python-binexport: Quick Start¶

Introduction¶

The sample to work on has been extracted from the firmware of a edimax router (BR6478AC V2) and it is known to be vulnerable to CVE-2023-49351. It can be downloaded below.

binary.tar.gz

It’s a MIPS ELF executable that acts as a HTTP server. We are interested in finding all the functions that call a potentially unsafe primitive function (like strcpy).

Let’s use python-binexport to list them.

I. Loading the program¶

If the program has not been exported with BinExport, it can be exported with:

[ ]:

from binexport import ProgramBinExport

program = ProgramBinExport.from_binary_file("./webs")

Otherwise it can be directly loaded with:

[2]:

from binexport import ProgramBinExport

program = ProgramBinExport("./webs.BinExport")

II. Listing interesting functions¶

We are interested in listing all the functions that call a potentially vulnerable function, like strcpy for example. This can be achieved by using the FunctionBinExport.parents API.

[3]:

# Get the vulnerable function
strcpy = program.fun_names["strcpy"]

targets = strcpy.parents
print("\n".join(map(lambda f: f.name, targets)))

formiNICWdsEncrypt
dhcpClientList
CharFilter4
formWpsStart
formQoS
wlSiteSurveyTbl
getInfo
formWIRESch
get_dir
formiNICSiteSurvey
formiNICWpsStart
wliNICSiteSurveyonlyTbl
websFormDefine
formFilter
getiNICIndex
formiNICbasic
formVPNuser
wlSurveyOnlyTbl
formiNICEncrypt
formEZQoS
formTriggerPort
websAspDefine
formWlAc
CharFilter2
formWlSiteSurvey
formWdsEncrypt
WIRESchList
ACPCList
USBFolderSelect
formPortFw
sub_434E40
wliNICSiteSurveyTbl
wispSiteSurveyTbl5G
CharFilter3
formDNSProxyrules
formUSBAccount
CharFilter5
getIndex
CharFilter0
formWlEncrypt
formWlbasic
formiNICAc
CharFilter6
setWAN
getiNICInfo
wispSiteSurveyTbl
getInAddr
apmib_set
getWlSiteSurveyRequest
formSaveText
formUSBFolder
apmib_get
formVirtualSv

III. Find interesting paths in the CG¶

Now what if we wanted to show the path in the CG (Call Graph) that leads to the execution of one of those functions from main?

[4]:

from binexport import FunctionBinExport


def dfs(f: FunctionBinExport, path: list[FunctionBinExport]):
    if f.name == "main":
        print(" > ".join(map(lambda x: x.name, path[::-1])))
        return

    for caller in f.parents:
        path.append(caller)
        dfs(caller, path)
        path.pop(-1)

for target in targets:
    dfs(target, [strcpy, target])

