[+] Check decompiled binary source code for vulnerabilities
The following module tries to decompile the firmware binaries with Ghidra. Afterwards it tests the decompiled sources with semgrep for vulnerabilities.
Furhter details about the used approach are documented by 0xdea in the following resources:
[*] https://security.humanativaspa.it/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep/
[*] https://github.com/0xdea/ghidra-scripts/blob/main/Haruspex.java
[*] https://github.com/0xdea/semgrep-rules
[+] Found 191 issues in native binary updatewifistats (common linux file: no)
[+] Found 219 issues in native binary igmpproxy (common linux file: no)
[+] Found 104 issues in native binary libip6tc.so.0.0.0 (common linux file: no)
[+] Found 646 issues in native binary cgibin (common linux file: no)
[+] Found 99 issues in native binary libip4tc.so.0.0.0 (common linux file: no)
[+] Found 128 issues in native binary servd (common linux file: no)
[+] Found 346 issues in native binary rgbin (common linux file: no)
[+] Found 146 issues in native binary ddnsd (common linux file: no)
[+] Found 114 issues in native binary libxtables.so.4.0.0 (common linux file: no)
[+] Found 232 issues in native binary udhcpd (common linux file: no)
[+] Found 112 issues in native binary nsbbox (common linux file: no)
[+] Found 272 issues in native binary xmldb (common linux file: no)
[+] Found 68 issues in native binary updateleases (common linux file: no)
[+] Found 71 issues in native binary gpiod (common linux file: no)
[+] Found 183 issues in native binary lld2d (common linux file: no)
[+] Found 97 issues in native binary neaps (common linux file: no)
[+] Found 88 issues in native binary logd (common linux file: no)
[+] Found 26 issues in native binary ated (common linux file: no)
[+] Found 31 issues in native binary ubcom (common linux file: no)
[+] Found 486 issues in native binary dhcp6s (common linux file: no)
[+] Found 39 issues in native binary portt (common linux file: no)
[+] Found 620 issues in native binary dhcp6c (common linux file: no)
[+] Found 13 issues in native binary netbios (common linux file: no)
[+] Found 60 issues in native binary llmnresp (common linux file: no)
[+] Found 26 issues in native binary libutil-0.9.30.1.so (common linux file: no)
[+] Found 24 issues in native binary ubcfg (common linux file: no)
[+] Found 51 issues in native binary sw_tcpip.ko (common linux file: no)
[+] Found 36 issues in native binary libpthread-0.9.30.1.so (common linux file: no)
[+] Found 44 issues in native binary rndimage (common linux file: no)
[+] Found 98 issues in native binary ecmh (common linux file: no)
[+] Found 15 issues in native binary widget (common linux file: no)
[+] Found 4 issues in native binary libm-0.9.30.1.so (common linux file: no)
[+] Found 14 issues in native binary librt-0.9.30.1.so (common linux file: no)
[+] Found 4 issues in native binary ifresetcnt.ko (common linux file: no)
[+] Found 3 issues in native binary libipt_HIJACK.so (common linux file: no)
[+] Found 7 issues in native binary rt3052esw (common linux file: no)
[+] Found 21 issues in native binary libdl-0.9.30.1.so (common linux file: no)
[+] Found 116 issues in native binary wps (common linux file: no)
[+] Found 16 issues in native binary libxt_mport.so (common linux file: no)
[+] Found 5719 issues in native binary rt2860v2_ap.ko (common linux file: no)
[+] Found 2826 issues in native binary lzma.uncompressed.elf (common linux file: no)
==> Results - Ghidra decompiled code analysis via Semgrep
[+] Found 13415 possible vulnerabilities (via semgrep on Ghidra decompiled code) in 43 tested binaries:
command-injection - 41 times.
format-string-bugs - 1431 times.
incorrect-unsigned-comparison - 14 times.
incorrect-use-of-free - 4 times.
insecure-api-access-stat - 17 times.
insecure-api-rand-srand - 6 times.
insecure-api-scanf - 7 times.
insecure-api-signal - 53 times.
insecure-api-sprintf-vsprintf - 236 times.
insecure-api-strcpy-strcat - 129 times.
integer-truncation - 4243 times.
integer-wraparound - 86 times.
interesting-api-calls - 3819 times.
off-by-one - 41 times.
overlapping-source-destination - 1 times.
pointer-subtraction - 47 times.
signed-unsigned-conversion - 2943 times.
unchecked-ret-malloc - 154 times.
unchecked-ret-scanf - 21 times.
unchecked-ret-setuid-seteuid - 1 times.
unsafe-ret-snprintf-vsnprintf - 6 times.
unsafe-ret-strlcpy-strlcat - 4 times.
unterminated-string-strncpy - 75 times.
use-after-free - 2 times.
use-of-source-size-in-copy - 34 times.