AwesomeREA.org

Tool

IDAPython Embedded Toolkit

Maddie Stone's IDAPython scripts for triaging and annotating embedded-device firmware images in IDA Pro, presented at RECON Montreal and DerbyCon in 2017. Triage scripts define code and functions from per-architecture prologue and epilogue patterns, mark address ranges as bytes, words or double words and turn unexplored bytes into strings; analysis scripts resolve memory accesses made at offsets from a known base value and add cross-references and value comments, and annotation scripts list CPU port (GPIO) use, tag functions without cross-references as possible dead code and trace where an operand is used. An Android folder adds a script that comments JNIEnv function calls in native libraries and one that decrypts the strings of ARM32 libraries packed with the WeddingCake anti-analysis wrapper.

Requirements & limits

  • Ten Python scripts and the slides of the two 2017 talks as PDFs, with no releases or tags; the reviewed master commit, from 2019-08-14, is the latest. The README says the scripts have only been tested on IDA Pro 6.95, with IDA 7.0 testing in progress, and runs each one separately through File > Script file in an open IDA database with IDAPython. Most use Python 2 print statements and pre-7.0 IDC calls such as MakeCode, MakeComm, MakeStr and AskAddr; jni_translate.py, added in 2019, uses Python 3-compatible print calls but still calls idc.MakeComm. The reviewed sources claim no compatibility with later IDA releases or Python 3.
  • The user supplies the firmware image or Android native library and its IDA database, and enters address ranges, regular expressions or base values at prompts or in each script's user-defined section. Processor-specific syntax is chosen from IDA's processor name: define_code_functions.py covers 8051, PIC18, Mitsubishi M32R, TI TMS320C28x and AVR, and find_mem_accesses.py only 8051, while identify_port_use_locations.py ships one active PIC18 pattern with commented 8051 alternatives. Unsupported processors stop with an error until the analyst adds patterns, and find_mem_accesses.py cannot create references into segments that do not yet exist.
  • Several scripts rewrite the database: define_data_as_types.py first undefines the range, overwriting code or strings there, and WeddingCake_decrypt.py overwrites encrypted strings with their decrypted contents and needs JNI_OnLoad defined and exported. The WeddingCake files accompany Maddie Stone's Black Hat USA 2018 talk on that packer; this entry covers their use for analysis only.
  • MIT, copyright 2017 Maddie Stone, in LICENSE; the README's copyright notice instead names The Johns Hopkins University Applied Physics Laboratory, and the Android README and WeddingCake script carry a Google LLC 2018 copyright line without separate license terms. Nothing was run, and the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Firmware tools
Relationship
Foundation tool
Targets
App · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
  2. Android/README.md GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
  3. define_code_functions.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
  4. find_mem_accesses.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
  5. identify_port_use_locations.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
  6. define_data_as_types.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
  7. Android/jni_translate.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
  8. Android/WeddingCake_decrypt.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
  9. presentations GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
  10. LICENSE GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346

More in Firmware and hardware

All 44 entries in Firmware and hardware