Research On Key Techniques For Firm-Code Reverse Analysis

Firm-Code Reversing Analysis (FCRA), an important part of Firmware Reversing Engineering (FWRE), is the basis of the reconstruction and reengineering of Embedded Systems. It is also critical for the information security detection, introduction of international advanced technology and maintenance of Legacy Systems, Research on FCRA has great practical significance in both theory research and application perspective.Taking the research on National"863"Project (2009AA01Z434) as background, this thesis carries out in-depth analysis on differences between firm-code and traditional software, systematically summarizes related research achievements of FWRE and makes thorough research on theories and technologies of FCRA. Major contributions and innovations endeavored in this thesis are as follows:1. An FCRA-oriented virtual instruction set architecture fr-VISA is designed, and an algorithm of constructing the orthogonal and complete instruction set is presented. This thesis also discusses the instruction normalization technology based on fr-VISA, and its semantics equivalence is proved.2. Having studied on the traditional static control flow recovery algorithms, this thesis proposes a control flow recovery algorithm based on fr-VISA instruction simulation and a control flow recovery algorithm for binary code with mixed codec mode, which improve the accuracy of control flow recovery.3. On the basis of the research on influence on the firm-code disassembly precision and structure reconstruction made by IVT, a heuristic algorithm for the reconstruction of IVT and an algorithm for extraction of call graph based on IVT are proposed.4. A firm-code reverse analysis platform amPro is constructed based on the research on instruction normalization, control flow recovery and disassembly technology. Tests are carried out, and the experiments results have proved the tenability of the theory and the validity of the platform.