performing-firmware-malware-analysis

name	performing-firmware-malware-analysis
description	Analyzes firmware images for embedded malware, backdoors, and unauthorized modifications in routers, IoT devices, UEFI/BIOS, and embedded systems, covering firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection. Use for firmware security analysis, IoT malware investigation, UEFI rootkit detection, or embedded device compromise assessment.
domain	cybersecurity
subdomain	malware-analysis
tags	["malware","firmware","IoT","UEFI","embedded-security"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]
mitre_attack	["T1027","T1055","T1140","T1497","T1505.003"]

Performing Firmware Malware Analysis

When to Use

• A compromised IoT device or router needs firmware analysis to identify implanted backdoors
• Investigating UEFI/BIOS rootkits that persist across OS reinstallations
• Analyzing firmware updates for supply chain compromise or malicious modifications
• Extracting and examining embedded Linux filesystems from IoT device firmware images
• Verifying firmware integrity after a suspected hardware or firmware-level compromise

Do not use for standard operating system malware; use PE/ELF analysis tools for OS-level malware on conventional systems.

Prerequisites

• binwalk installed for firmware image analysis and extraction (pip install binwalk)
• Ghidra with ARM/MIPS architecture support for embedded binary reverse engineering
• UEFI Tool (UEFITool) for UEFI firmware parsing and analysis
• Firmware Analysis Toolkit (FAT) or EMBA for automated firmware analysis
• QEMU for emulating extracted firmware filesystems
• Cross-compilation toolchains for ARM, MIPS, and other embedded architectures

Workflow

Step 1: Extract and Identify Firmware Components

Analyze the firmware image structure and extract filesystems:

# Identify embedded filesystems and compressed data
binwalk firmware.bin

# Extract all identified components
binwalk -e firmware.bin

# Recursive extraction with signature scanning
binwalk -eM firmware.bin

# Output typically includes:
# - Bootloader (U-Boot, GRUB, custom)
# - Kernel image (Linux, RTOS)
# - Root filesystem (SquashFS, JFFS2, CramFS, ext4)
# - Configuration data
# - Digital signatures or checksums

# Entropy analysis to find encrypted or compressed regions
binwalk -E firmware.bin

# Identify specific filesystem types
file _firmware.bin.extracted/*

# For SquashFS filesystems
unsquashfs _firmware.bin.extracted/squashfs-root.img
ls squashfs-root/

Step 2: Analyze the Extracted Filesystem

Search for malicious modifications in the firmware filesystem:

# Directory structure analysis
find squashfs-root/ - f |  -50


find squashfs-root/ -name  -  -la {} \;
find squashfs-root/ -perm -4000 - f  
find squashfs-root/ -name  -newer squashfs-root/bin/busybox  


 squashfs-root/etc/init.d/rcS
 squashfs-root/etc/inittab
 -la squashfs-root/etc/rc.d/


grep -rn  squashfs-root/etc/ 2>/dev/null
grep -rn  squashfs-root/etc/shadow 2>/dev/null


find squashfs-root/ -name  -  {} \;


 squashfs-root/etc/hosts
grep -rn  squashfs-root/etc/ squashfs-root/usr/bin/


find squashfs-root/ -name  -o -name  | xargs  2>/dev/null


find squashfs-root/ - f - file {} \; | grep ELF