search

ChrisTheCoolHut / Firmware_Slap

Discovering vulnerabilities in firmware through concolic analysis and function clustering.
GNU General Public License v3.0
470 stars 79 forks source link

Supported CPU ISA #14

Closed nstarke closed 5 years ago

nstarke commented 5 years ago

Hello, Does Firmware Slap support MIPS? I ask because I ran a few MIPS binaries through and received no results when I know for a fact there are various vulnerable functions in the firmware binary. Is there anything special I would need to do or develop to make MIPS works?

I do see this after every function trace worker thread:

<SimulationManager with all stashes empty (1 errored)>

I'm not sure if that is relevant or not.

Thanks for your help!

ChrisTheCoolHut commented 5 years ago

Hey @nstarke,

it does!

Firmware Slap is using angr to do it's lifting and concolic analysis. angr supports mips, however Firmware Slap is not guaranteed to find all vulnerabilities.

I've designed it to detect basic memory corruptions and command injection vulnerabilities. There are also resource time outs. If you think it needs more time or resources to analyze take a look at Discover and Dumps on line 212

Change the timeout and memory limit values to larger values.

            time_limit=60,
            worker_max_memory_per_child=2048000)
nstarke commented 5 years ago

Thank you, I will try that. Closing now.