Coreboot Project Is Leveraging NSA Software To Help With Firmware Reverse Engineering

[phoronix]

Phoronix: Coreboot Project Is Leveraging NSA Software To Help With Firmware Reverse Engineering

It's not often the National Security Agency (NSA) can be thanked for their contributions to society, but in the case of one of their public open-source projects it's going to be used to help the Coreboot folks in reverse-engineering system firmware...

http://www.phoronix.com/scan.php?page=news_item&px=Ghidra-Coreboot-NSA-RE

[uid313]

Ghidra does not have support for the RISC-V architecture. 😢

[FireBurn]

I thought only clean room reverse engineering was allowed in open source projects

[coder111]

I thought only clean room reverse engineering was allowed in open source projects

Um, that's how you do clean room. You have one team contaminating themselves with "rogue IP" reverse engineering and writing specs. You have another clean team reading specs and writing new or compatible implementation.

[Adarion]

That sounds like a great opportunity, but I wonder if that will ever help against signed FW, since without a proper privkey you will hardly be able to sign your new and improved FW.

[Guest]

Ghidra does not have support for the RISC-V architecture. 😢

Hardly a problem considering RISC-V won't have much software available now, especially the kind you don't have source for.

[stormcrow]

That sounds like a great opportunity, but I wonder if that will ever help against signed FW, since without a proper privkey you will hardly be able to sign your new and improved FW.

While I can understand and sympathize with those concerns, the reality in practice has been that firmware signing has been mostly security theater as the OEMs that do use signed loaders seem to almost always screw it up in some rather spectacular fashion. This leads to ways to load custom firmware even on machines where signed firmware loading is enforced. See the recent Cisco enterprise hardware security blunder which can't be fixed with software patches for a rather spectacular example.

If we ever reach the point where those exploits become rare people are going to have to consciously choose between signed & locked down firmware and more open non-signed loaders. By themselves there's often pros and cons to either which may or may not be obvious to even knowledgeable purchasers, especially since that's rarely a feature point on marketing materials.

[Snoop05]

That sounds like a great opportunity, but I wonder if that will ever help against signed FW, since without a proper privkey you will hardly be able to sign your new and improved FW.

https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11098

[uid313]

Hardly a problem considering RISC-V won't have much software available now, especially the kind you don't have source for.

Ghidra have support for many other architectures architectures that doesn't have much software.
But RISC-V is used on hardware too, like in Nvidia GeForce cards and in storage devices from Western Digital. So RISC-V support would be useful for firmware reverse engineering.

[pgeorgi]

But RISC-V is used on hardware too, like in Nvidia GeForce cards and in storage devices from Western Digital. So RISC-V support would be useful for firmware reverse engineering.

I fully expect RISC-V support in Ghidra to come around eventually. As for the project at hands, this effort is mentored by coreboot folks and so Alex will naturally work on stuff that benefits the coreboot ecosystem. The ability to learn more about PC firmware's inner working simply has a higher priority there.