├── CHANGELOG ├── LICENSE ├── README.md ├── README_EN.md ├── docker-menu.sh ├── fap.config ├── fap.py ├── firmadyne ├── .gitignore ├── .gitmodules ├── README.md ├── analyses │ ├── README.md │ ├── metasploit │ │ └── linksys_tmunblock_admin_reset_bof.rb │ ├── nmap.sh │ ├── runExploits.py │ ├── snmpwalk.sh │ └── webAccess.py ├── binaries │ ├── README.md │ ├── console.armel │ ├── console.mipseb │ ├── console.mipsel │ ├── libnvram.so.armel │ ├── libnvram.so.mipseb │ ├── libnvram.so.mipsel │ ├── vmlinux.mipseb │ ├── vmlinux.mipsel │ └── zImage.armel ├── database │ └── schema ├── download.sh ├── firmadyne.config ├── paper │ └── paper.pdf ├── scripts │ ├── delete.sh │ ├── fixImage.sh │ ├── getArch.sh │ ├── inferNetwork.sh │ ├── makeImage.sh │ ├── makeNetwork.py │ ├── mount.sh │ ├── preInit.sh │ ├── run-debug.sh │ ├── run.armel-debug.sh │ ├── run.armel.sh │ ├── run.mipseb-debug.sh │ ├── run.mipseb.sh │ ├── run.mipsel-debug.sh │ ├── run.mipsel.sh │ ├── run.sh │ ├── tar2db.py │ └── umount.sh └── sources │ ├── console │ ├── LICENSE.txt │ ├── Makefile │ ├── README.md │ └── console.c │ ├── extractor │ ├── Dockerfile │ ├── LICENSE.txt │ ├── README.md │ ├── extract.sh │ └── extractor.py │ ├── libnvram │ ├── LICENSE.txt │ ├── Makefile │ ├── README.md │ ├── alias.c │ ├── alias.h │ ├── config.h │ ├── nvram.c │ ├── nvram.h │ └── test.c │ └── scraper │ ├── .gitignore │ ├── LICENSE.txt │ ├── README.md │ ├── TODO.txt │ ├── firmware │ ├── __init__.py │ ├── items.py │ ├── loader.py │ ├── pipelines.py │ ├── settings.py │ └── spiders │ │ ├── 360.py │ │ ├── __init__.py │ │ ├── actiontec.py │ │ ├── airlink101.py │ │ ├── asus.py │ │ ├── att.py │ │ ├── belkin.py │ │ ├── buffalo.py │ │ ├── centurylink.py │ │ ├── dlink.py │ │ ├── foscam.py │ │ ├── huawei_en.py │ │ ├── huawei_zh.py │ │ ├── linksys.py │ │ ├── mercury.py │ │ ├── microstrain.py │ │ ├── mikrotik.py │ │ ├── netcore.py │ │ ├── netgear.py │ │ ├── openwireless.py │ │ ├── openwrt.py │ │ ├── pfsense.py │ │ ├── phicomm.py │ │ ├── polycom.py │ │ ├── qnap.py │ │ ├── seiki.py │ │ ├── supermicro.py │ │ ├── synology.py │ │ ├── tenda_en.py │ │ ├── tenda_zh.py │ │ ├── tenvis.py │ │ ├── ti.py │ │ ├── tomato-shibby.py │ │ ├── tomato.py │ │ ├── tp-link_en.py │ │ ├── tp-link_zh.py │ │ ├── trendnet.py │ │ ├── ubiquiti.py │ │ ├── ublox.py │ │ ├── verizon.py │ │ ├── xerox.py │ │ └── zyxel.py │ ├── ftp.sh │ ├── scraper-64332e251865a419616dd493b9e74c30fad02024 │ ├── .gitignore │ ├── LICENSE.txt │ ├── README.md │ ├── TODO.txt │ ├── firmware │ │ ├── __init__.py │ │ ├── items.py │ │ ├── loader.py │ │ ├── pipelines.py │ │ ├── settings.py │ │ └── spiders │ │ │ ├── 360.py │ │ │ ├── __init__.py │ │ │ ├── actiontec.py │ │ │ ├── airlink101.py │ │ │ ├── asus.py │ │ │ ├── att.py │ │ │ ├── belkin.py │ │ │ ├── buffalo.py │ │ │ ├── centurylink.py │ │ │ ├── dlink.py │ │ │ ├── foscam.py │ │ │ ├── huawei_en.py │ │ │ ├── huawei_zh.py │ │ │ ├── linksys.py │ │ │ ├── mercury.py │ │ │ ├── microstrain.py │ │ │ ├── mikrotik.py │ │ │ ├── netcore.py │ │ │ ├── netgear.py │ │ │ ├── openwireless.py │ │ │ ├── openwrt.py │ │ │ ├── pfsense.py │ │ │ ├── phicomm.py │ │ │ ├── polycom.py │ │ │ ├── qnap.py │ │ │ ├── seiki.py │ │ │ ├── supermicro.py │ │ │ ├── synology.py │ │ │ ├── tenda_en.py │ │ │ ├── tenda_zh.py │ │ │ ├── tenvis.py │ │ │ ├── ti.py │ │ │ ├── tomato-shibby.py │ │ │ ├── tomato.py │ │ │ ├── tp-link_en.py │ │ │ ├── tp-link_zh.py │ │ │ ├── trendnet.py │ │ │ ├── ubiquiti.py │ │ │ ├── ublox.py │ │ │ ├── verizon.py │ │ │ ├── xerox.py │ │ │ └── zyxel.py │ ├── ftp.sh │ └── scrapy.cfg │ └── scrapy.cfg ├── images └── run.png ├── qemu-builds ├── 2.5.0 │ ├── qemu-system-arm │ ├── qemu-system-mips │ ├── qemu-system-mipsel │ └── share │ │ └── qemu │ │ ├── QEMU,cgthree.bin │ │ ├── QEMU,tcx.bin │ │ ├── acpi-dsdt.aml │ │ ├── bamboo.dtb │ │ ├── bios-256k.bin │ │ ├── bios.bin │ │ ├── efi-e1000.rom │ │ ├── efi-eepro100.rom │ │ ├── efi-ne2k_pci.rom │ │ ├── efi-pcnet.rom │ │ ├── efi-rtl8139.rom │ │ ├── efi-virtio.rom │ │ ├── keymaps │ │ ├── ar │ │ ├── bepo │ │ ├── common │ │ ├── cz │ │ ├── da │ │ ├── de │ │ ├── de-ch │ │ ├── en-gb │ │ ├── en-us │ │ ├── es │ │ ├── et │ │ ├── fi │ │ ├── fo │ │ ├── fr │ │ ├── fr-be │ │ ├── fr-ca │ │ ├── fr-ch │ │ ├── hr │ │ ├── hu │ │ ├── is │ │ ├── it │ │ ├── ja │ │ ├── lt │ │ ├── lv │ │ ├── mk │ │ ├── modifiers │ │ ├── nl │ │ ├── nl-be │ │ ├── no │ │ ├── pl │ │ ├── pt │ │ ├── pt-br │ │ ├── ru │ │ ├── sl │ │ ├── sv │ │ ├── th │ │ └── tr │ │ ├── kvmvapic.bin │ │ ├── linuxboot.bin │ │ ├── multiboot.bin │ │ ├── openbios-ppc │ │ ├── openbios-sparc32 │ │ ├── openbios-sparc64 │ │ ├── palcode-clipper │ │ ├── petalogix-ml605.dtb │ │ ├── petalogix-s3adsp1800.dtb │ │ ├── ppc_rom.bin │ │ ├── pxe-e1000.rom │ │ ├── pxe-eepro100.rom │ │ ├── pxe-ne2k_pci.rom │ │ ├── pxe-pcnet.rom │ │ ├── pxe-rtl8139.rom │ │ ├── pxe-virtio.rom │ │ ├── q35-acpi-dsdt.aml │ │ ├── qemu-icon.bmp │ │ ├── qemu_logo_no_text.svg │ │ ├── s390-ccw.img │ │ ├── s390-zipl.rom │ │ ├── sgabios.bin │ │ ├── slof.bin │ │ ├── spapr-rtas.bin │ │ ├── trace-events │ │ ├── u-boot.e500 │ │ ├── vgabios-cirrus.bin │ │ ├── vgabios-qxl.bin │ │ ├── vgabios-stdvga.bin │ │ ├── vgabios-virtio.bin │ │ ├── vgabios-vmware.bin │ │ └── vgabios.bin └── README.txt ├── reset.py ├── setup.sh ├── shutdown.py └── testcases ├── README.md └── iot_dir880l_110b01.bin /CHANGELOG: -------------------------------------------------------------------------------- 1 | ### v2.0 2 | - 安装流程进一步简化，增加新版本库的支持，删除冗余库 3 | - 移除 `python2`，之前的版本需要 `python2` 和 `python3` 的同时支持 4 | - 移除 `setup2kali.sh`，同时修改 `setup.sh` 5 | - 修改 `firmadyne` 源码中的 `inferNetwork.sh` 文件 6 | - 修改 `firmaydne` 源码中的 `extractor.py` 文件 7 | - 修改 `binwalk` 安装脚本 8 | 9 | ### v2.1 10 | - 增加无binwalk模式 11 | - 修改若干描述 12 | - 修复mips架构不能调试的问题 13 | 14 | ### v2.2 [2022-05-07] 15 | - Fix mipsel and armel network error 16 | - Fix directory from nvram 