面向固件的嵌入式操作系统识别技术研究

发布时间：2018-04-29 11:29

本文选题：嵌入式固件 + 操作系统类型识别　；参考：《解放军信息工程大学》2012年硕士论文

【摘要】：嵌入式设备中固化操作系统的逆向分析是嵌入式设备逆向解剖的重要内容之一，对设备所使用的操作系统类型及内核版本进行识别是操作系统逆向分析的必要前提，所以对嵌入式固件中操作系统识别技术进行研究具有重要意义。论文首先对嵌入式操作系统固件的结构、存储机制及逆向解析流程进行了叙述，在此基础上提出了一个嵌入式操作系统识别框架。该框架分为固件模块剥离与逆向解析、操作系统类型识别以及内核版本识别三个部分。模块剥离与逆向解析部分主要完成固件中操作系统代码的剥离和基本信息的提取工作，，为后续识别提供数据基础。针对操作系统类型识别问题，提出了一种基于多属性决策的识别技术，在对操作系统在固件中体现出的多种特征进行提取的基础上，结合预先构建的操作系统类型识别特征数据库，通过系统筛选、相似度判定方法实现对待识别固件中操作系统类型的识别。针对内核版本识别问题，提出了一种基于内核相似度判定的识别技术，采用FLIRT库函数识别技术和改进的函数结构化匹配技术将待识别内核中的函数与各标准版本内核中的函数进行匹配，并通过匹配的函数总数计算与各标准版本内核之间的相似度，最终通过相似度分布情况做出判定。在此基础上，设计并实现了一个操作系统识别原型系统，并使用多种操作系统固件对该系统进行了测试，测试结果表明系统能够准确有效地完成操作系统类型识别及内核版本的判定工作。
[Abstract]:Reverse analysis of solidified operating system in embedded devices is one of the important contents of reverse anatomy of embedded devices. Recognition of operating system types and kernel versions used in embedded devices is a necessary prerequisite of operating system reverse analysis. Therefore, it is of great significance to study the operating system recognition technology in embedded firmware. Firstly, the structure, storage mechanism and reverse parsing flow of embedded operating system firmware are described, and then an embedded operating system recognition framework is proposed. The framework is divided into firmware module stripping and reverse parsing, operating system type recognition and kernel version recognition. The module stripping and reverse parsing part mainly completes the stripping of operating system code and the extraction of basic information in the firmware, which provides the data basis for the subsequent identification. In order to solve the problem of operating system type recognition, a multi-attribute decision based recognition technique is proposed, based on which the operating system features in firmware are extracted. Combined with the pre-built operating system type recognition feature database, the recognition of operating system type in the firmware is realized by system selection and similarity determination method. In order to solve the kernel version recognition problem, a kernel similarity recognition technique is proposed. FLIRT library function recognition technology and improved function structured matching technique are used to match the functions in the kernel to be identified with the functions in each standard version kernel, and the similarity between the functions and the standard kernel is calculated by the total number of matching functions. Finally, the similarity distribution is determined. On this basis, an operating system recognition prototype system is designed and implemented, and a variety of operating system firmware is used to test the system. Test results show that the system can accurately and effectively complete the operating system type identification and kernel version determination.
【学位授予单位】：解放军信息工程大学
【学位级别】：硕士
【学位授予年份】：2012
【分类号】：TP368.1;TP311.5

【参考文献】