Skip to content

Commit f1d1f53

Browse files
author
Michael Messner
committed
emba says hello world
1 parent bdfb6e6 commit f1d1f53

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+5713
-2
lines changed

‎.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.idea/
2+
logs/
3+
dir-combined.yara
4+
external/
5+
!external/.keep

‎CONTRIBUTING.md

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Contributing to *emba*
2+
Contributions to *emba* are always welcome. This document explains the general requirements for contributions and the recommended preparation steps.
3+
It also sketches the typical integration process of patches.
4+
5+
## 1) Contribution Checklist
6+
7+
8+
- use git to manage your changes [*recommended*]
9+
10+
- add the required copyright header to each new file introduced, see
11+
[licensing information](./LICENSE) [**required**]
12+
13+
- structure patches logically, in small steps [**required**]
14+
- one separable functionality/fix/refactoring = one patch
15+
- do not mix those three into a single patch (e.g., first refactor, then add a new functionality that builds onto the refactoring)
16+
- after each patch, *emba* has to work. Do not add
17+
even temporary breakages inside a patch series (helps when tracking down bugs)
18+
- use `git rebase -i` to restructure a patch series
19+
20+
- base patches on top of latest master or - if there are dependencies - on next
21+
(note: next is an integration branch that may change non-linearly)
22+
23+
- add signed-off to all patches [**required**]
24+
- to certify the "Developer's Certificate of Origin", see below
25+
- check with your employer when not working on your own!
26+
27+
- test your code with shellcheck [**required**]
28+
- see the included [shellchecker script](./check_project.sh)
29+
30+
- send reminder if nothing happens after about a week
31+
32+
- the code needs to work on the latest Kali Linux (other distributions are welcome but currently not tested)
33+
34+
## 2) Code Guidelines
35+
36+
- General: Identation should be 2 spaces (no tab character)
37+
38+
- Comments: use # sign followed by a space. When needed, create a comment block. Blank lines: allowed
39+
40+
- All functions use snake_case (e.g. `test_xyz()`). One blank lines between functions.
41+
42+
- Variables: Variables should be capitalized, with underscore as word separator (e.g. `PROCESS_EXISTS=1`)
43+
44+
- If you use external code, add `# Test source: [LINK TO CODE]` above
45+
46+
- Scope of variables: Use local variables if possible
47+
48+
- Use `export` for variables which aren't only used in one file - it isn't necessary, but helps for readability
49+
50+
- Code tests: Use shellcheck to test your code (./check_project.sh)
51+
52+
## 3) Developer's Certificate of Origin 1.1
53+
54+
When signing-off a patch for this project like this
55+
56+
Signed-off-by: Random J Developer <[email protected]>
57+
58+
using your real name (no pseudonyms or anonymous contributions), you declare the
59+
following:
60+
61+
By making a contribution to this project, I certify that:
62+
63+
(a) The contribution was created in whole or in part by me and I
64+
have the right to submit it under the open source license
65+
indicated in the file; or
66+
67+
(b) The contribution is based upon previous work that, to the best
68+
of my knowledge, is covered under an appropriate open source
69+
license and I have the right under that license to submit that
70+
work with modifications, whether created in whole or in part
71+
by me, under the same open source license (unless I am
72+
permitted to submit under a different license), as indicated
73+
in the file; or
74+
75+
(c) The contribution was provided directly to me by some other
76+
person who certified (a), (b) or (c) and I have not modified
77+
it.
78+
79+
(d) I understand and agree that this project and the contribution
80+
are public and that a record of the contribution (including all
81+
personal information I submit with it, including my sign-off) is
82+
maintained indefinitely and may be redistributed consistent with
83+
this project or the open source license(s) involved.
84+
85+
See also https://www.kernel.org/doc/Documentation/process/submitting-patches.rst
86+
(Section 11, "Sign your work") for further background on this process which was
87+
adopted from the Linux kernel.

‎LICENSE

+675
Large diffs are not rendered by default.