main > websAspInit > formsDefine > formiNICWdsEncrypt > strcpy
main > websAspInit > formsDefine > dhcpClientList > strcpy
main > websAspInit > formsDefine > virtualSvList > CharFilter4 > strcpy
main > websAspInit > formsDefine > wlAcList > CharFilter4 > strcpy
main > websAspInit > formsDefine > portFwList > CharFilter4 > strcpy
main > websAspInit > formsDefine > wliNICAcList > CharFilter4 > strcpy
main > websAspInit > formsDefine > macFilterList > CharFilter4 > strcpy
main > websAspInit > formsDefine > ACPCList > CharFilter4 > strcpy
main > websAspInit > formsDefine > triggerPortList > CharFilter4 > strcpy
main > websAspInit > formsDefine > formWpsStart > strcpy
main > websAspInit > formsDefine > formQoS > strcpy
main > websAspInit > formsDefine > wlSiteSurveyTbl > strcpy
main > websAspInit > formsDefine > getInfo > strcpy
main > websAspInit > formsDefine > formWIRESch > strcpy
main > loop > process_requests > read_header > process_header_end > init_get > get_dir > strcpy
main > loop > process_requests > read_header > process_header_end > init_get2 > get_dir > strcpy
main > websAspInit > formsDefine > formiNICSiteSurvey > strcpy
main > websAspInit > formsDefine > formiNICWpsStart > strcpy
main > websAspInit > formsDefine > wliNICSiteSurveyonlyTbl > strcpy
main > websAspInit > formsDefine > websFormDefine > strcpy
main > websAspInit > formsDefine > formFilter > strcpy
main > websAspInit > getiNICVar > getiNICIndex > strcpy
main > websAspInit > formsDefine > getiNICIndex > strcpy
main > websAspInit > formsDefine > formiNICbasic > strcpy
main > websAspInit > formsDefine > formVPNuser > strcpy
main > websAspInit > formsDefine > wlSurveyOnlyTbl > strcpy
main > websAspInit > formsDefine > formiNICEncrypt > strcpy
main > websAspInit > formsDefine > formEZQoS > strcpy
main > websAspInit > formsDefine > formTriggerPort > strcpy
main > websAspInit > websAspDefine > strcpy
main > websAspInit > formsDefine > websAspDefine > strcpy
main > websAspInit > formsDefine > formWlAc > strcpy
main > websAspInit > formsDefine > getiNICInfo > CharFilter2 > strcpy
main > websAspInit > formsDefine > wliNICSiteSurveyTbl > CharFilter2 > strcpy
main > websAspInit > formsDefine > wispSiteSurveyTbl5G > CharFilter2 > strcpy
main > websAspInit > formsDefine > formWlSiteSurvey > CharFilter2 > strcpy
main > websAspInit > formsDefine > wispSiteSurveyTbl > CharFilter2 > strcpy
main > websAspInit > formsDefine > wlSurveyOnlyTbl > CharFilter2 > strcpy
main > websAspInit > formsDefine > wlSiteSurveyTbl > CharFilter2 > strcpy
main > websAspInit > formsDefine > getInfo > CharFilter2 > strcpy
main > websAspInit > formsDefine > formiNICSiteSurvey > CharFilter2 > strcpy
main > websAspInit > formsDefine > wliNICSiteSurveyonlyTbl > CharFilter2 > strcpy
main > websAspInit > formsDefine > formWlSiteSurvey > strcpy
main > websAspInit > formsDefine > formWdsEncrypt > strcpy
main > websAspInit > formsDefine > WIRESchList > strcpy
main > websAspInit > formsDefine > ACPCList > strcpy
main > websAspInit > formsDefine > USBFolderSelect > strcpy
main > websAspInit > formsDefine > formPortFw > strcpy
main > websAspInit > formsDefine > wliNICSiteSurveyTbl > strcpy
main > websAspInit > formsDefine > wispSiteSurveyTbl5G > strcpy
main > websAspInit > formsDefine > formFilter > CharFilter3 > strcpy
main > websAspInit > formsDefine > formiNICAc > CharFilter3 > strcpy
main > websAspInit > formsDefine > formTriggerPort > CharFilter3 > strcpy
main > websAspInit > formsDefine > formWlAc > CharFilter3 > strcpy
main > websAspInit > formsDefine > formVirtualSv > CharFilter3 > strcpy
main > websAspInit > formsDefine > formPortFw > CharFilter3 > strcpy
main > websAspInit > formsDefine > formDNSProxyrules > strcpy
main > websAspInit > formsDefine > formUSBAccount > strcpy
main > websAspInit > formsDefine > getInfo > CharFilter5 > strcpy
main > websAspInit > formsDefine > getiNICInfo > CharFilter5 > strcpy
main > websAspInit > formsDefine > getIndex > strcpy
main > websAspInit > getVar > getIndex > strcpy
main > websAspInit > formsDefine > formWlbasic > CharFilter0 > strcpy
main > websAspInit > formsDefine > formWlEncrypt > strcpy
main > websAspInit > formsDefine > formWlbasic > strcpy
main > websAspInit > formsDefine > formiNICAc > strcpy
main > websAspInit > formsDefine > getInfo > CharFilter6 > strcpy
main > websAspInit > formsDefine > getiNICInfo > CharFilter6 > strcpy
main > websAspInit > formsDefine > setWAN > strcpy
main > websAspInit > formsDefine > getiNICInfo > strcpy
main > websAspInit > formsDefine > wispSiteSurveyTbl > strcpy
