Skip to content

Commit f57436a

Browse files
orangecmsorangecms
committed
docs: bootstrap chapter on unpacking firmware
Signed-off-by: Daniel Maslowski <[email protected]>
1 parent e6e2426 commit f57436a

File tree

4 files changed

+140
-0
lines changed

4 files changed

+140
-0
lines changed

‎docs/SUMMARY.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@
33
- [Intel platforms](platforms.md)
44
- [Knowledge on Firmware Images](knowledge.md)
55
- [Obtaining firmware images](images.md)
6+
- [Unpacking firmware](unpacking.md)

‎docs/analyze_unpack.drawio‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
<mxfile host="Electron" agent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/26.0.4 Chrome/128.0.6613.186 Electron/32.2.5 Safari/537.36" version="26.0.4">
2+
<diagram name="Page-1" id="hwgrUtwjc1-UXiYtHv0d">
3+
<mxGraphModel dx="1588" dy="592" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="600" pageHeight="400" math="0" shadow="0">
4+
<root>
5+
<mxCell id="0" />
6+
<mxCell id="1" parent="0" />
7+
<mxCell id="0rj6E4vX0p3N8P6SBft1-33" value="" style="rounded=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
8+
<mxGeometry x="-140" width="740" height="400" as="geometry" />
9+
</mxCell>
10+
<mxCell id="0rj6E4vX0p3N8P6SBft1-1" value="Container" style="swimlane;horizontal=0;whiteSpace=wrap;html=1;" parent="1" vertex="1">
11+
<mxGeometry x="40" y="62" width="120" height="200" as="geometry" />
12+
</mxCell>
13+
<mxCell id="0rj6E4vX0p3N8P6SBft1-17" value="AEntry" style="swimlane;fontStyle=0;childLayout=stackLayout;horizontal=1;startSize=26;horizontalStack=0;resizeParent=1;resizeParentMax=0;resizeLast=0;collapsible=1;marginBottom=0;whiteSpace=wrap;html=1;fontSize=18;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#000000;" parent="1" vertex="1">
14+
<mxGeometry x="420" y="40" width="140" height="130" as="geometry" />
15+
</mxCell>
16+
<mxCell id="0rj6E4vX0p3N8P6SBft1-18" value="+ offset: u32" style="text;align=left;verticalAlign=top;spacingLeft=4;spacingRight=4;overflow=hidden;rotatable=0;points=[[0,0.5],[1,0.5]];portConstraint=eastwest;whiteSpace=wrap;html=1;fontSize=16;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#000000;" parent="0rj6E4vX0p3N8P6SBft1-17" vertex="1">
17+
<mxGeometry y="26" width="140" height="34" as="geometry" />
18+
</mxCell>
19+
<mxCell id="0rj6E4vX0p3N8P6SBft1-19" value="+ size: u32" style="text;align=left;verticalAlign=top;spacingLeft=4;spacingRight=4;overflow=hidden;rotatable=0;points=[[0,0.5],[1,0.5]];portConstraint=eastwest;whiteSpace=wrap;html=1;fontSize=16;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#000000;" parent="0rj6E4vX0p3N8P6SBft1-17" vertex="1">
20+
<mxGeometry y="60" width="140" height="38" as="geometry" />
21+
</mxCell>
22+
<mxCell id="0rj6E4vX0p3N8P6SBft1-20" value="+ name: [u8; 12]" style="text;align=left;verticalAlign=top;spacingLeft=4;spacingRight=4;overflow=hidden;rotatable=0;points=[[0,0.5],[1,0.5]];portConstraint=eastwest;whiteSpace=wrap;html=1;fontSize=16;fillColor=#d5e8d4;strokeColor=#82b366;fontColor=#000000;" parent="0rj6E4vX0p3N8P6SBft1-17" vertex="1">
23+
<mxGeometry y="98" width="140" height="32" as="geometry" />
24+
</mxCell>
25+
<mxCell id="0rj6E4vX0p3N8P6SBft1-21" value="BEntry" style="swimlane;fontStyle=0;childLayout=stackLayout;horizontal=1;startSize=26;horizontalStack=0;resizeParent=1;resizeParentMax=0;resizeLast=0;collapsible=1;marginBottom=0;whiteSpace=wrap;html=1;fontSize=18;fillColor=#f8cecc;strokeColor=#b85450;fontColor=#000000;" parent="1" vertex="1">
26+
<mxGeometry x="420" y="260" width="140" height="98" as="geometry" />
27+
</mxCell>
28+
<mxCell id="0rj6E4vX0p3N8P6SBft1-22" value="+ tag: [u8; 4]" style="text;align=left;verticalAlign=top;spacingLeft=4;spacingRight=4;overflow=hidden;rotatable=0;points=[[0,0.5],[1,0.5]];portConstraint=eastwest;whiteSpace=wrap;html=1;fontSize=16;fillColor=#f8cecc;strokeColor=#b85450;fontColor=#000000;" parent="0rj6E4vX0p3N8P6SBft1-21" vertex="1">
29+
<mxGeometry y="26" width="140" height="34" as="geometry" />
30+
</mxCell>
31+
<mxCell id="0rj6E4vX0p3N8P6SBft1-24" value="+ hash: [u8; 32]" style="text;align=left;verticalAlign=top;spacingLeft=4;spacingRight=4;overflow=hidden;rotatable=0;points=[[0,0.5],[1,0.5]];portConstraint=eastwest;whiteSpace=wrap;html=1;fontSize=16;fillColor=#f8cecc;strokeColor=#b85450;fontColor=#000000;" parent="0rj6E4vX0p3N8P6SBft1-21" vertex="1">
32+
<mxGeometry y="60" width="140" height="38" as="geometry" />
33+
</mxCell>
34+
<mxCell id="0rj6E4vX0p3N8P6SBft1-25" value="&lt;p style=&quot;margin:0px;margin-top:6px;text-align:center;&quot;&gt;&lt;b&gt;AContainer&lt;/b&gt;&lt;/p&gt;&lt;hr size=&quot;1&quot; style=&quot;border-style:solid;&quot;&gt;&lt;p style=&quot;margin:0px;margin-left:8px;&quot;&gt;- [0]&lt;/p&gt;&lt;p style=&quot;margin:0px;margin-left:8px;&quot;&gt;- [1]&lt;/p&gt;&lt;p style=&quot;margin:0px;margin-left:8px;&quot;&gt;- [2]&lt;/p&gt;" style="align=left;overflow=fill;html=1;dropTarget=0;whiteSpace=wrap;" parent="1" vertex="1">
