ECMO: Rehost Embedded Linux Kernels via Peripheral Transplantation

The presentation discusses the Peripheral Transplantation technique for re-hosting embedded kernels and the challenges it addresses.

• Embedded kernels consist of architecture-independent, architecture-dependent, and board-specific code.
• Peripheral Transplantation technique involves replacing the original device drivers with transplanted ones and emulating early boot peripherals.
• The technique addresses challenges such as peripheral diversity, lack of public information, and accurate emulation of peripherals.
• The workflow involves decompressing the kernel, identifying XML pointers, generating XML pointer ecmo drivers, and rehosting the kernel.

The presentation demonstrates the capability of supporting other peripherals by installing the leak driver smg 916. The naval smc 9116 is compiled into a kernel module and packed into a ram file system, which is then fed to the kernel. The filing speed can reach about 400 per second.

Dynamic analysis based on the full-system emulator QEMU is widely used for various purposes. However, it is challenging to run firmware images of embedded devices in QEMU, especially the process to boot the Linux kernel (we call this process rehosting the Linux kernel.) That's because embedded devices usually use different system-on-chips (SoCs) from multiple vendors and only a limited number of SoCs are currently supported in QEMU.In this work, we propose a technique called peripheral transplantation. The main idea is to transplant the device drivers of designated peripherals into the Linux kernel. By doing so, it can replace the peripherals in the kernel that are currently unsupported in QEMU with supported ones, thus making the Linux kernel rehostable. After that, various applications can be built upon. We implemented this technique inside a prototype system called ECMO and applied it to 815 firmware images, which consist of 20 kernel versions, 37 device models, and 24 vendors. The result shows that ECMO can successfully transplant peripherals for all the 815 Linux kernels. Among them,710 kernels can be successfully rehosted, i.e., launching a user-space shell (87.1% success rate). The failed cases are mainly because the root file system format (ramfs) is not supported by the kernel. We further build three applications, i.e., kernel crash analysis, rootkit forensic analysis, and kernel fuzzing, based on the rehosted kernels to demonstrate the usage scenarios of ECMO