search

pr0v3rbs / FirmAE

Towards Large-Scale Emulation of IoT Firmware for Dynamic Analysis
MIT License
610 stars 117 forks source link

the issues about directly acess of mtdblock device in the emulation of d-link dap1360 firmware #28

Open ziliang8658 opened 3 years ago

ziliang8658 commented 3 years ago

hi, thanks for your great work in FirmAE, dap1360.zip decompile reecently I was trying to emulate the d-link dap1360. however, the /bin/webs program cannot be started with error "read hw setting header failed". I decompile this program and found this program is trying to directly the mtdblock0 device, which I found is related to the nand flash. As your paper have described before, some linksys routers also have the same problem. So I was wondering is there way to emulate and read/write infomation in this device or assign some default values to to emulate the nand flash read/write process. I attached the firmware and the decompile screen shot of the webs program below, please check it and give me some idaes about this , thks a lot!

pr0v3rbs commented 2 years ago

Memory Technology Device (MTD) block is used to get data from a physical partition. However, sometimes the emulated environment cannot support correctly such things.

At this point, on the default emulating state, there is no data in the mtdblock.

To read data from empty mtdblock, before perform read, just write the data with such command echo -ne "\xff\xff\xff\xff" > /dev/mtdblock0. Similar example in fixImage.sh on GPIO.

Please note that the data need to be written on running state (qemu run). And the preInit.sh will be a good file to add command.