35+
<mxGeometry x="220" y="40" width="140" height="90" as="geometry" />
36+
</mxCell>
37+
<mxCell id="0rj6E4vX0p3N8P6SBft1-26" value="" style="shape=component;jettyWidth=8;jettyHeight=4;" parent="0rj6E4vX0p3N8P6SBft1-25" vertex="1">
38+
<mxGeometry x="1" width="20" height="20" relative="1" as="geometry">
39+
<mxPoint x="-24" y="4" as="offset" />
40+
</mxGeometry>
41+
</mxCell>
42+
<mxCell id="0rj6E4vX0p3N8P6SBft1-27" value="&lt;p style=&quot;margin:0px;margin-top:6px;text-align:center;&quot;&gt;&lt;b&gt;BContainer&lt;/b&gt;&lt;/p&gt;&lt;hr size=&quot;1&quot; style=&quot;border-style:solid;&quot;&gt;&lt;p style=&quot;margin:0px;margin-left:8px;&quot;&gt;- [0]&lt;/p&gt;&lt;p style=&quot;margin:0px;margin-left:8px;&quot;&gt;- [1]&lt;/p&gt;&lt;p style=&quot;margin:0px;margin-left:8px;&quot;&gt;- [2]&lt;/p&gt;&lt;p style=&quot;margin:0px;margin-left:8px;&quot;&gt;- [3]&lt;/p&gt;" style="align=left;overflow=fill;html=1;dropTarget=0;whiteSpace=wrap;" parent="1" vertex="1">
43+
<mxGeometry x="220" y="260" width="140" height="100" as="geometry" />
44+
</mxCell>
45+
<mxCell id="0rj6E4vX0p3N8P6SBft1-28" value="" style="shape=component;jettyWidth=8;jettyHeight=4;" parent="0rj6E4vX0p3N8P6SBft1-27" vertex="1">
46+
<mxGeometry x="1" width="20" height="20" relative="1" as="geometry">
47+
<mxPoint x="-24" y="4" as="offset" />
48+
</mxGeometry>
49+
</mxCell>
50+
<mxCell id="0rj6E4vX0p3N8P6SBft1-29" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.075;entryDx=0;entryDy=0;entryPerimeter=0;" parent="1" source="0rj6E4vX0p3N8P6SBft1-25" target="0rj6E4vX0p3N8P6SBft1-17" edge="1">
51+
<mxGeometry relative="1" as="geometry" />
52+
</mxCell>
53+
<mxCell id="0rj6E4vX0p3N8P6SBft1-30" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=-0.011;entryY=0.106;entryDx=0;entryDy=0;entryPerimeter=0;" parent="1" source="0rj6E4vX0p3N8P6SBft1-27" target="0rj6E4vX0p3N8P6SBft1-21" edge="1">
54+
<mxGeometry relative="1" as="geometry" />
55+
</mxCell>
56+
<mxCell id="0rj6E4vX0p3N8P6SBft1-31" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;exitX=1;exitY=0.5;exitDx=0;exitDy=0;entryX=0.016;entryY=0.136;entryDx=0;entryDy=0;entryPerimeter=0;" parent="1" source="0rj6E4vX0p3N8P6SBft1-1" target="0rj6E4vX0p3N8P6SBft1-27" edge="1">
57+
<mxGeometry relative="1" as="geometry" />
58+
</mxCell>
59+
<mxCell id="0rj6E4vX0p3N8P6SBft1-32" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=-0.009;entryY=0.149;entryDx=0;entryDy=0;entryPerimeter=0;" parent="1" source="0rj6E4vX0p3N8P6SBft1-1" target="0rj6E4vX0p3N8P6SBft1-25" edge="1">
60+
<mxGeometry relative="1" as="geometry" />
61+
</mxCell>
62+
<mxCell id="ui3bQU06Xg5i3S3oondM-1" value="" style="swimlane;startSize=0;perimeterSpacing=0;strokeWidth=4;strokeColor=#7970FF;glass=1;rounded=0;swimlaneFillColor=none;shadow=0;" vertex="1" parent="1">
63+
<mxGeometry x="-100" y="40" width="90" height="320" as="geometry" />
64+
</mxCell>
65+
<mxCell id="ui3bQU06Xg5i3S3oondM-2" value="" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#F2FBFF;strokeColor=#36393d;" vertex="1" parent="1">
66+
<mxGeometry x="-100" y="160" width="90" height="60" as="geometry" />
67+
</mxCell>
68+
<mxCell id="ui3bQU06Xg5i3S3oondM-7" style="edgeStyle=orthogonalEdgeStyle;rounded=0;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;" edge="1" parent="1" source="ui3bQU06Xg5i3S3oondM-3" target="0rj6E4vX0p3N8P6SBft1-1">
69+
<mxGeometry relative="1" as="geometry" />
70+
</mxCell>
71+
<mxCell id="ui3bQU06Xg5i3S3oondM-3" value="" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#F2FBFF;strokeColor=#36393d;" vertex="1" parent="1">
72+
<mxGeometry x="-100" y="220" width="90" height="100" as="geometry" />
73+
</mxCell>
74+
<mxCell id="ui3bQU06Xg5i3S3oondM-4" value="" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#F2FBFF;strokeColor=#36393d;" vertex="1" parent="1">
75+
<mxGeometry x="-100" y="320" width="90" height="40" as="geometry" />
76+
</mxCell>
77+
<mxCell id="ui3bQU06Xg5i3S3oondM-5" value="" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#F2FBFF;strokeColor=#36393d;" vertex="1" parent="1">
78+
<mxGeometry x="-100" y="40" width="90" height="50" as="geometry" />
79+
</mxCell>
80+
<mxCell id="ui3bQU06Xg5i3S3oondM-6" value="" style="rounded=0;whiteSpace=wrap;html=1;fillColor=#F2FBFF;strokeColor=#36393d;" vertex="1" parent="1">
81+
<mxGeometry x="-100" y="90" width="90" height="70" as="geometry" />
82+
</mxCell>
83+
<mxCell id="ui3bQU06Xg5i3S3oondM-8" value="Firmware Image" style="text;html=1;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;" vertex="1" parent="1">
84+
<mxGeometry x="-100" y="20" width="90" height="20" as="geometry" />
85+
</mxCell>
86+
</root>
87+
</mxGraphModel>
88+
</diagram>
89+
</mxfile>