17 | 18 | ### v2.3 [2022-07-20] 19 | - 修复`Ubuntu16.04`下一些bug (Fix some bugs in ubuntu16.04) 20 | - `Kali2022/Ubuntu2022-binwalk`无法解压很多固件，所以抛弃了这两个操作系统 (Binwalk could not decompress many firmware, so it abandoned these two operating systems) 21 | 22 | ### v2.3.1 [2022-07-21] 23 | - 修复Fap在多个Linux发行版中的兼容性问题 (Fix FAP compatibility issues in multiple Linux distributions) 24 | - 创建docker镜像 (Create a docker image) -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2021 liyansong2018 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README_EN.md: -------------------------------------------------------------------------------- 1 | # Firmware Analysis Plus (Fap) 2 | 3 | Fap is a greate simulator based on the [firmadyne](https://github.com/firmadyne/firmadyne) that can run common router firmware from TP-Link, D-Link and other IoT manufacturer. 4 | 5 | ## Build 6 | 7 | Installing Fap is easy. **We strongly recommend installing Fap on the latest version of Ubuntu 20.04 and [binwalk-f4a5759](https://github.com/liyansong2018/binwalk)**. [VMware Image](https://pan.baidu.com/s/1eVNxoLKlqAQHcrSMfI7tQw?pwd=jpy4) and docker `docker-menu.sh` is also available. 8 | 9 | ```shell 10 | git clone https://github.com/liyansong2018/firmware-analysis-plus.git 11 | cd firmware-analysis-plus 12 | ./setup.sh 13 | ``` 14 | 15 | ## Usage 16 | 17 | Modify password in the `fap.config` 18 | 19 | ```Shell 20 | [DEFAULT] 21 | sudo_password=toor 22 | firmadyne_path=/home/lys/Tools/firmware-analysis-plus/firmadyne 23 | ``` 24 | 25 | Monitor firmware 26 | 27 | ```Shell 28 | ./fap.py -q ./qemu-builds/2.5.0/ ./testcases/iot.bin 29 | ``` 30 | 31 | Shut down the simulator 32 | 33 | ``` 34 | ./shutdown.py 35 | ``` 36 | 37 | Reset the simulator 38 | 39 | ```shell 40 | ./reset.py 41 | ``` 42 | 43 | Help information 44 | 45 | ```shell 46 | ./fap.py --help 47 | usage: fap.py [-h] [-q qemu_path] [-b compiled_binwalk] [-t network_infer_time] firm_path 48 | 49 | options: 50 | -h, --help show this help message and exit 51 | -q qemu_path, --qemu qemu_path 52 | The qemu version to use (must exist within qemu-builds directory). If not specified, the qemu 53 | version installed system-wide will be used 54 | -b compiled_binwalk, --binwalk compiled_binwalk 55 | Has binwalk been compiled? yes or no, 1 or 0 56 | -t network_infer_time, --time network_infer_time 57 | Network infer time 58 | ``` 59 | 60 | ## List of firmware supported 61 | 62 | ### Common 63 | 64 | - [wnap320_V3.7.11.4_firmware.tar](https://github.com/liyansong2018/firmware-analysis-plus/tree/master/testcases) 65 | - DIR-601_REVB_FIRMWARE_2.01.BIN 66 | - DIR890A1_FW103b07.bin 67 | - DIR-505L_FIRMWARE_1.01.ZIP 68 | - DIR-615_REVE_FIRMWARE_5.11.ZIP 69 | - DGL-5500_REVA_FIRMWARE_1.12B05.ZIP 70 | - WRT54G3G_2.11.05_ETSI_code.bin 71 | - NBG-416N_V1.00(USA.7)C0.zip 72 | - TEW-638v2%201.1.5.zip 73 | - Firmware_TEW-411BRPplus_2.07_EU.zip 74 | - DGND3700 Firmware Version 1.0.0.17(NA).zip 75 | - **DIR-300A1_FW105b09.bin** 76 | - HG532eV100R001C01B020_upgrade_packet.bin 77 | - DIR-860/865/880... 