main > websAspInit > formsDefine > getiNICInfo > getInAddr > strcpy
main > websAspInit > formsDefine > getIndex > isDhcpClientExist > getInAddr > strcpy
main > websAspInit > getVar > getIndex > isDhcpClientExist > getInAddr > strcpy
main > websAspInit > getiNICVar > getiNICIndex > isDhcpClientExist > getInAddr > strcpy
main > websAspInit > formsDefine > getiNICIndex > isDhcpClientExist > getInAddr > strcpy
main > websAspInit > formsDefine > getiNICInfo > isDhcpClientExist > getInAddr > strcpy
main > websAspInit > formsDefine > getInfo > isDhcpClientExist > getInAddr > strcpy
main > websAspInit > formsDefine > formFilter > getInAddr > strcpy
main > websAspInit > formsDefine > formrefresh > getInAddr > strcpy
main > websAspInit > formsDefine > formQoS > getInAddr > strcpy
main > websAspInit > formsDefine > formTcpipSetup > getInAddr > strcpy
main > websAspInit > formsDefine > getInfo > getInAddr > strcpy
main > websAspInit > formsDefine > formVirtualSv > getInAddr > strcpy
main > websAspInit > formsDefine > formPortFw > getInAddr > strcpy
main > websAspInit > formsDefine > formTELBPSetup > apmib_set > strcpy
main > websAspInit > formsDefine > wiz_5in1_redirect > apmib_set > strcpy
main > websAspInit > formsDefine > formAdvanceSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICWdsEncrypt > apmib_set > strcpy
main > websAspInit > formsDefine > saveAndReboot > apmib_set > strcpy
main > websAspInit > formsDefine > chkLink > apmib_set > strcpy
main > websAspInit > formsDefine > formOpMode > opModeHandler > apmib_set > strcpy
main > websAspInit > formsDefine > formEZQoSMode > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICWpsStart > apmib_set > strcpy
main > websAspInit > formsDefine > setWifi > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICbasic > apmib_set > strcpy
main > websAspInit > formsDefine > formVPNuser > apmib_set > strcpy
main > websAspInit > formsDefine > formUSBmanage > apmib_set > strcpy
main > websAspInit > formsDefine > formTriggerPort > apmib_set > strcpy
main > websAspInit > formsDefine > formPSSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formPortFw > apmib_set > strcpy
main > websAspInit > formsDefine > formStcIpSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formALGSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICEnableSwitch > apmib_set > strcpy
main > websAspInit > formsDefine > formWpsEnable > apmib_set > strcpy
main > websAspInit > formsDefine > formMultipleSSID > apmib_set > strcpy
main > websAspInit > formsDefine > formDynIpSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formUSBdevice > apmib_set > strcpy
main > websAspInit > formsDefine > getInfo > apmib_set > strcpy
main > websAspInit > formsDefine > formNatEnable > apmib_set > strcpy
main > websAspInit > formsDefine > formWIRESch > apmib_set > strcpy
main > websAspInit > formsDefine > formHWNATSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formEZQoS > apmib_set > strcpy
main > websAspInit > formsDefine > formTcpipSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formReManagementSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formPasswordSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formUPNPSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formWlbasic > apmib_set > strcpy
main > websAspInit > formsDefine > formStaDrvSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formSaveText > apmib_set > strcpy
main > websAspInit > formsDefine > formTimeZoneSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formAdvManagement > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICAdvanceSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formVirtualSv > apmib_set > strcpy
main > websAspInit > formsDefine > formQoS > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICSiteSurvey > apmib_set > strcpy
main > websAspInit > formsDefine > formFwEnable > apmib_set > strcpy
main > websAspInit > formsDefine > formWlanSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formPPPoESetup > apmib_set > strcpy
main > websAspInit > formsDefine > formWifiEnable > apmib_set > strcpy
main > websAspInit > formsDefine > formPPTPSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formUrlb > apmib_set > strcpy
main > websAspInit > formsDefine > formDDNSSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formWlSiteSurvey > apmib_set > strcpy
main > websAspInit > formsDefine > formWdsEncrypt > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICWpsEnable > apmib_set > strcpy
main > websAspInit > formsDefine > formDNSProxyrules > apmib_set > strcpy