‎docs/analyze_unpack.png‎

86.2 KB
Loading

‎docs/unpacking.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Unpacking Firmware
2+
3+
Firmware images are typically packed and consist of various pieces henceforth
4+
called _components_. In different places, they may be called more specific
5+
terms, such as partitions, directories, modules, files, etc.
6+
7+
Many components are _containers_, which in turn are comprised of other things.
8+
As it happens over time, a firmware image for a platform of today may look very
9+
different from one meant for a platform from the past. It may be, however, that
10+
the target platform cannot be recognized right away, making analysis harder.
11+
Such is the case for Intel. We thus need an [architecture](./architecture.md)
12+
that is able to distinguish at any given level and allows for extraction.
13+
14+
## Partitions
15+
16+
The following diagram is a generic example of a partitioned firmware image with
17+
a container that may be of either one or another kind.
18+
And in turn, it would contain one or another kind of entries.
19+
20+
![](./analyze_unpack.png)
21+
22+
In Rust, we can use `enum` types to express this:
23+
24+
```rs
25+
enum Container {
26+
AContainer(Vec<AEntry>),
27+
BContainer(Vec<BEntry>),
28+
}
29+
```
30+
31+
## Intel ME Generation 3
32+
33+
With the third hardware generation of Intel ME based platforms, a new operating
34+
system was introduced, based on MINIX 3. It needs bootstrapping first.
35+
36+
There are multiple kinds of partitions, including Code Partition Directory (CPD)
37+
partitions. Those contain executables, their corresponding metadata files, and a
38+
manifest that holds a signature over the manifest.
39+
40+
The signed data in the manifest includes hashes of the metadata files and other
41+
things, so that the manifest suffices to verify the entire CPD's integrity.
42+
Each metadata file contains the counterpart binary's hash.
43+
The binaries themselves are mostly compressed, commonly using LZMA and a few via
44+
Huffman encoding.
45+
46+
Knowledge on CPDs, manifests, metadata and binaries can be found in PT Research
47+
utilities for unpacking:
48+
49+
- <https://github.com/ptresearch/unME11>
50+
- <https://github.com/ptresearch/unME12>

0 commit comments

Comments
 (0)