78 | - ... 79 | 80 | ### Custom 81 | 82 | - [FAP-DIR2640.tar.bz2](https://github.com/liyansong2018/firmware-analysis-plus/releases) 83 | - TL-WR802N(US)_V4_200 84 | - Archer_C50v5_US_0.9.1_0.2 -------------------------------------------------------------------------------- /docker-menu.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # 检测shell是否为bash 3 | if [ -z "$BASH_VERSION" ]; then 4 | echo "请使用bash运行此脚本，不要使用sh" 5 | exit 1 6 | fi 7 | 8 | function menu { 9 | clear 10 | echo 11 | echo -e "\t\tDocker 启动菜单\n" 12 | echo -e "\t1. 启动容器" 13 | echo -e "\t2. 停止容器" 14 | echo -e "\t3. 删除容器" 15 | echo -e "\t4. 进入容器" 16 | echo 17 | echo -e "\t 退出" 18 | echo -en "\t\t请输入选项:" 19 | read -n 1 option 20 | } 21 | 22 | function start { 23 | clear 24 | # 判断fap容器是否存在，存在则直接启动 25 | if [ $(sudo docker ps -a | grep fap | wc -l) -gt 0 ]; then 26 | echo -e "\n\n\t\t容器已存在，直接启动" 27 | echo "启动中..." 28 | sudo docker start fap 29 | return 30 | fi 31 | if [ -f run.sh ]; then 32 | echo -e "\n\n\t\t启动命令已存在，从run.sh文件启动；或是重新配置启动命令？" 33 | echo -en "\n\n\t\t是否从run.sh文件启动？(y/n):" 34 | echo -en "\n\n\t\trun.sh文件内容如下：\n\n" 35 | cat run.sh 36 | read -n 1 yn 37 | if [ "$yn" == "y" ]; then 38 | echo "启动中..." 39 | ./run.sh 40 | return 41 | fi 42 | fi 43 | echo -e "\n\n\t\t启动容器，容器名称默认为：fap" 44 | echo -e "\n\n\t\t请输入挂载路径，多条请使用半角分号分隔，例如：./:/root/mnt" 45 | read -e -p "请输入路径：" path 46 | echo -e "\n\n\t\t请输入端口映射，多条请使用半角分号分隔，例如：8080:80" 47 | read -e -p "请输入端口：" port 48 | allports="" 49 | allpath="" 50 | for i in $(echo $port | tr ";" "\n") 51 | do 52 | allports="-p $i $allports" 53 | done 54 | for i in $(echo $path | tr ";" "\n") 55 | do 56 | allpath="-v $i $allpath" 57 | done 58 | # 保存启动配置到配置文件 59 | echo "sudo docker run -it --privileged $allports $allpath --name fap liyansong2022/fap-docker:2.3.1 /bin/bash" > run.sh 60 | chmod +x run.sh 61 | echo "启动命令已保存到run.sh文件" 62 | cat run.sh 63 | echo "启动中..." 64 | ./run.sh 65 | } 66 | 67 | function stop { 68 | clear 69 | echo -e "\n\n\t\t停止容器" 70 | sudo docker stop fap 71 | echo -e "\n\n\t\t停止成功" 72 | } 73 | 74 | function delete { 75 | clear 76 | echo -e "\n\n\t\t删除容器" 77 | sudo docker rm -f fap 78 | echo -e "\n\n\t\t删除成功" 79 | } 80 | 81 | function enter { 82 | clear 83 | echo -e "\n\n\t\t进入容器" 84 | sudo docker exec -it fap /bin/bash 85 | } 86 | 87 | while [ 1 ] 88 | do 89 | menu 90 | case $option in 91 | 1) 92 | start;; 93 | 2) 94 | stop;; 95 | 3) 96 | delete;; 97 | 4) 98 | enter;; 99 | *) 100 | break;; 101 | esac 102 | echo -en "\n\n\t\t按任意键继续" 103 | read -n 1 line 104 | done 105 | clear 106 | -------------------------------------------------------------------------------- /fap.config: -------------------------------------------------------------------------------- 1 | [DEFAULT] 2 | sudo_password=kali 3 | firmadyne_path=/home/kali/firmware-analysis-plus/firmadyne 4 | -------------------------------------------------------------------------------- /firmadyne/.gitignore: -------------------------------------------------------------------------------- 1 | firmadyne.config 2 | 3 | *.o 4 | *.armel 5 | *.mipseb 6 | *.mipsel 7 | binaries/ 8 | images/ 9 | scratch/ 10 | -------------------------------------------------------------------------------- /firmadyne/.gitmodules: -------------------------------------------------------------------------------- 1 | [submodule "sources/extractor"] 2 | path = sources/extractor 3 | url = https://github.com/firmadyne/extractor.git 4 | [submodule "sources/console"] 5 | path = sources/console 6 | url = https://github.com/firmadyne/console.git 7 | [submodule "sources/scraper"] 8 | path = sources/scraper 9 | url = https://github.com/firmadyne/scraper.git 10 | [submodule "sources/libnvram"] 11 | path = sources/libnvram 12 | url = https://github.com/firmadyne/libnvram.git 13 | -------------------------------------------------------------------------------- /firmadyne/analyses/nmap.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | set -u 4 | 5 | if [ -e ./firmadyne.config ]; then 6 | source ./firmadyne.config 7 | elif [ -e ../firmadyne.config ]; then 8 | source ../firmadyne.config 9 | else 10 | echo "Error: Could not find 'firmadyne.config'!" 11 | exit 1 12 | fi 13 | 14 | if [ $# -ne 1 ]; then 15 | echo "Usage: $0 " 16 | exit 1 17 | fi 18 | 19 | IID=${1} 20 | WORK_DIR=`get_scratch ${IID}` 21 | 22 | #Nmap options to use for scanning: 23 | NMAP_OPTS="-v -n -sSV" 24 | 25 | if ! which nmap > /dev/null; then 26 | echo "[-] missing nmap binary" 27 | exit 1 28 | fi 29 | 30 | if ! [ -d ${WORK_DIR} ]; then 31 | echo "[-] missing working directory of image ID ${IID}" 32 | exit 1 33 | fi 34 | 35 | if ! [ -f ${WORK_DIR}/run.sh ]; then 36 | echo "[-] missing start script (run.sh) of image ID ${IID}" 37 | exit 1 38 | fi 39 | 40 | TARGET_IP=`grep "GUESTIP=" "${WORK_DIR}"/run.sh | cut -d= -f2` 41 | 42 | if [ -z "${TARGET_IP}" ]; then 43 | echo "[-] Found no target IP address ..." 44 | exit 1 45 | fi 46 | 47 | echo "[+] Found IP: ${TARGET_IP}" 48 | 49 | sudo nmap ${NMAP_OPTS} "${TARGET_IP}" -oA "$WORK_DIR"nmap-basic-tcp | tee "${WORK_DIR}"nmap-basic-tcp.txt 2>&1 50 | 51 | echo -e "\nDumped Nmap scan details of ${TARGET_IP} to $WORK_DIR" 52 | 53 | 54 | -------------------------------------------------------------------------------- /firmadyne/analyses/snmpwalk.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | TARGET_IP=$1 4 | 5 | snmpwalk -v2c -c public $1 .iso > snmp.public.txt 2>&1 6 | snmpwalk -v2c -c private $1 .iso > snmp.private.txt 2>&1 7 | 8 | echo "Dumped to snmp.public.txt and snmp.private.txt!" 9 | -------------------------------------------------------------------------------- /firmadyne/binaries/README.md: -------------------------------------------------------------------------------- 1 | Binary files used by the FIRMADYNE framework should be placed here. These include: 2 | 3 | * console 4 | * `console.armel` 5 | * `console.mipseb` 6 | * `console.mipsel` 7 | 8 | * libnvram 9 | * `libnvram.so.armel` 10 | * `libnvram.so.mipseb` 11 | * `libnvram.so.mipsel` 12 | 13 | * kernel 14 | * `zImage.armel` 15 | * `vmlinux.mipseb` 16 | * `vmlinux.mipsel` 17 | -------------------------------------------------------------------------------- /firmadyne/binaries/console.armel: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/binaries/console.armel -------------------------------------------------------------------------------- /firmadyne/binaries/console.mipseb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/binaries/console.mipseb -------------------------------------------------------------------------------- /firmadyne/binaries/console.mipsel: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/binaries/console.mipsel -------------------------------------------------------------------------------- /firmadyne/binaries/libnvram.so.armel: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/binaries/libnvram.so.armel -------------------------------------------------------------------------------- /firmadyne/binaries/libnvram.so.mipseb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/binaries/libnvram.so.mipseb -------------------------------------------------------------------------------- /firmadyne/binaries/libnvram.so.mipsel: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/binaries/libnvram.so.mipsel -------------------------------------------------------------------------------- /firmadyne/binaries/vmlinux.mipseb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/binaries/vmlinux.mipseb -------------------------------------------------------------------------------- /firmadyne/binaries/vmlinux.mipsel: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/binaries/vmlinux.mipsel -------------------------------------------------------------------------------- /firmadyne/binaries/zImage.armel: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/binaries/zImage.armel -------------------------------------------------------------------------------- /firmadyne/download.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | set -e 4 | 5 | echo "Downloading binaries..." 6 | 7 | echo "Downloading kernel 2.6.32 (MIPS)..." 8 | wget -O ./binaries/vmlinux.mipsel https://github.com/firmadyne/kernel-v2.6.32/releases/download/v1.0/vmlinux.mipsel 9 | wget -O ./binaries/vmlinux.mipseb https://github.com/firmadyne/kernel-v2.6.32/releases/download/v1.0/vmlinux.mipseb 10 | 11 | echo "Downloading kernel 4.1 (ARM)..." 12 | wget -O ./binaries/zImage.armel https://github.com/firmadyne/kernel-v4.1/releases/download/v1.0/zImage.armel 13 | 14 | echo "Downloading console..." 