一种基于匹配字符串地址判定ARM固件装载基址的方法  

Determining Image Base of ARM Firmware Based on Matching String Addresses

作　　者：朱瑞瑾[1] 张宝峰[1] 毛军捷[1] 骆扬[1] 谭毓安[2,3] 张全新[2,3] 

机构地区：[1]中国信息安全测评中心,北京100085 [2]北京理工大学计算机学院,北京100081 [3]北京市海量语言信息处理与云计算应用工程技术研究中心,北京100081

出　　处：《电子学报》2017年第6期1475-1482,共8页Acta Electronica Sinica

基　　金：国家自然科学基金(No.61370063);国家重点研发计划网络空间安全重点专项

摘　　要：固件是嵌入式系统的灵魂,当对固件进行安全检测或者深入理解固件中的运行机制时,对固件进行反汇编是一个必经的步骤.对固件反汇编时,首先要确定固件的装载基址及其运行环境的处理器类型.通常我们可以通过拆解硬件设备或者查阅产品手册获得处理器类型,但目前尚没有自动化工具可获知固件的装载基址.鉴于目前大部分嵌入式系统中的处理器为ARM类型,本文以ARM固件为研究目标,提出了一种自动化方法来判定固件的装载基址.首先通过研究固件中字符串的存储规律及其加载方式,提出了两个算法可分别求出固件中字符串偏移量和LDR指令加载的字符串地址.然后利用这些字符串信息,提出了DBMAS(Determining image Base by Matching Addresses of Strings)算法来判定固件的装载基址.实验证明本文提出的方法可以成功判定使用LDR指令加载字符串地址的固件装载基址.Firmware is the soul of an embedded system, and disassembly is a necessary step to understand the operational mechanism or detect the vulnerabilities of the firmware. When disassembling a firmware,it should first determine the processor type of running environment and the image base of firmware. In general, the processor type can be got by tearing down the device or consulting the product manual. However, at present there is still no automated tool that can be used to obtain the image base of firmware. Since the processors of majority embedded systems are ARM architecture, in this paper we focus on the firmwares in ARM and propose an automated method to determine the base address. Firstly, by studying the storage rule and loading mode of the string we present two algorithms to calculate the string offset and the string address loaded by LDR instruction. Then with these information, we proposed a DBMAS （Determining image Base by Matching Ad- dresses of Strings） algorithm to determine the image base. Experimental results indicate the proposed method can successfully determine the image base of firmware that uses the LDR instruction to load string address.

关 键 词：装载基址 固件 ARM 反汇编 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]