main > websAspInit > formsDefine > formLicence > apmib_set > strcpy
main > websAspInit > formsDefine > formWlEnableSwitch > apmib_set > strcpy
main > websAspInit > formsDefine > formIgmpEnable > apmib_set > strcpy
main > websAspInit > formsDefine > formWlEncrypt > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICEnable > apmib_set > strcpy
main > websAspInit > formsDefine > formPOWERSch > apmib_set > strcpy
main > websAspInit > formsDefine > formSDHCP > apmib_set > strcpy
main > websAspInit > formsDefine > formPreventionSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formWanTcpipSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formWlEnable > apmib_set > strcpy
main > websAspInit > formsDefine > formVPNsetup > apmib_set > strcpy
main > websAspInit > formsDefine > formFilter > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICEncrypt > apmib_set > strcpy
main > websAspInit > formsDefine > formWlAc > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICMultipleSSID > apmib_set > strcpy
main > websAspInit > formsDefine > formUSBAccount > apmib_set > strcpy
main > websAspInit > formsDefine > formAPModeSwitch > apmib_set > strcpy
main > websAspInit > formsDefine > formiNICAc > apmib_set > strcpy
main > websAspInit > formsDefine > setWAN > apmib_set > strcpy
main > websAspInit > formsDefine > formL2TPSetup > apmib_set > strcpy
main > websAspInit > formsDefine > formUSBFolder > apmib_set > strcpy
main > websAspInit > formsDefine > wliNICSiteSurveyTbl > getWlSiteSurveyRequest > strcpy
main > websAspInit > formsDefine > wispSiteSurveyTbl5G > getWlSiteSurveyRequest > strcpy
main > websAspInit > formsDefine > formWlSiteSurvey > getWlSiteSurveyRequest > strcpy
main > websAspInit > formsDefine > wispSiteSurveyTbl > getWlSiteSurveyRequest > strcpy
main > websAspInit > formsDefine > wlSurveyOnlyTbl > getWlSiteSurveyRequest > strcpy
main > websAspInit > formsDefine > wlSiteSurveyTbl > getWlSiteSurveyRequest > strcpy
main > websAspInit > formsDefine > formiNICSiteSurvey > getWlSiteSurveyRequest > strcpy
main > websAspInit > formsDefine > wliNICSiteSurveyonlyTbl > getWlSiteSurveyRequest > strcpy
main > websAspInit > formsDefine > formSaveText > strcpy
main > websAspInit > formsDefine > formUSBFolder > strcpy
main > websAspInit > formsDefine > formAdvanceSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formiNICWdsEncrypt > apmib_get > strcpy
main > websAspInit > formsDefine > saveAndReboot > apmib_get > strcpy
main > websAspInit > formsDefine > wlSiteSurveyTbl > apmib_get > strcpy
main > websAspInit > formsDefine > chkLink > apmib_get > strcpy
main > websAspInit > formsDefine > setWifi > apmib_get > strcpy
main > websAspInit > formsDefine > StcRoutList > apmib_get > strcpy
main > websAspInit > formsDefine > formUSBmanage > apmib_get > strcpy
main > websAspInit > formsDefine > formiNICbasic > apmib_get > strcpy
main > websAspInit > formsDefine > formVPNuser > apmib_get > strcpy
main > websAspInit > formsDefine > formTriggerPort > apmib_get > strcpy
main > websAspInit > formsDefine > DNSPROXYURLList > apmib_get > strcpy
main > websAspInit > formsDefine > WIRESchList > apmib_get > strcpy
main > websAspInit > formsDefine > formPortFw > apmib_get > strcpy
main > websAspInit > formsDefine > FolderShow > apmib_get > strcpy
main > websAspInit > formsDefine > formStcIpSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formALGSetup > apmib_get > strcpy
main > loop > process_requests > read_header > process_header_end > auth_authorize > apmib_get > strcpy
main > websAspInit > apmib_init > apmib_get > strcpy
main > resetWebs > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > formsDefine > formSaveConfigSec > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > getiNICVar > getiNICIndex > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > formsDefine > getiNICIndex > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > formsDefine > formWpsStart > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > formsDefine > formSaveConfig > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > formsDefine > formwizResetDefault > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > formsDefine > getIndex > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > getVar > getIndex > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > formsDefine > formiNICWpsStart > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > formsDefine > formResetDefault > apmib_reinit > apmib_init > apmib_get > strcpy
main > websAspInit > formsDefine > formWpsEnable > apmib_get > strcpy
main > websAspInit > formsDefine > formUSBdevice > apmib_get > strcpy
