AwesomeREA.org

Tool

cpu_rec

Statistically recognize the CPU instruction set in an arbitrary binary file, such as an unknown firmware image, by comparing Markov-chain byte statistics with a default corpus covering dozens of architectures, from 6502 and 8051 to ARM, MIPS, PowerPC, RISC-V, x86-64 and WebAssembly. It reports a match for the whole file, then the largest chunk that matches one architecture, and shows entropy so that encrypted or compressed regions can be discounted. It runs standalone, as a Python function or as a binwalk module.

Requirements and limitations

  • Latest release at review: v1.1, published 2024-03-19 and tagged at the reviewed commit; it adds an optional pickled corpus for faster startup and LIEF as an alternative to elfesteem. There is no package: cpu_rec.py and the cpu_rec_corpus directory are copied into the same directory.
  • Runs on Python 3 or Python 2; the portability workflow covers Python 3.10, PyPy 2.7 and 3.9 and GraalPy on Ubuntu and macOS. Without the lzma module the .xz corpus files must be decompressed first. Optional elfesteem or LIEF extracts the text section of ELF, PE, Mach-O or COFF files. The README reports about one minute of analysis per MB, and 1 GB of RAM to build signatures for 70 architectures, on the author's laptop.
  • Binwalk mode installs into binwalk's module directory and needs a binwalk that includes devttys0/binwalk pull request 241; these instructions point to the earlier Python binwalk, and compatibility with the current Rust-based v3 was not checked.
  • Results are heuristic: the README warns that files can contain several architectures, small chunks can be misdetected, and results for data with entropy above 0.9 are probably meaningless. 78k and TriCore are left out of the default corpus for licensing reasons and can only be added from the user's own binaries.
  • cpu_rec.py is Apache-2.0. The README describes the default corpus as a composite of code chunks under their own licenses, mostly from Debian, BusyBox, C-Kermit and the author's own cross-compiled open-source builds, plus a few of unknown license, including an H8S binary distributed by Dell; build_default_corpus records each origin. No files were analyzed.

About this entry

Type
Tool
Category
Firmware tools
Relationship
Foundation tool
Targets
Binary · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · airbus-seclab/cpu_rec · Revision 6b19239
  2. README.md#L7-L76 GitHub · airbus-seclab/cpu_rec · Revision 6b19239
  3. README.md#L140-L151 GitHub · airbus-seclab/cpu_rec · Revision 6b19239
  4. README.md#L233-L296 GitHub · airbus-seclab/cpu_rec · Revision 6b19239
  5. cpu_rec.py#L329-L516 GitHub · airbus-seclab/cpu_rec · Revision 6b19239
  6. cpu_rec.py#L517-L645 GitHub · airbus-seclab/cpu_rec · Revision 6b19239
  7. .github/workflows/portability.yml GitHub · airbus-seclab/cpu_rec · Revision 6b19239
  8. LICENCE GitHub · airbus-seclab/cpu_rec · Revision 6b19239
  9. https://github.com/airbus-seclab/cpu_rec/releases/tag/v1.1
  10. https://www.sstic.org/2017/presentation/cpu_rec/