4. (c) SAUMIL SHAH
@DC11332
Introducing ARMX
• An ARM Firmware Emulation Framework.
• Ultimate Goal - create an IoT VM!
• A Virtual IoT device makes for easy
– runtime analysis
– reverse engineering
– fuzzing
– exploit development
• Gain insight into embedded hardware by
trying to emulate it.
7. (c) SAUMIL SHAH
@DC11332
CPU and
Hardware
Kernel
Drivers
File System
nvram
User Processes
API
UI
libnvram
…same same but different
8. (c) SAUMIL SHAH
@DC11332
compressed FS
CPU
Kernel
Boot Loader
mounted
FS
nvram
init
scripts
Services
Apps
libnvram
The IoT Boot Up Process
conf
conf
conf
conf
firmware
Loads Kernel.
Uncompresses FS to ramdisk,
invokes init process.
ramdisk
userland
Reads config from nvram.
Builds system config files on
the fly.
Starts up system services.
Invokes Applications and
Application services.
READY
POWER ON
9. (c) SAUMIL SHAH
@DC11332
QEMU
CPU and
Limited
Hardware
Kernel
Drivers
uncompressed
Filesystem
emulated
nvram
init scripts
Services
Apps
libnvram
Emulation: Goals and Challenges
x
x
x
x
BUILDROOT
Match the kernel with the
one on the device
chroot environment
Implemented as an INI file,
preloaded before "boot up"
conf
conf
Fix to match QEMU environment
Not all drivers load successfully
19. (c) SAUMIL SHAH
@DC11332
QEMU
CPU and
Limited
Hardware
Kernel
Drivers
NFS /armx
emulated
nvram
init scripts
Services
Apps
libnvram
ARM-X: Device "booted up"
x
x
x
x
conf
conf