Firmware diffing
The identification of the relevant changes between firmware releases is an essential step in bug hunting. For example, in exploit development you are sometimes interested in the changes between two firmware versions - The vulnerable version compared to the fixed version. As it is usually quite hard to extract enough useful information from the published advisories or the CVE details, the only possibility is to check the real differences between the relevant firmware releases. This allows a tear down of the fixed vulnerability and probably write an exploit for it.
EMBA can support you in your tear down process as it is able to identify the differences between different firmware versions using fuzzy hashing with ssdeep.
For this diff mechanisms we introduced the -o option. This allows the setup of a 2nd firmware.
The 2nd firmware is usually the newer firmware version (the fixed one). Start EMBA with the following options to perform the firmware diffing procedure:
sudo ./emba -f ~/DIR600B1_2_FW205b01.zip -o ~/DIR600B_FW206b01_FOR_Hardware_B.bin -l ~/emba_logs_dir600-diff
Note: EMBA does not perform a usual firmware analysis in this mode! After the diffing check you can also perform your usual firmware analysis of the firmware images.
In diff mode EMBA first gives some details of both firmware images.
