固件与UEFI恶意代码分析

---
name: firmware-malware-analysis
description: >
  Analyze firmware images and UEFI threats including bootkits, implants, and
  embedded device malware. Use when investigating firmware-level persistence,
  UEFI implants, compromised IoT/router firmware, or bootloader modifications
  that survive OS reinstallation.
---

# Firmware Malware Analysis

Systematic approach to analyzing firmware-level threats across UEFI, embedded devices, and IoT.

## When to Use

- Suspected firmware-level persistence (survives OS reinstall)
- Compromised router, IoT device, or embedded system
- UEFI Secure Boot bypass suspected
- Bootloader integrity verification needed
- Investigating supply chain compromise at firmware level

## Prerequisites

- **Python 3.10+** with standard library modules
- **binwalk**: Firmware extraction and component identification
- **UEFITool**: UEFI firmware image parsing and inspection
- **CHIPSEC**: Intel platform firmware security assessment
- **firmwalker**: Firmware filesystem content analysis
- **firmadyne**: Automated firmware emulation framework
- **flashrom**: SPI flash chip reading and writing
- **Ghidra**: Cross-architecture reverse engineering (ARM, MIPS, x86, PowerPC)
- **QEMU**: Firmware emulation for various architectures
- **jefferson/sasquatch**: SquashFS filesystem extraction tools
- **vbindiff**: Binary diff for firmware comparison
- **scripts/firmware_extractor.py**: Automated firmware image extraction
- **scripts/uefi_analyzer.py**: UEFI firmware analysis
- **SPI flash programmer** (e.g., CH341A) for hardware-based acquisition (optional)

## Step-by-Step Instructions

### Step 1: Firmware Acquisition

```bash
# Extract firmware from device
python3 scripts/firmware_extractor.py --image firmware.bin --output extracted/

# For UEFI firmware
python3 scripts/uefi_analyzer.py --firmware bios_dump.rom
```

**Acquisition methods:**
- **Software**: flashrom, CHIPSEC, vendor update utilities
- **Hardware**: SPI flash programmer (CH341A), JTAG debugger
- **Network**: Download from vendor website (for comparison)
- **VM**: Extract from VM firmware settings

### Step 2: Firmware Extraction

```bash
# binwalk analysis
binwalk firmware.bin                    # Identify components
binwalk -e firmware.bin                 # Extract filesystem
binwalk -A firmware.bin                 # Identify CPU architecture

# Manual extraction for specific filesystems
jefferson firmware.squashfs             # SquashFS
sasquatch firmware.squashfs             # Non-standard SquashFS
ubi_reader firmware.ubi                 # UBI/UBIFS
```

### Step 3: Filesystem Analysis

After extraction, analyze the filesystem:

```bash
# Find backdoor accounts
grep -r "root:" extracted/etc/passwd
grep -r ":\$" extracted/etc/shadow

# Check startup scripts
ls -la extracted/etc/init.d/
cat extracted/etc/rc.local
cat extracted/etc/inittab

# Find network services
grep -r "telnetd\|sshd\|httpd\|ftpd" extracted/etc/

# Search for hardcoded credentials
grep -rn "password\|passwd\|secret\|key" extracted/ --include="*.conf"
grep -rn "admin\|root\|default" extracted/ --include="*.conf"

# Check for suspicious binaries
find extracted/ -executable -type f | xargs file
```

### Step 4: Binary Analysis

Identify and analyze suspicious binaries:

```bash
# Determine architecture
file extracted/usr/bin/suspicious
readelf -h extracted/usr/bin/suspicious

# Cross-architecture analysis with Ghidra
# Set correct processor: ARM, MIPS, x86, etc.
# Use reverse-engineering skill for deep analysis
```

Common architectures in firmware:
- **MIPS** (big/little endian): Routers, network devices
- **ARM** (32/64-bit): IoT, mobile, modern routers
- **x86/x64**: UEFI, PC firmware
- **PowerPC**: Enterprise networking equipment

### Step 5: UEFI-Specific Analysis

```bash
python3 scripts/uefi_analyzer.py --firmware bios_dump.rom --output uefi_report.json
```

Check for:
- Unknown DXE drivers not matching vendor baseline
- Modified Boot Manager (bootmgfw.efi)
- Unauthorized certificates in Secure Boot db/dbx
- Modified runtime services
- Suspicious NVRAM variables

Known UEFI implants to check against:
- LoJax (APT28) — Modified SPI flash firmware
- MosaicRegressor — Multi-component UEFI implant
- CosmicStrand — Firmware-level rootkit
- BlackLotus — Secure Boot bypass bootkit
- ESPecter — EFI System Partition modification

### Step 6: Comparison Analysis

Compare suspect firmware against known-good version:

```bash
# Binary diff
vbindiff firmware_suspect.bin firmware_clean.bin

# File-level diff after extraction
diff -r extracted_suspect/ extracted_clean/

# Identify added/modified files
```

### Step 7: Emulation (if needed)

```bash
# Emulate firmware with QEMU
# ARM: qemu-system-arm
# MIPS: qemu-system-mips
# Use firmadyne for automated emulation

# Or use Unicorn for selective emulation of specific functions
```

### Step 8: Report and Detect

- Document firmware modification details
- Hash clean vs modified components
- Create signatures for modified binaries
- Map to MITRE ATT&CK:
  - T1542.001: Pre-OS Boot: System Firmware
  - T1542.003: Pre-OS Boot: Bootkit
  - T1195.003: Supply Chain Compromise: Hardware
  - T1014: Rootkit

## Tools

| Tool | Purpose |
|------|---------|
| binwalk | Firmware extraction and analysis |
| UEFITool | UEFI firmware parsing |
| CHIPSEC | Intel firmware security |
| firmwalker | Firmware content analysis |
| firmadyne | Firmware emulation |
| Ghidra | Cross-architecture RE |
| flashrom | SPI flash reading/writing |

## Related Skills

- `rootkit-analysis` — Bootkit analysis techniques
- `reverse-engineering` — Binary analysis of firmware components
- `supply-chain-malware-analysis` — Firmware supply chain compromise