准备-IDA插件
https://github.com/gdelugre/ida-arm-system-highlight
https://github.com/NeatMonster/AMIE
通过binwalk,hexdump,010-editor大概分析
binwalk观察
$ binwalk bios.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
143472 0x23070 SHA256 hash constants, little endian
770064 0xBC010 ELF, 64-bit LSB executable, version 1 (SYSV)
792178 0xC1672 Unix path: /lib/libc/aarch64
792711 0xC1887 Unix path: /lib/libc/aarch64
794111 0xC1DFF Unix path: /lib/libc/aarch64
796256 0xC2660 Unix path: /home/seanwu/hitcon-ctf-2018
只看到存在一个elf文件
hexdump观察-可以看到明显的分隔(这里需要了解异常向量表)
00000000 ~ 000028b0 | 00010000
00010000 ~ 00013010 | 0x20000
00020000 ~ 000231b0 | 000b0000
000b0000 ~ 000baa00 | 000bc000
000bc000 ~ 000c8bd8
通过hexdump可以很直观的看到bios.bin
由5个部分链接组成,其中0x80大小的碎块是中断处理函数
- 00000000 ~ 000028b0 | 00010000
- 00010000 ~ 00013010 | 0x20000
- 00020000 ~ 000231b0 | 000b0000
- 000b0000 ~ 000baa00 | 000bc000
- 000bc000 ~ 000c8bd8
提取内容,分析架构
先通过dd将这些明显分段的内容提取出来
dd if=bios.bin of=00000000_000028b0_00010000.bin bs=1 skip=0 count=0x28b0
dd if=bios.bin of=00010000_00013010_00020000.bin bs=1 skip=0x10000 count=0x3010
dd if=bios.bin of=00020000_000231b0_000b0000.bin bs=1 skip=0x20000 count=0x31b0
dd if=bios.bin of=000b0000_000baa00_000bc000.bin bs=1 skip=0xb0000 count=0xaa00
dd if=bios.bin of=000bc000_000c8bd8_end.bin bs=1 skip=0xbc000 count=0xCBD8
分析架构
binwalk -A 00000000_000028b0_00010000.bin - aarch64
binwalk -A 00010000_00013010_00020000.bin - aarch64
binwalk -A 00020000_000231b0_000b0000.bin 没分析出来架构
binwalk -A 000b0000_000baa00_000bc000.bin - aarch64
binwalk -A 000bc000_000c8bd8_end.bin - aarch64
这里00020000_000231b0_000b0000.bin
没有出来,通过ida分别指定架构arm,armv8,看起来不是字符串的就用c
进行识别,可以分析出00020000_000231b0_000b0000.bin
属于arm
架构
binwalk -A 00000000_000028b0_00010000.bin - aarch64
binwalk -A 00010000_00013010_00020000.bin - aarch64
binwalk -A 00020000_000231b0_000b0000.bin - arm
binwalk -A 000b0000_000baa00_000bc000.bin - aarch64
binwalk -A 000bc000_000c8bd8_end.bin - aarch64
分析各文件所属EL级别
00000000_000028b0_00010000_aarch64.bin
通过binwalk分析各段的内容,啥都没分析出来
╰─○ binwalk 00000000_000028b0_00010000_aarch64.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
放到IDA64-armv8里面试试,不像字符串的就按c
识别试试
识别出来,能处理EL3,大概就是EL3相关的处理程序了
00010000_00013010_00020000_aarch64.bin
binwalk 看下来也是什么都没有
╰─○ binwalk 00010000_00013010_00020000_aarch64.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
猜测属于EL2
000b0000_000baa00_000bc000_aarch64.bin
╰─○ binwalk 000b0000_000baa00_000bc000_aarch64.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
放入IDA64-arm小端-aarch64啥都没分析出来
尝试IDA64-arm大端-aarch64,有内容了(amie插件识别不了大端的系统寄存器)
发现有调用EL3,EL2的指令,但是插件出了些问题
https://github.com/gdelugre/ida-arm-system-highlight
https://github.com/NeatMonster/AMIE
换ghidra,aarch64-big end - default
操作了TTBR0_EL1,TTBR1_EL1,这个应该是EL1的kernel了
00020000_000231b0_000b0000_arch.bin
有点内容,但是不知道是啥
╰─○ binwalk 00020000_000231b0_000b0000_arch.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
12400 0x3070 SHA256 hash constants, little endian
以上来就是一个看起来像异常向量表的东西,那应该不是EL0了
搜一搜MSR,MRS
该程序段可存在特权,猜测是S-EL1
000bc000_000c8bd8_end_aarch64.bin
╰─○ binwalk 000bc000_000c8bd8_end_aarch64.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
16 0x10 ELF, 64-bit LSB executable, version 1 (SYSV)
22130 0x5672 Unix path: /lib/libc/aarch64
22663 0x5887 Unix path: /lib/libc/aarch64
24063 0x5DFF Unix path: /lib/libc/aarch64
26208 0x6660 Unix path: /home/seanwu/hitcon-ctf-2018
╰─○ dd if=000bc000_000c8bd8_end_aarch64.bin of=000bc010_000c8bd8_end_aarch64.elf bs=1 skip=0x10
52168+0 records in
52168+0 records out
52168 bytes transferred in 0.203992 secs (255736 bytes/sec)
看起来像是一个EL0的程序
汇总
EL0_000bc010_000c8bd8_end_aarch64.elf
EL1_000b0000_000baa00_000bc000_aarch64.bin
EL2_00010000_00013010_00020000_aarch64.bin
EL3_00000000_000028b0_00010000_aarch64.bin
S-EL1_00020000_000231b0_000b0000_arch.bin
好像还少一个S-EL0,之后再分析