15 | wget -O ./binaries/console.armel https://github.com/firmadyne/console/releases/download/v1.0/console.armel 16 | wget -O ./binaries/console.mipseb https://github.com/firmadyne/console/releases/download/v1.0/console.mipseb 17 | wget -O ./binaries/console.mipsel https://github.com/firmadyne/console/releases/download/v1.0/console.mipsel 18 | 19 | echo "Downloading libnvram..." 20 | wget -O ./binaries/libnvram.so.armel https://github.com/firmadyne/libnvram/releases/download/v1.0b/libnvram.so.armel 21 | wget -O ./binaries/libnvram.so.mipseb https://github.com/firmadyne/libnvram/releases/download/v1.0b/libnvram.so.mipseb 22 | wget -O ./binaries/libnvram.so.mipsel https://github.com/firmadyne/libnvram/releases/download/v1.0b/libnvram.so.mipsel 23 | 24 | echo "Done!" 25 | -------------------------------------------------------------------------------- /firmadyne/paper/paper.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/secnotes/firmware-analysis-plus/cc740a76fff25b145b53878e3dad5a06382b453c/firmadyne/paper/paper.pdf -------------------------------------------------------------------------------- /firmadyne/scripts/delete.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | if [ -e ./firmadyne.config ]; then 4 | source ./firmadyne.config 5 | elif [ -e ../firmadyne.config ]; then 6 | source ../firmadyne.config 7 | else 8 | echo "Error: Could not find 'firmadyne.config'!" 9 | exit 1 10 | fi 11 | 12 | if check_number $1; then 13 | echo "Usage: $0 " 14 | echo "This script deletes a whole project" 15 | exit 1 16 | fi 17 | IID=${1} 18 | 19 | #Check that no qemu is running: 20 | echo "checking the process table for a running qemu instance ..." 21 | PID=`ps -ef | grep qemu | grep "${IID}" | grep -v grep | awk '{print $2}'` 22 | if ! [ -z $PID ]; then 23 | echo "killing process ${PID}" 24 | sudo kill -9 ${PID} 25 | fi 26 | 27 | PID1=`ps -ef | grep "${IID}\/run.sh" | grep -v grep | awk '{print $2}'` 28 | if ! [ -z $PID1 ]; then 29 | echo "killing process ${PID1}" 30 | sudo kill ${PID1} 31 | fi 32 | 33 | #Check that nothing is mounted: 34 | echo "In case the filesystem is mounted, umount it now ..." 35 | sudo ./scripts/umount.sh ${IID} 36 | 37 | #Check network config 38 | echo "In case the network is configured, reconfigure it now ..." 39 | for i in 0 .. 4; do 40 | sudo ifconfig tap${IID}_${i} down 41 | sudo tunctl -d tap${IID}_${i} 42 | done 43 | 44 | #Cleanup database: 45 | echo "Remove the database entries ..." 46 | psql -d firmware -U firmadyne -h 127.0.0.1 -t -q -c "DELETE from image WHERE id=${IID};" 47 | 48 | #Cleanup filesystem: 49 | echo "Clean up the file system ..." 50 | if [ -f "/tmp/qemu.${IID}*" ]; then 51 | sudo rm /tmp/qemu.${IID}* 52 | fi 53 | 54 | if [ -f ./images/${IID}.tar.gz ]; then 55 | sudo rm ./images/${IID}.tar.gz 56 | fi 57 | 58 | if [ -f ./images/${IID}.kernel ]; then 59 | sudo rm ./images/${IID}.kernel 60 | fi 61 | 62 | if [ -d ./scratch/${IID}/ ]; then 63 | sudo rm -r ./scratch/${IID}/ 64 | fi 65 | 66 | echo "Done. Removed project ID ${IID}." 