firmwaredroid / firmwaredroid

FirmwareDroid is an analysis framework for Android firmware.

FirmwareDroid (FMD)

FirmwareDroid is a research project that aims to develop novel methods to analyse Android firmware. It is mainly made to automate the process of extracting and scanning pre-installed Android apps for security research purposes. FMD is made to run in docker and includes several third party analysis tools for security analysis and extraction. For instance:

• AndroGuard
• Androwarn
• VirusTotal
• Quark-Engine
• Qark
• SUPER Android Analyzer
• APKiD
• Exodus-Core
• APKLeaks
• Fuzzy-Hashing (currently unavailable -> refactoring in progress)
  • SSDeep
  • TLSH
• Unblob

In this repository you will find the code for the backend of FMD. The application has a minimal React frontend (see https://github.com/FirmwareDroid/FMD-WebClient), but is mainly an API and database that can be use for research studies.

Usage documentation can be found at: https://firmwaredroid.github.io/

Contributing

We are happy to accept contributions to the software and documentation. Feel free to open a pull request with your enhancements.

Security

FMD has only a minimal set of security features and is not a production ready software. Use at your own risk.

Publications

FirmwareDroid: Towards Automated Static Analysis of Pre-Installed Android Apps

@INPROCEEDINGS{FirmwareDroid,
  author={Sutter, Thomas and Tellenbach, Bernhard},
  booktitle={2023 IEEE/ACM 10th International Conference on Mobile Software Engineering and Systems (MOBILESoft)}, 
  title={FirmwareDroid: Towards Automated Static Analysis of Pre-Installed Android Apps}, 
  year={2023},
  month={May},
  pages={12-22},
  doi={10.1109/MOBILSoft59058.2023.00009}
}

License:

FirmwareDroid is a non-profit research project licenced under the GNU General Public License v3.0 (see our licence).

firmwaredroid's Issues

Migrate to GraphQL

https://github.com/graphql-python/graphene-mongo
https://github.com/graphql-python/graphene-mongo/tree/master/examples/flask_mongoengine

Update dependencies and requirements

Change extraction routine of unblob

Issue onekey-sec/unblob#647 is now resolved an can be integrated into FMD

Test new firmware importer

Update Read the Docs

Add sanitation and verification of parameters

Currently the graphQL API does only a minimal verification of parameters. This needs to be changed in future version to make the API more stable and secure.

Sanitation mechanisms for various payloads are not in-place in the current version and need to be added.

Unknown filesystem type 'f2fs'

New Android firmware samples use the f2fs filesystem. The Debian docker container is by default not able to mount f2fs. Thus, we need additional packages to be able to mount these images.

Add static code analysis and automated testing

Enhance firmware import with unblob