main > websAspInit > formsDefine > URLBList > apmib_get > strcpy
main > websAspInit > formsDefine > getInfo > apmib_get > strcpy
main > websAspInit > formsDefine > formWIRESch > apmib_get > strcpy
main > websAspInit > formsDefine > Wan1QosList > apmib_get > strcpy
main > websAspInit > formsDefine > macFilterList > apmib_get > strcpy
main > websAspInit > formsDefine > USBDevAccount > apmib_get > strcpy
main > websAspInit > formsDefine > formHWNATSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formEZQoS > apmib_get > strcpy
main > websAspInit > formsDefine > formTcpipSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formReManagementSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formApply > apmib_get > strcpy
main > websAspInit > formsDefine > ACPCList > apmib_get > strcpy
main > websAspInit > formsDefine > formiNICSetup > apmib_get > strcpy
main > websAspInit > formsDefine > wliNICSiteSurveyTbl > apmib_get > strcpy
main > websAspInit > formsDefine > formPasswordSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formUPNPSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formWlbasic > apmib_get > strcpy
main > websAspInit > formsDefine > OpenVpnAccountList > apmib_get > strcpy
main > websAspInit > formsDefine > POWERSchList > apmib_get > strcpy
main > websAspInit > formsDefine > formStaDrvSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formSaveText > apmib_get > strcpy
main > websAspInit > formsDefine > formTimeZoneSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formiNICAdvanceSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formVirtualSv > apmib_get > strcpy
main > websAspInit > formsDefine > triggerPortList > apmib_get > strcpy
main > websAspInit > formsDefine > USBDevFolder > apmib_get > strcpy
main > websAspInit > formsDefine > formQoS > apmib_get > strcpy
main > loop > process_requests > read_header > process_header_end > auth_authorize > auth_check_userpass2 > apmib_get > strcpy
main > websAspInit > formsDefine > formFwEnable > apmib_get > strcpy
main > websAspInit > formsDefine > portFwList > apmib_get > strcpy
main > websAspInit > formsDefine > EZQosList > apmib_get > strcpy
main > websAspInit > getiNICVar > getiNICIndex > apmib_get > strcpy
main > websAspInit > formsDefine > getiNICIndex > apmib_get > strcpy
main > websAspInit > formsDefine > wliNICAcList > apmib_get > strcpy
main > websAspInit > formsDefine > formPPTPSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formUrlb > apmib_get > strcpy
main > websAspInit > formsDefine > formDDNSSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formWdsEncrypt > apmib_get > strcpy
main > websAspInit > formsDefine > formDNSProxyrules > apmib_get > strcpy
main > websAspInit > formsDefine > virtualSvList > apmib_get > strcpy
main > websAspInit > formsDefine > formIgmpEnable > apmib_get > strcpy
main > websAspInit > formsDefine > formWlEncrypt > apmib_get > strcpy
main > websAspInit > formsDefine > AccountShow > apmib_get > strcpy
main > websAspInit > formsDefine > formPOWERSch > apmib_get > strcpy
main > websAspInit > formsDefine > formSDHCP > apmib_get > strcpy
main > websAspInit > formsDefine > formPreventionSetup > apmib_get > strcpy
main > websAspInit > formsDefine > SDHCPList > apmib_get > strcpy
main > websAspInit > formsDefine > formWanTcpipSetup > apmib_get > strcpy
main > websAspInit > formsDefine > wlAcList > apmib_get > strcpy
main > websAspInit > formsDefine > formFilter > apmib_get > strcpy
main > websAspInit > formsDefine > DMZList > apmib_get > strcpy
main > websAspInit > formsDefine > formiNICEncrypt > apmib_get > strcpy
main > websAspInit > formsDefine > formWlAc > apmib_get > strcpy
main > websAspInit > formsDefine > QosShow > apmib_get > strcpy
main > websAspInit > formsDefine > showWebsPasswd > apmib_get > strcpy
main > websAspInit > formsDefine > formUSBAccount > apmib_get > strcpy
main > websAspInit > formsDefine > getIndex > apmib_get > strcpy
main > websAspInit > getVar > getIndex > apmib_get > strcpy
main > websAspInit > formsDefine > formAPModeSwitch > apmib_get > strcpy
main > websAspInit > formsDefine > formiNICAc > apmib_get > strcpy
main > websAspInit > formsDefine > setWAN > apmib_get > strcpy
main > websAspInit > formsDefine > getiNICInfo > apmib_get > strcpy
main > websAspInit > formsDefine > formL2TPSetup > apmib_get > strcpy
main > websAspInit > formsDefine > formUSBFolder > apmib_get > strcpy
main > websAspInit > formsDefine > formVirtualSv > strcpy

This can gives us an idea of which functions to look at when searching for a vulnerability.