without success. Do you recommend other open-source symbolic execution tools for Firmware?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.