<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-firmware-malware-analysis
description: >-
  Extract, analyze, and detect malware embedded in firmware images including UEFI,
  BIOS, router firmware, and IoT device images using binwalk, uefi-firmware-parser,
  and Ghidra.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - firmware
  - uefi
  - bios
  - iot-malware
  - binwalk
  - ghidra
  - bootkit
  - malware-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1542"]
---

# Performing Firmware Malware Analysis

## Overview

Firmware malware persists below the operating system in UEFI/BIOS, router firmware, or IoT device images, surviving OS reinstalls and disk replacements. Threat actors implant modified DXE drivers, compromised bootloaders, or backdoored embedded Linux images to maintain stealth persistence. Analysis requires firmware extraction, filesystem carving, binary component identification, and reverse engineering of architecture-specific code (ARM, MIPS, x86).

## Prerequisites

- binwalk for firmware extraction and entropy analysis
- uefi-firmware-parser for UEFI volume parsing
- Ghidra with processor modules for ARM/MIPS/x86
- radare2 / rizin for quick disassembly
- QEMU for firmware emulation
- Jefferson (JFFS2), sasquatch (SquashFS) for filesystem extraction
- Python 3.10+ with `uefi_firmware`, `capstone`

## Key Concepts

### Firmware Attack Surface

| Component | Attack Vector | Persistence Level |
|-----------|--------------|-------------------|
| UEFI DXE driver | Modified SPI flash | Survives OS reinstall |
| Option ROM | PCI device firmware | Survives disk replacement |
| BMC/IPMI | Network-accessible management | Independent of host OS |
| Router firmware | Modified squashfs/kernel | Survives factory reset (sometimes) |
| IoT bootloader | U-Boot modification | Full device control |

### UEFI Boot Flow

SPI Flash → SEC (Security) → PEI (Pre-EFI Init) → DXE (Driver Execution) → BDS (Boot Device Select) → OS Loader. Implants typically target DXE phase where they can hook OS loader.

## Workflow

### Step 1: Firmware Extraction

```bash
# Extract firmware image with binwalk
binwalk -e firmware.bin

# Entropy analysis — detect encrypted/compressed regions
binwalk -E firmware.bin

# Extract UEFI volumes
uefi-firmware-parser -e -O output_dir firmware.rom

# SPI flash dump from live system (requires root + flashrom)
flashrom -p internal -r spi_dump.bin

# Router firmware — extract squashfs
binwalk -e router_firmware.bin
sasquatch -d extracted/ _router_firmware.bin.extracted/*.squashfs
```

### Step 2: Identify Firmware Components

```bash
# List UEFI firmware volumes and files
uefi-firmware-parser --test firmware.rom

# Identify architecture of embedded binaries
file extracted/*
for f in extracted/*; do
    file "$f" | grep -iE "ELF|PE32|ARM|MIPS|EFI"
done

# Strings from firmware components
strings -a -n 8 extracted/dxe_driver.efi | grep -iE "http|backdoor|shell|connect|password"

# YARA scan extracted components
yara -r firmware_implant_rules.yar extracted/
```

### Step 3: Reverse Engineer Suspicious Modules

```bash
# Ghidra headless analysis of EFI binary
analyzeHeadless /tmp/ghidra_project FWAnalysis \
    -import extracted/suspicious_driver.efi \
    -processor x86:LE:64:default \
    -postScript ExportFunctions.py

# radare2 quick analysis
r2 -A extracted/suspicious_driver.efi
# In r2 shell:
# afl          — list functions
# axt @sym.main — xrefs to main
# pdf @entry0  — disassemble entry point
# izz          — all strings

# For ARM/MIPS IoT binaries
r2 -a arm -b 32 extracted/busybox
r2 -a mips -b 32 -e cfg.bigendian=true extracted/httpd
```

### Step 4: Compare Against Known-Good Firmware

```bash
# Binary diff between known-good and suspect firmware
radiff2 -s known_good.rom suspect.rom

# Hash comparison of extracted modules
find known_good_extracted/ -type f -exec sha256sum {} \; | sort > known_good_hashes.txt
find suspect_extracted/ -type f -exec sha256sum {} \; | sort > suspect_hashes.txt
diff known_good_hashes.txt suspect_hashes.txt
```

### Step 5: Emulate Firmware for Dynamic Analysis

```bash
# QEMU emulation of ARM firmware
qemu-system-arm -M virt -kernel extracted/zImage \
    -drive file=extracted/rootfs.img,format=raw \
    -append "root=/dev/vda console=ttyAMA0" \
    -nographic -net nic -net user,hostfwd=tcp::8080-:80

# firmwalker — automated firmware analysis
./firmwalker.sh extracted/ output_report.txt
```

## YARA Rule

```yara
rule UEFI_Firmware_Implant {
    meta:
        description = "Detects suspicious patterns in UEFI DXE drivers"
        author = "NERF"
        date = "2026-03-17"
        mitre_attack = "T1542.001"
        severity = "critical"
    strings:
        $efi_magic = { 00 00 00 00 D9 54 93 7A }
        $hook1 = "ExitBootServices" ascii
        $hook2 = "SetVirtualAddressMap" ascii
        $net1 = "HttpSendRequest" ascii
        $net2 = "socket" ascii
        $sus1 = "cmd.exe" ascii
        $sus2 = "/bin/sh" ascii
    condition:
        $efi_magic and
        any of ($hook*) and
        any of ($net*, $sus*)
}
```

## Detection

```yaml
title: Firmware Malware Analysis Detection
id: e4241e3a-8f32-4460-a342-7fcd9dffaa2c
status: experimental
description: Detects suspicious activity related to performing firmware malware analysis techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*firmware*"
  condition: selection
level: high
tags:
  - attack.t1542
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

- [ ] Firmware image extracted and components catalogued
- [ ] Entropy analysis identifies encrypted/compressed regions
- [ ] Suspicious modules identified via string analysis and YARA
- [ ] Binary diff against known-good firmware completed
- [ ] Architecture-appropriate disassembly performed in Ghidra
- [ ] Firmware emulated for dynamic behavior analysis (if applicable)
- [ ] Findings mapped to MITRE ATT&CK (T1542, T1495)

## References

- [MITRE ATT&CK T1542.001 — UEFI Firmware Implant](https://attack.mitre.org/techniques/T1542/001/)
- [binwalk — Firmware Analysis Tool](https://github.com/ReFirmLabs/binwalk)
- [uefi-firmware-parser](https://github.com/theopolis/uefi-firmware-parser)
- [ESET — LoJax UEFI Rootkit Analysis](https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild/)
