0

I have tried to use angr, KLEE, S2E to symbolically analyze firmware binaries such as DIR-815(httpd ELF binary).

import claripy
import angr
p = angr.Project('./httpd', load_options={'auto_load_libs':False})
state = p.factory.entry_state(addr=0x40a218)
a = state.solver.BVS('a', 8 * 7)
dummy_addr = 0x401c70
state.memory.store(dummy_addr, a)
state.mem[state.regs.a0-0x10].uint64_t = dummy_addr
sm = p.factory.simulation_manager(state)
sm.explore(find=0x40a3b4)
print(sm)
found_path = sm.found[0]
found_path.se.eval(a, cast_to=bytes)

Output is:

WARNING | 2020-12-03 12:15:15,994 | angr.storage.memory_mixins.default_filler_mixin | Filling register s8 with 4 unconstrained bytes referenced from 0x40a228 (main+0x10 in httpd (0x40a228))
WARNING | 2020-12-03 12:15:15,997 | angr.storage.memory_mixins.default_filler_mixin | Filling register s7 with 4 unconstrained bytes referenced from 0x40a22c (main+0x14 in httpd (0x40a22c))
WARNING | 2020-12-03 12:15:16,002 | angr.storage.memory_mixins.default_filler_mixin | Filling register s6 with 4 unconstrained bytes referenced from 0x40a230 (main+0x18 in httpd (0x40a230))
WARNING | 2020-12-03 12:15:16,004 | angr.storage.memory_mixins.default_filler_mixin | Filling register s5 with 4 unconstrained bytes referenced from 0x40a234 (main+0x1c in httpd (0x40a234))
WARNING | 2020-12-03 12:15:16,006 | angr.storage.memory_mixins.default_filler_mixin | Filling register s4 with 4 unconstrained bytes referenced from 0x40a238 (main+0x20 in httpd (0x40a238))
WARNING | 2020-12-03 12:15:16,008 | angr.storage.memory_mixins.default_filler_mixin | Filling register s3 with 4 unconstrained bytes referenced from 0x40a23c (main+0x24 in httpd (0x40a23c))
WARNING | 2020-12-03 12:15:16,010 | angr.storage.memory_mixins.default_filler_mixin | Filling register s2 with 4 unconstrained bytes referenced from 0x40a240 (main+0x28 in httpd (0x40a240))
WARNING | 2020-12-03 12:15:16,012 | angr.storage.memory_mixins.default_filler_mixin | Filling register s1 with 4 unconstrained bytes referenced from 0x40a244 (main+0x2c in httpd (0x40a244))
WARNING | 2020-12-03 12:15:16,015 | angr.storage.memory_mixins.default_filler_mixin | Filling register s0 with 4 unconstrained bytes referenced from 0x40a248 (main+0x30 in httpd (0x40a248))
WARNING | 2020-12-03 12:15:16,022 | angr.storage.memory_mixins.default_filler_mixin | Filling register a1 with 4 unconstrained bytes referenced from 0x40a254 (main+0x3c in httpd (0x40a254))
WARNING | 2020-12-03 12:15:16,175 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0xff800000 with 4 unconstrained bytes referenced from 0x40a26c (main+0x54 in httpd (0x40a26c))
<SimulationManager with 3 active, 1 found>
b'\x00\x00\x00\x00\x00\x00\x00'

Does this output meaningful? However, the result is finished without success. Do you recommend other open-source symbolic execution tools for Firmware?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.