Firmware diffing
The identification of the relevant changes between firmware releases is an essential step in bug hunting. For example, in exploit development you are sometimes interested in the changes between two firmware versions - The vulnerable version compared to the fixed version. As it is usually quite hard to extract enough useful information from the published advisories or the CVE details, the only possibility is to check the real differences between the relevant firmware releases. This allows a tear down of the fixed vulnerability and probably write an exploit for it.
EMBA can support you in your tear down process as it is able to identify the differences between different firmware versions using fuzzy hashing with ssdeep.
For this diff mechanisms we introduced the -o option. This allows the setup of a 2nd firmware.
The 2nd firmware is usually the newer firmware version (the fixed one). Start EMBA with the following options to perform the firmware diffing procedure:
sudo ./emba -f ~/DIR600B1_2_FW205b01.zip -o ~/DIR600B_FW206b01_FOR_Hardware_B.bin -l ~/emba_logs_dir600-diff
Note: EMBA does not perform a usual firmware analysis in this mode!
Overview of both firmware images
In diff mode EMBA first gives some details of both firmware images. This is similar to the already known P02 module but for both firmware images.
1st firmware overview:
In the following screenshot some details of the firmware images are shown. Currently, the available details are the output of the file command, entropy analysis, checksum and a the output of the first few bytes as hexdump:
2nd firmware overview:
Extraction of both firmware images
For further analysis it is needed to extract both firmware images before comparing them. As usual we are using Unblob as our main extractor:
1st firmware extraction:
2nd firmware extraction:
Fuzz diffing firmware
Finally EMBA tries to find every file from the first directory/firmware als in the second extracted firmware directory. If the file is available we automatically check if it is a binary or something clear text.
Overview page:
The overview page is the main page of the firmware diffing results. It shows if a file is modified, if it is something kind of ascii or binary and finally it links to further results: