search

Binary Analysis Report

hashtag
1. Overview

This document is a report described by Team.ENVY (Kim Chan-in, Park Myung-hoon, Shin Myung-jin, Yang Gang-min, Lee Yu-kyeong) who carried out the BoB 12th NVR Vulnability Analysis project.

hashtag
1.1. Necessity

For the vulnerability analysis of Hikvision, analysis of the operation method of web services and web APIs is essential. Therefore, it is necessary to analyze the web service and web API operation method of Hikvision for vulnerability analysis.

hashtag
2. sc_hicore

hashtag
2.1. main

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  int v5; // r1
  int v6; // r1
  int v7; // r1
  int v8; // r1
  int v9; // r1
  int v10; // r1
  int v11; // r1
  int v12; // r1
  int v13; // r1
  int v14; // r0

  remove("/home/app/exec/sc_hicore");
  sys_init(1);
  if ( sub_EC3CEC(argc, argv) )
  {
    HPR_MSleep(2000);
    _assert("0", "./slave.c", 26);
  }
  sub_EC34E8(&NETIF, v5);
  sub_EC34E8(&HICORE, v6);
  sub_EC34E8(&STORAGE, v7);
  sub_EC34E8(&GUI, v8);
  sub_EC34E8(&DVRLOG, v9);
  sub_EC34E8(&IPCM, v10);
  sub_EC34E8(&SURROT_ANR, v11);
  sub_EC34E8(&SADP, v12);
  sub_EC34E8(&UPNP, v13);
  sub_EC3650();
  v14 = th_check_sc_abnomal_thread_create();
  nullsub_37(v14);
  sub_F317C8();
}

If you check the result of the decompilation of the main function, the binary is deleted as soon as it is executed. Therefore, in order to extract the binary, you need to run the boot script one by one and copy the file to a different location before executing the binary.

In the main function, NETIF, HICORE, STORAGE, GUI, DVRLOG, IPCM, SURROT_ANR, SADP, and UPNP are set after initializing the device and api used.

Each variable contains a function pointer, and the service is executed using a thread and a function pointer.

hashtag
2.2. Web Service

The function in which the service is first executed is as follows. In the function, isapi and HTTP server services are executed in threads.

hashtag
2.2.1. ISAPI

In the "isapi_task_thread_create" function, handling for ISAPI and other url paths is set as follows, and the threads "isapi_session_task_thread" and "isapi_intell_search_keep_task_thread" are executed.

  • url_handler

  • sdk_urlhandler

hashtag
2.2.2. http server

In a function that first executes a web service (dvr_startup_sc_web_server_start), the "startHttpServer_thread" function is running as a thread, and again rides through several functions to execute a web service named "appweb" as a thread.

  • taskAppWeb_thread

In the taskAppWeb_thread function, sub_1C2C70 → sub_1C2B7C → sub_1C1C18 → sub_1D8FC4 → sub_1D92D8 → sub_1DDAAC (request_handler) function is used to handle requests for client web connections.

The function parses the HTTP header and method as a function through which all web requests pass.

  • request_handler

hashtag
2.3. Xref

hashtag
2.3.1. system

As a result of checking the cross reference of the system function, most of them contained static strings rather than user input values or were used to execute various processes when booting the device.

hashtag
2.3.2. execl

In the case of execl, there was only one cross reference. As a result of climbing up the function, it was used in services related to x11 and sftp. However, in the case of this service, there is no way to trigger it because it is a legacy that is not currently in use.

hashtag
2.3.3. popen

The sc_hicore binary uses popen as a function to execute system commands during service runtime. The popen function is used individually, but in most cases where user input is entered, it is again wrapped and used as a function called my_system and safe_system_wait.

  • my_system

  • safe_system_wait

PreviousAnalysis Environment Build reportNextFile System Analysis Report

Last updated