Streamlining Firmware Analysis with Inter-Image Call Graphs and Decompilation

No ratings

Presented at RE//verse 2025 by

Robin David

This talk addresses challenges related to cartography and executable interdependencies often encountered in firmware analysis or in structured formats like the MacOS/iOS dylib shared cache. We introduce the term "inter-image" call graph, representing the calls relationship across an entire filesystem as a single graph. Instead of relying on the import/export relationships in dynamically linked binaries, we use the call graph obtain by disassembly, mapping precisely which functions call others. This graph, enables more efficient testing and resolution of graph-reachability queries across binaries. We show how to compute this graph using several open-source libraries we've developed such as Quokka for exporting disassembly data in an easy-to-process structure and Numbat, which interfaces with Sourcetrail's graph database. Originally developed for source code navigation, Sourcetrail's database can be adapted to accommodate various graph structures. We further illustrate how to integrate decompiled code for enhanced navigation. However, adding the entire decompiled code from each firmware executable into a single database is not scalable due to Sourcetrail's underlying SQLite limitations. To address this, we present a "fractal firmware analysis" methodology. This approach allows for traversal of the inter-image call graph, then zooming into a specific executable to explore decompiled code (still represented as a graph), and finally, accessing more detailed information through preferred disassemblers for data structure and everything that can't fit in a graph database. Finally, we provide a glimpse into bridging the gap between binary/assembly and source code tools by assembling open-source libraries. We conclude with an open discussion showing that there are rooms for more advanced analyses and data representations that could ease reverser's life.