Ready to learn why and how to leverage IDAPython to take hundreds of hours off of the time required to statically analyze the firmware of embedded devices? Tired of only being able to find IDAPython examples for x86 and ARM? Frustrated with developing analysis tools that can only apply to one architecture? Then this talk is for you!
This talk first discusses some important differences between the analysis process of applications and firmware images. It then shows how to use IDAPython to address these differences when analyzing firmware images running on a variety of microcontroller architectures. I will then explain and demonstrate a general toolkit of IDAPython scripts I wrote to triage, analyze, and annotate a firmware image’s IDA database for more efficient static analysis. The key focus is writing the scripts to be architecture-agnostic so that you have a toolkit that can be used repeatedly on each new target firmware image. All demonstrated and discussed scripts are available open-source at https://github.com/maddiestone/IDAPythonEmbeddedToolkit.