‎README.md

+179-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,179 @@
1-
# emba
2-
emba - Embedded Analyzer
1+
<!--
2+
emba - EMBEDDED LINUX ANALYZER
3+
4+
Copyright 2020 Siemens AG
5+
6+
emba comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
7+
welcome to redistribute it under the terms of the GNU General Public License.
8+
See LICENSE file for usage of this software.
9+
10+
Emba is licensed under GPLv3
11+
12+
Author(s): Michael Messner, Pascal Eckmann
13+
-->
14+
# emba, an analyzer for Linux-based firmware of embedded devices
15+
16+
![Logo emba](./helpers/emba.png)
17+
18+
19+
### Why?
20+
21+
_emba_ is being developed as a firmware scanner that analyses already-extracted Linux-based firmware images. It should help you to identify and focus on the interesting areas of a huge firmware image.
22+
Although _emba_ is optimized for offline firmware images, it can test both, live systems and extracted images. Additionally, it can also analyze kernel configurations.
23+
_emba_ is designed to assist a penetration tester. It is not designed as a standalone tool without human interaction. _emba_ is designed to give as much information as possible about the firmware. The tester can decide on the areas to focus on and is always responsible for verifying and interpreting the results.
24+
25+
![emba_weak_functions](./documentation/emba_03.png)
26+
27+
### How to use it?
28+
29+
30+
__Before starting, check that all dependencies are met and use the installer.sh script:
31+
`./emba.sh -d` or `./emba.sh -d -F`__
32+
33+
##### Arguments:
34+
```
35+
Test firmware / live system
36+
-a [MIPS] Architecture of the linux firmware [MIPS, ARM, x86, x64]
37+
-A [MIPS] Force Architecture of the linux firmware [MIPS, ARM, x86, x64] (disable architecture check)
38+
-l [./path] Log path
39+
-f [./path] Firmware path
40+
-e [./path] Exclude paths from testing (multiple usage possible)
41+
-m [MODULE_NO.] Test only with set modules [e.g. -m 05 -m 10 ... ] (multiple usage possible)
42+
-c Enable cwe-checker
43+
44+
Dependency check
45+
-d Only check dependencies
46+
-F Check dependencies but ignore errors
47+
48+
Test kernel config
49+
-k [./config] Kernel config path
50+
51+
Modify output
52+
-s Print only relative paths
53+
-z Add ANSI color codes to log
54+
55+
Help
56+
-h Print this help message
57+
58+
```
59+
60+
#### Examples
61+
62+
##### Static firmware testing:
63+
- Extract the firmware from an update file or from flash storage with [binwalk](https://github.com/ReFirmLabs/binwalk) or something else
64+
- Execute _emba_ with set parameters, e.g.
65+
66+
`sudo ./emba.sh -l ./logs/arm_test -f ./firmware/arm_firmware/`
67+
68+
<img src="./documentation/emba_01.png" alt="emba example startup" width="600"/>
69+
70+
- Path for logs and firmware path are necessary for testing successfully (__WARNING:__ emba needs some free disk space for logging)
71+
- Architecture will be detected automatically; you can overwrite it with `-a [ARCH]`
72+
- Use `-A [ARCH]` if you don't want to use auto detection for architecture
73+
- _emba_ currently supports the following architectures: MIPS, ARM, PPC, x86 and x64
74+
75+
##### Live testing:
76+
For testing live system with _emba_ run it as if you were testing static firmware, but with `/` as firmware path:
77+
78+
`sudo ./emba.sh -l ./logs/local_test -f /`
79+
80+
- Path for logs and firmware path are necessary for testing successfully
81+
- Architecture will be detected automatically; you can overwrite it with `-a [ARCH]`
82+
- Use `-A [ARCH]` if you don't want to use auto detection for architecture
83+
- The paths `/proc` and `/sys` will be automatically excluded
84+
