Explore a 25-minute Black Hat conference talk on rehosting embedded Linux kernels through peripheral transplantation. Dive into the challenges of running firmware images in QEMU, particularly for booting Linux kernels on embedded devices with diverse system-on-chips. Learn about a novel technique that transplants device drivers of designated peripherals into the Linux kernel, enabling dynamic analysis. Follow the speaker's journey from motivation and background to the intricacies of the ECMO (Embedded Core Migration Operation) system workflow. Examine concrete examples, evaluation metrics, and potential applications of this innovative approach to firmware analysis and security research.
ECMO - Rehost Embedded Linux Kernels via Peripheral Transplantation
Overview
Syllabus
Intro
Motivation
Rehosting
Background
Challenges
Our Insights
Peripheral Transplantation
A Concrete Example
System Workflow
Decompress Linux kernel
Lexical Information (2)
Function Relationship (1)
Function Structure (2)
Generate ECMO Drivers
Evaluation
Identify ECMO Pointers (RQ1)
Reliability and Stability (RQ3)
Applications and Other Peripherals (RQ4)
Conclusion
Taught by
Black Hat
