File System Analysis Report
1. Overview
This document is from the BoB 12th NVR Vulnerability Analysis project team.ENVY (Kim Chang-in, Park Myung-hoon, Shin Myung-jin, Yang Kang-min, Lee Yu-kyeong) explains Hikvision file system analysis.
1.1. Necessity
File system analysis is essential for performing embedded vulnerability analysis. It is a necessary step to deactivate watchdogs for identifying and debugging binary analysis that activates services to perform vulnerability analysis. Therefore, this report describes the progress of file system analysis to perform vulnerability analysis.
1.2. /etc/inittab
The contents of /etc/inittab are as follows.
::sysinit:/etc/init.d/rcS: This section specifies the instructions to be performed during system initialization, and when NVR is started, the /etc/init.d/rcS file is executed first, and when NVR is terminated, you can see that the /etc/scripts/SsShutdown.sh file is executed.
::respawn:-/bin/sh: Specifies to run "/bin/sh" shell and, if finished, to run again. This part is usually used to manage the login shell for a particular console.
::restart:/sbin/init:/sbin/init Specifies the command to run when the process is restarted, primarily used to restart the init process itself.
:ctrlaltdel:/sbin/reboot:Specifies instructions to restart the system when Ctrl+Alt+Delete key combination is pressed.
::shutdown:/bin/umount-a-r—Specifies an instruction to amount the file system upon system shutdown, where "-a" is used for all file systems and "-r" is used to force a read-only mounted file system.
::shutdown:/sbin/swapoff-a—Specifies the instruction to disable all swap space upon system shutdown. "swapoff-a" disables all swap space.
::sysinit:/etc/init.d/rcS
::respawn:-/bin/sh
# Stuff to do when restarting the init process
::restart:/sbin/init
# Stuff to do before rebooting
::ctrlaltdel:/sbin/reboot
::shutdown:/bin/umount -a -r
::shutdown:/sbin/swapoff -a2. Analysis of startup scripts
2.1. init script
2.1.1. /etc/rcS.d/rcS
After mounting the device based on contents in /etc/mtab by a /bin/mount-a command, a local network interface is configured to execute all scripts in the /etc/rcS.d directory.
2.1.2. /etc/rcS.d/S20hikbase
After unencrypting the hikbase.image file using the hikefs command, uncompress it with a tar command to set a file necessary for starting.
2.1.3. /etc/rcS.d/S30udev
An udev service is executed by using an udevd command to generate a device node.
2.1.4. /etc/rcS.d/S31devs
When multiple device nodes do not exist through the mkmod command, the device node is created so that the device can be used.
2.1.5. /etc/rcS.d/S40distmnt
A plurality of subordinate directories are generated based on the /mnt directory.
2.1.6. /etc/rcS.d/S70hostname
The hostname command sets the host name of the appliance to dvrdvs.
2.1.7. /etc/rcS.d/S70ifconfig
A MAC address and an IP setting of a network interface are dynamically configured according to specific conditions.
2.1.8. /etc/rcS.d/S70ramoops
Ramoops provides a function to store memory dumps in the event of panic or other abnormal situations in the Linux kernel. It operates primarily using a pstore file system, which provides an interface for storing various types of data using persistent storage provided by the Linux kernel.
After mounting the pstore file system in /sys/fs/pstore to use ramoops, check whether the device has been warm rebooted or cold rebooted and output a log accordingly.
warm reboot—Restart with some information retained without completely erasing memory when the system is restarted
cold reboot—Full shutdown and restart of the system
2.1.9. /etc/rcS.d/S71update
If there is a DIGICAP environment variable, proceed with the NVR update using the do_update binary.
2.1.10. /etc/rcS.d/S80mem
Adjust memory management to specific systems or special requirements.
2.1.11. /etc/rcS.d/S80net
local network Modifies the routing behavior of traffic and adjusts it to specific network configurations or requirements.
2.1.12. /etc/rcS.d/S81startbsp
Run the /home/bsp/startbsp.sh script, which copies the file to /usr/sbin/ if it exists.
2.1.13. /etc/rcS.d/S90start_cramfs
If the "BOOTMODE" of the "/proc/hkvs/ability" file is "cramfs", a "/dev/mtdblock1" device is mounted in the cramfs file system format to "/home/hk". After that, the /tmp/start.sh file is decrypted using a ded tool, and execution authority is given to execute the corresponding shell script file.
2.1.14. /etc/rcS.d/S90start_slave2
If the BOOTMODE of the /proc/hkvs/ability file is slave, create a /dev/slaveram device and a /home/slave directory, uncompress the /dev/slaveram device to /home/slave, and create a shell script for /home/slave/start.sh .
2.1.15. /etc/rcS.d/S90start_ubifs
If the BOOTMODE of the /proc/hkvs/ability file is ubifs, directories /home/dav0, /home/dav1 and /home/dav2 are generated, and subifs file systems are mounted in respective directories. After that, a start partition among the three directories is determined to set a network, and after decrypting the /tmp/start.sh file by using a ded tool, execution authority is given to execute the corresponding shell script file.
2.1.16. /etc/rcS.d/S90start_yaffs2
If the BOOTMODE of the /proc/hkvs/ability file is yaffs2, after generating directories /home/dav0, /home/dav1, /home/dav2, a yaffs2 file system is mounted in each directory. After that, the /tmp/start.sh file is decrypted using a ded tool, and execution authority is given to execute the corresponding shell script file.
2.1.17. /etc/rcS.d/S95setconsole
Execute setconsole only when a console called shmty0 is configured and the settings are correct.
2.1.18. /etc/rcS.d/S99selftests
If a kernel module called hik_selftests.ko exists, it loads the module.
2.2. Activation Service Analysis
2.2.1. sc_hicore
Checking the port in service.
Since sc_hicore is in charge of major services, it can be determined that the binary is the main binary.
2.2.2. Web Services
Analysis using the ps-T command produces the following results.
sc_hicore uses threads to run multiple services and multiple tasks to run web services.
2.3. Check mount
After the start-up is completed, the following results can be obtained by executing the mount command.
The device uses the ubifs file system, and it can be seen that the /etc/rcS.d/S90start_ubifs shell script file was executed during the startup script.
2.4. Watchdog analysis
2.4.1. hik_watchdog.ko
When init script is executed, there is a part that loads the kernel module. Among the modules loaded in the process, hik_watchdog.ko acts as a watchdog.
As mentioned above, a function to be called when an error occurs through the request_threaded_irq function is set. If an error occurs, it can be confirmed that the hikwdt_isr function is executed.
If you look at the function, you can see that it is performing various tasks according to the error code, and you can also see the string output when rebooted by the watchdog.
2.4.2. libplatform.so
Watchdog init and feeding in the libplatform.so library.
If you look at the code above, you can see that the ioctl function is executed after opening the /dev/watchdog device. At this time, the timeout period is set to the transmitted factor.
Feeding is also done through the ioctl function like init.
Last updated