FirmAE - Emulate Firmware

FirmAE is a fully-automated framework that performs emulation and vulnerability analysis. FirmAE significantly increases the emulation success rate (From Firmadyne's 16.28% to 79.36%) with five arbitration techniques.

Spreadcheet of verified firmware versions: view

Below is a short guide on how to emulate the firmware of a TP-Link Wireless Router.

1. Clone repo, install dependencies and build image

void@dev:~$ git clone https://github.com/pr0v3rbs/FirmAE.git
void@dev:~/FirmAE$ ./download.sh
void@dev:~/FirmAE$ ./install.sh
void@dev:~/FirmAE$ reboot (to make sure $USER is member of docker group)
void@dev:~/FirmAE$ ./docker-init.sh
void@dev:~/FirmAE$ sudo apt install python3-coloredlogs -y

2. Setup a postgres container and import database schema

void@dev:~/FirmAE$ service postgresql stop
void@dev:~/FirmAE$ docker pull postgres
void@dev:~/FirmAE$ docker run -itd -e POSTGRES_USER=firmadyne -e POSTGRES_PASSWORD=firmadyne -e POSTGRES_DB=firmware -p 5432:5432 -v /data:/var/lib/postgresql/data --name postgresql postgres
void@dev:~/FirmAE$ PGPASSWORD=firmadyne psql -h localhost -p 5432 -U firmadyne -d firmware < ./database/schema
(optional - verify)
void@dev:~/FirmAE$ PGPASSWORD=firmadyne psql -h localhost -p 5432 -U firmadyne -d firmware

3. Emulate firmware

Check the emulation using the -ec flag, if successfull you can then build/debug it using -ed flag.

4. Create tunnel to emulated devices' web interface with socat

Last updated

Was this helpful?