Binary Analysis Report

1. Overview

This document is a report described by Team.ENVY (Kim Chan-in, Park Myung-hoon, Shin Myung-jin, Yang Kang-min, Lee Yu-kyeong) who carried out the BoB 12th NVR Vulnability Analysis project.

1.1. Necessity

Analysis of web service operation method is essential for Dahua's vulnerability analysis. Therefore, we want to analyze the binary used by Dahua for vulnerability analysis.

2. challenge

2.1. main

When the binary is executed, the main function first goes through the device initialization process.

After sending arbitrary commands to the /dev/dh_resource device using the ioctl function, the initialization work is performed using the acquired data.

  v2 = sub_1853134(v1);
  if ( v2 )
    v2 = sub_190D128(0, 1, "[LIBDVR@57888] ERROR  (%s|%d): GpioManager init error\r\n", "InitDvrSystem", 905);
  v3 = sub_184139C(v2);
  if ( v3 )
    v3 = sub_190D128(0, 1, "[LIBDVR@57888] ERROR  (%s|%d): TransComDevInit init error\r\n", "InitDvrSystem", 911);
  v4 = sub_185F424(v3);
  if ( v4 )

Subsequently, the services are executed.

The process of viewing the operation function for each service is as follows.

  1. Entering a function between sub_7CFF0 functions

  1. Find an array of functions (off_?) inside that function

  1. Find the last function in that function array

  1. function entry

  1. Check vtables after entering an internal function

    • Presumed to be a constructor

  1. Analysis of vtables

2.2. RPC

2.2.1. RPC Method Analysis Method

Dahua sends JSON requests through the /RPC2, /RPC2_Login path.

The format is as follows.

Here's how to find a function that handles that method.

  1. Search String

    • deviceDiscovery.attach→ configManager.factory.instance.

    • Change the string after the dot to factory.instance.

  2. Check reference

You can check the address that is the .rodata area of the reference. If you follow the address, you can see that it is listed in the form of Method Name, Function Address as follows, so you can check the processing method by checking the function under the desired method name.

In the case of Dahua, since it is implemented in C++, most functions that process actual logic are indirect calls.

Therefore, analysis should be conducted after establishing an analysis environment such as gdb and watchdog feeding.

2.2.2. RPC order of operation

When requesting the deviceDiscovery.attach method, the backtrace is as follows.

  1. start_routine

  2. sub_DE2F86

  3. sub_DE2878

  4. sub_DE245C(proc_request_arrive)

  5. sub_DE1134(deal_request)

  6. sub_DE6090(_Method_Call)

  7. sub_DE5F40(GetSubService)

  8. Execute method

2.3. Additional Analysis Methods

2.3.1. Challenge Log

In the case of Challenge binary, a log is output to the terminal when it is executed.

Since it is output in great detail, it is convenient to analyze by searching for a string that appears in the log.

2.3.2. Settings File

The challenge is that the configuration file is located in /mnt/mtd/Config and is managed in a special format or JSON format.

The configuration files are encrypted and stored in the memory after initial decryption when the binary is executed.

2.3.3. Legacy Code

In the case of Dahua, as the size of the binary is large, there are codes that are not used, and codes that do not exist on websites but can be used. Therefore, it will be an important point to find vulnerabilities by targeting the area.

PreviousAnalysis Environment Build ReportNextFile System Analysis Report

Last updated