- It improves output and performance, if you exclude docker
85+
`-e /var/lib/docker`
86+
87+
##### Test kernel config:
88+
Test only a kernel configuration with the kernel checker of [checksec](https://github.com/slimm609/checksec.sh):
89+
90+
`sudo ./emba.sh -l ./logs/kernel_conf -k ./kernel.config`
91+
92+
- If you add `-f ./firmware/x86_firmware/`, it will ignore `-k` and search for a kernel config inside
93+
the firmware
94+
95+
__Good to know:__
96+
- `sudo` is necessary for some modules to run properly
97+
- Currently only tested on [Kali Linux](https://kali.org/downloads)(2020.2)
98+
- _emba_ needs some free disk space for logging
99+
- _emba_ uses well known tools like objdump, [LinEnum](https://github.com/rebootuser/LinEnum), [checksec](https://github.com/slimm609/checksec.sh), [linux-exploit-suggester.sh](https://github.com/mzet-/linux-exploit-suggester), [cwe-checker](https://github.com/fkie-cad/cwe_checker)
100+
- _emba_ includes multiple modules of the well known Linux analyser [Lynis](https://cisofy.com/lynis/)
101+
102+
### Dependencies
103+
104+
_emba_ uses multiple other tools and components.
105+
106+
For using _emba_ with all features, you will need following tools on your __Kali Linux__:
107+
- `readelf`
108+
- `find`
109+
- `grep`
110+
- `modinfo`
111+
- `realpath`
112+
- `sed`
113+
- `cut`
114+
- `sort`
115+
- `basename`
116+
- `strings`
117+
- `Option: tree`
118+
- `Option: shellcheck`
119+
- `Option: docker`
120+
- `Option: yara`
121+
122+
To check these dependencies, only run `sudo ./emba.sh -d`
123+
124+
For installation of all needed dependencies, run `sudo ./installer.sh`
125+
126+
### Structure
127+
128+
```
129+
├── installer.sh
130+
```
131+
132+
-> Tries to install all needed dependencies. Internet access for downloading is required.
133+
- Afterwards no Internet access is needed
134+
```
135+
├── check_project.sh
136+
```
137+
138+
-> Check full project with all subdirectories with [shellchecker](https://github.com/koalaman/shellcheck)
139+
- Install it on your system (Kali) with `apt-get install shellcheck`
140+
```
141+
├── emba.sh
142+
```
143+
-> Main script of this project
144+
```
145+
├── config
146+
```
147+
-> Configuration files for different modules with file names, regular expressions or paths. These files are very handy,
148+
easy to use and they also keep the modules clean.
149+
```
150+
├── external
151+
```
152+
-> All tools and files which are from other projects and necessary for _emba_
153+
```
154+
├── helpers
155+
```
156+
-> Some scripts for stuff like pretty formatting on your terminal or path handling
157+
```
158+
└── modules
159+
```
160+
-> The stars of the project - every module is an own file and will be called by [_emba_](/emba.sh).
161+
162+
### External tools in directory 'external'
163+
- ./yara
164+
- yara rule files - add your own rules here
165+
- ./checksec
166+
- https://github.com/slimm609/checksec.sh
167+
- ./linux-exploit-suggester.sh
168+
- https://github.com/mzet-/linux-exploit-suggester
169+
- ./objdump with all architectures enabled
170+
- https://www.gnu.org/software/binutils/
171+
- ./allitems.csv
172+
- Use the CSV formated vulnerability list from Mitre: https://cve.mitre.org/data/downloads/
173+
174+
### How to write own modules?
175+
176+
[Look here](/modules/template_module.sh) - read this file, copy and modify it. Add your _main_ function, where `module_log_init`
177+
and `module_title` are been called to the [_emba_](/emba.sh) script. That's it. Or if you only want to run a single command:
178+
Add your command to [_user\_check_](/modules/user_check.sh) and uncomment `user_check` in the [_emba_](/emba.sh) script.
179+

‎check_project.sh

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#!/bin/bash
2+
3+
# emba - EMBEDDED LINUX ANALYZER
4+
#
5+
# Copyright 2020 Siemens AG
6+
#
7+
# emba comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
8+
# welcome to redistribute it under the terms of the GNU General Public License.
9+
# See LICENSE file for usage of this software.
10+
#
11+
# Emba is licensed under GPLv3
12+
#
13+
# Author(s): Michael Messner, Pascal Eckmann
14+
15+
# Description: Check all shell scripts inside ./helpers, ./modules, emba.sh and itself with shellchecker
16+
17+
GREEN='\033[0;32m'
18+
ORANGE='\033[0;33m'
19+
BOLD='\033[1m'
20+
NC='\033[0m' # no color
21+
22+
HELP_DIR="./helpers"
23+
MOD_DIR="./modules"
24+
25+
SOURCES=()
26+
27+
import_helper() {
28+
HELPERS=$(find "$HELP_DIR" -iname "*.sh" 2>/dev/null)
29+
for LINE in $HELPERS; do
30+
if (file "$LINE" | grep -q "shell script"); then
31+
echo "$LINE"
32+
SOURCES+=("$LINE")
33+
fi
34+
done
35+
}
36+
37+
import_module() {
38+
MODULES=$(find "$MOD_DIR" -iname "*.sh" 2>/dev/null)
39+
for LINE in $MODULES; do
40+
if (file "$LINE" | grep -q "shell script"); then
41+
echo "$LINE"
42+
SOURCES+=("$LINE")
43+
fi
44+
done
45+
}
46+
47+
check()
48+
{
49+
echo -e "\\n""$ORANGE""$BOLD""Embedded Linux Analyzer Shellcheck""$NC""\\n""$BOLD""=================================================================""$NC"
50+
if ! command -v shellcheck >/dev/null 2>&1; then
51+
echo -e "\\n""$ORANGE""Shellcheck not found!""$NC""\\n""$ORANGE""Install shellcheck via 'apt-get install shellcheck'!""$NC\\n"
52+
exit 1
53+
fi
54+
55+
echo -e "\\n""$GREEN""Run shellcheck on this script:""$NC""\\n"
56+
if shellcheck ./check_project.sh || [[ $? -ne 1 && $? -ne 2 ]]; then
57+
echo -e "$GREEN""$BOLD""==> SUCCESS""$NC""\\n"
58+
else
59+
echo -e "\\n""$ORANGE$BOLD==> FIX ERRORS""$NC""\\n"
60+
fi
61+
62+
echo -e "\\n""$GREEN""Run shellcheck on installer:""$NC""\\n"
63+
if shellcheck ./installer.sh || [[ $? -ne 1 && $? -ne 2 ]]; then
64+
echo -e "$GREEN""$BOLD""==> SUCCESS""$NC""\\n"
65+
else
66+
echo -e "\\n""$ORANGE$BOLD==> FIX ERRORS""$NC""\\n"
67+
fi
68+
69+
echo -e "\\n""$GREEN""Load all files for check:""$NC""\\n"
70+
echo "./emba.sh"
71+
import_helper
72+
import_module
73+
74+
echo -e "\\n""$GREEN""Run shellcheck:""$NC""\\n"
75+
if shellcheck -P "$HELP_DIR":"$MOD_DIR" -a ./emba.sh "${SOURCES[@]}" || [[ $? -ne 1 && $? -ne 2 ]]; then
76+
echo -e "$GREEN""$BOLD""==> SUCCESS""$NC""\\n"
77+
else
78+
echo -e "\\n""$ORANGE""$BOLD""==> FIX ERRORS""$NC""\\n"
79+
fi
80+
}
81+
82+
check

‎config/boot_files.cfg

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
*/inittab
2+
*/rcS*
3+
*/init.d
4+
*/rc.d
5+
*/rc?.d
6+
*/*.service

‎config/cert_files.cfg

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
*/*.pem
2+
*/authorized_keys
3+
*/id_dsa
4+
*/id_rsa

‎config/check_command_inj_dirs.cfg

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*/*www*
2+
*/*cgi*
3+
*/*htdocs*

‎config/check_command_injections.cfg

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
'.*$.*'
2+
$(.*$.*)
3+
shell_exec('.*$.*');
4+
exec('.*$.*');

‎config/config_files.cfg

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
*/*.cfg
2+
*/*.conf
3+
*/*.rhosts
4+
*/hosts.equiv
5+
*/exports
6+
*/fstab
7+
*/*.bak

‎config/deep_search.cfg

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
PRIVATE KEY-----
2+
\-\-\-\-\-BEGIN\ .*PRIVATE KEY\-\-\-\-\-

‎config/functions.cfg

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
strcpy
2+
strcat
3+
printf
4+
fprintf
5+
sprintf
6+
system
7+
mmap

0 commit comments

Comments
 (0)