Firmware diffing

Note: Preview information! Not finished! Currently not in EMBA included! Planned for v1.3.1 :)

Sometimes it is quite helpful to identify the changes between different firmware versions. For example, in exploit development you are interested in the changes between two firmware versions. The vulnerable version compared to the fixed version. As it is usually quite hard to extract enough useful information from the published advisories or the CVE details, the only thing is to check the differences between the firmware releases to tear down the fixed vulnerability.

EMBA can support you in your tear down process as it is able to identify the differences between different firmware versions using fuzzy hash diffing with ssdeep.

For this diff mechanisms we introduced the -o option. This allows the setup of a 2nd firmware. This is usually the newer firmware version. Start EMBA with the following options to perform the firmware diffing procedure:

sudo ./emba -f ~/DIR600B1_2_FW205b01.zip -o ~/DIR600B_FW206b01_FOR_Hardware_B.bin -l ~/emba_logs_dir600-diff

Note: EMBA does not perform a usual firmware analysis in this mode!

Overview of both firmware images

In diff mode EMBA first gives some details of both firmware images.

1st firmware overview:

2nd firmware overview:

Extraction of both firmware images

1st firmware extraction:

2nd firmware extraction:

Fuzz diffing firmware

Overview page:

ASCII diffing details:

Binary diffing details: