Skip to content

Reversing Binaries

Reverse Engineering Firmware Binaries

Firmware binaries in IoT devices often contain critical logic, cryptographic routines, and communication protocols. Ghidra, a powerful reverse engineering tool by NSA, provides a comprehensive suite for analyzing these binaries, including disassembly, decompilation, and symbolic analysis. This section covers the workflow for reverse engineering embedded firmware using Ghidra.

Loading and Analyzing Firmware Binaries

Ghidra supports a wide range of binary formats, including ELF (common in Linux-based embedded systems), BIN/HEX (for bare-metal firmware), and proprietary formats. Begin by loading the binary into Ghidra: 

ghidraRun.sh -open <firmware_file> -import <firmware_file>

Once loaded, Ghidra automatically performs initial analysis, identifying entry points, symbols, and basic block structures. Use the Program view to inspect memory regions and identify potential code sections (e.g., .text, .rodata).

For non-ELF binaries, use the File > Import > Import Hex File option to load raw firmware. Ghidra will then analyze the binary based on its structure.

Decompile and Analyze Code

Ghidra’s decompiler (via the Decompiler plugin) converts assembly code into high-level C-like pseudocode. To decompile a function:
1. Right-click a function in the Listing view and select Decompile.
2. Adjust decompilation settings (e.g., optimization level) via Options > Decompiler.

Example: Decompile the firmware’s entry point:

# Ghidra Scripting Example: Decompile main function
import ghidra
from ghidra.app.util.oplist import OpList
from ghidra.program.util import ProgramLocation

program = currentProgram
main_addr = toAddr("0x400000")  # Example address
main_func = getFunctionAt(main_addr)
decompile(main_func, "main_decompiled.c", True)

Look for cryptographic routines (e.g., AES, HMAC), network protocols (e.g., MQTT), or hardcoded credentials in the decompiled output. Use the Search tool to find strings like "password" or "SSID".

Advanced Analysis Techniques

  • Cross-referencing: Use the References tab to trace function calls and data dependencies.
  • Memory Layout Analysis: Inspect the Memory Map to identify regions for code, data, and stack.
  • Custom Scripting: Leverage Ghidra’s API (via Python scripts) to automate tasks like pattern matching or symbol extraction.

Example: Search for a specific cryptographic function:

# Search for "AES" in decompiled code
results = findText("AES", False)
for result in results:
    print(f"Found AES reference at {result.getAddress().toString()}")

Key takeaways

  • Use Ghidra’s import tools to load firmware binaries in their native format.
  • Decompile critical functions to identify cryptographic logic, network protocols, and hardcoded secrets.
  • Combine manual analysis with scripting to automate repetitive tasks and uncover hidden patterns.
  • Always validate Ghidra’s analysis against the binary’s architecture (e.g., ARM vs. x86) to avoid misinterpretation.