摘要：

嵌入式设备的快速增长和广泛应用, 带来便利的同时也引入了巨大的安全风险, 其中, 固件安全是关键风险点之一。嵌入式设备固件数量多、格式复杂, 且很多经过加密、混淆, 使安全分析人员难以快速有效地解析固件并发现隐藏脆弱点。针对以上问题, 提出一种面向异构固件的高效靶向分析技术。首先, 研究多粒度分析方法、文件自动分类、关键信息输出和靶向提取等技术, 实现深度可控的固件靶向解析; 然后, 建立文件系统特征库, 研究基于特征值匹配的靶向识别技术, 增强混淆固件的识别能力, 扩展文件系统识别范围; 最后, 设计爬虫提取不同厂商固件并构建万级固件库作为基础支撑, 实现基于邻近版本的固件靶向解密。设计实现了FTA自动化固件解析系统并进行测试, 实验结果表明, 与主流固件分析工具Binwalk相比, FTA实现的多粒度分析方法对固件的解析速度平均提升42.59%, 优化输出模式实现固件中目标文件的靶向提取, 扩展了对多种文件系统特征值的识别能力, 为嵌入式系统安全领域中的固件解析工作提供了有力支持。

关键词: 嵌入式设备安全, 固件自动解析, 固件加密解密, 固件靶向分析, 大规模固件分析

Abstract:

The widespread use and diversification of embedded devices have introduced unparalleled convenience and formidable security vulnerabilities, particularly in firmware security. The intricate nature of embedded device firmware, coupled with its sheer volume and the adoption of encryption and obfuscation techniques, presents a formidable challenge for security analysts seeking to uncover hidden vulnerabilities efficiently. In response to this challenge, this study proposes an innovative targeting analysis technique customized to heterogeneous firmware. First, the study explores multi-granularity analysis methods, automatic document categorization, key information extraction, and target delineation techniques to enable nuanced and depth-controllable firmware analysis. Next, it establishes a comprehensive file system feature library and introduces a novel target recognition approach based on eigenvalue matching, enhancing the discernment capabilities for obscure firmware and expanding the breadth of file system identification. Furthermore, the study develops a specialized crawler to procure firmware from diverse vendors, leading to the construction of a 10 000-level firmware library that is crucial for targeted decryption based on neighboring versions. An FTA automated firmware parsing system is conceptualized and empirically validated, showing significant enhancements over mainstream firmware analysis tools such as Binwalk. Specifically, FTA's multi-granular analysis method elevates the firmware parsing speed by an average of 42.59%, whereas the optimized output mode facilitates targeted file extraction and extends recognition capabilities across multiple file system feature values. FTA provides robust support for firmware parsing within the domain of embedded system security.

Key words: embedded device security, firmware automation parsing, firmware encryption and decryption, firmware targeting analysis, large-scale firmware analysis