67 | -------------------------------------------------------------------------------- /firmadyne/scripts/getArch.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | set -e 4 | set -u 5 | 6 | if [ -e ./firmadyne.config ]; then 7 | source ./firmadyne.config 8 | elif [ -e ../firmadyne.config ]; then 9 | source ../firmadyne.config 10 | else 11 | echo "Error: Could not find 'firmadyne.config'!" 12 | exit 1 13 | fi 14 | 15 | function getArch() { 16 | if (echo ${FILETYPE} | grep -q "MIPS64") 17 | then 18 | ARCH="mips64" 19 | elif (echo ${FILETYPE} | grep -q "MIPS") 20 | then 21 | ARCH="mips" 22 | elif (echo ${FILETYPE} | grep -q "ARM64") 23 | then 24 | ARCH="arm64" 25 | elif (echo ${FILETYPE} | grep -q "ARM") 26 | then 27 | ARCH="arm" 28 | elif (echo ${FILETYPE} | grep -q "Intel 80386") 29 | then 30 | ARCH="intel" 31 | elif (echo ${FILETYPE} | grep -q "x86-64") 32 | then 33 | ARCH="intel64" 34 | elif (echo ${FILETYPE} | grep -q "PowerPC") 35 | then 36 | ARCH="ppc" 37 | else 38 | ARCH="" 39 | fi 40 | } 41 | 42 | function getEndian() { 43 | if (echo ${FILETYPE} | grep -q "LSB") 44 | then 45 | END="el" 46 | elif (echo ${FILETYPE} | grep -q "MSB") 47 | then 48 | END="eb" 49 | else 50 | END="" 51 | fi 52 | } 53 | 54 | INFILE=${1} 55 | BASE=$(basename "$1") 56 | IID=${BASE%.tar.gz} 57 | 58 | mkdir -p "/tmp/${IID}" 59 | 60 | set +e 61 | FILES="$(tar -tf $INFILE | grep -e "/busybox\$") " 62 | FILES+="$(tar -tf $INFILE | grep -E "/sbin/[[:alpha:]]+")" 63 | FILES+="$(tar -tf $INFILE | grep -E "/bin/[[:alpha:]]+")" 64 | set -e 65 | 66 | for TARGET in ${FILES} 67 | do 68 | SKIP=$(echo "${TARGET}" | fgrep -o / | wc -l) 69 | tar -xf "${INFILE}" -C "/tmp/${IID}/" --strip-components=${SKIP} ${TARGET} 70 | TARGETLOC="/tmp/$IID/${TARGET##*/}" 71 | 72 | if [ -h ${TARGETLOC} ] || [ ! -f ${TARGETLOC} ] 73 | then 74 | continue 75 | fi 76 | 77 | FILETYPE=$(file ${TARGETLOC}) 78 | 79 | echo -n "${TARGET}: " 80 | getArch 81 | getEndian 82 | 83 | if [ -n "${ARCH}" ] && [ -n "${END}" ] 84 | then 85 | ARCHEND=${ARCH}${END} 86 | echo ${ARCHEND} 87 | 88 | #########psql -d firmware -U firmadyne -h 127.0.0.1 -q -c "UPDATE image SET arch = '$ARCHEND' WHERE id = $IID;" 89 | 90 | rm -fr "/tmp/${IID}" 91 | exit 0 92 | else 93 | echo -n ${ARCH} 94 | echo ${END} 95 | fi 96 | done 97 | 98 | rm -fr "/tmp/${IID}" 99 | 100 | exit 1 101 | -------------------------------------------------------------------------------- /firmadyne/scripts/inferNetwork.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | set -e 4 | set -u 5 | 6 | if [ -e ./firmadyne.config ]; then 7 | source ./firmadyne.config 8 | elif [ -e ../firmadyne.config ]; then 9 | source ../firmadyne.config 10 | else 11 | echo "Error: Could not find 'firmadyne.config'!" 12 | exit 1 13 | fi 14 | 15 | if check_number $1; then 16 | echo "Usage: inferNetwork.sh [] [