STAGE 6.1: EMBEDDED FIRMWARE & MULTI-ARCHQEMU / GHIDRA SLEIGH MULTI-ARCH ENGINEMIRAI / MOZI / BACKDOOR TRIAGER

IoT, Embedded Firmware & Multi-Architecture Triager

Triages non-x86 embedded binaries across ARM32/AArch64, MIPS (EB/EL), RISC-V (RV64GC), and PowerPC. Dissects SquashFS/CramFS rootfs images, extracts hardcoded telnet backdoors, cracks /etc/shadow hashes, and analyzes Mirai/Mozi C2 protocols and hardware watchdog disabling loops.

Select Firmware / IoT Sample:

Target Architecture

ARM32

ELF 32-bit LSB

Endianness & Calling Conv

Little Endian

AAPCS / ARM EABI

Entropy & Obfuscation

6.24 / 8.00

0xDEADBEEF (4-byte XOR table)

Watchdog Killer Status

WDT IOCTL Armed

/dev/watchdog, /dev/misc/watchdog, /dev/wdt

Target Vulnerable Device

Hikvision IP Cameras & Realtek Routers

Family: Mirai

Arch Architecture:

OFFSETHEX BYTESMNEMONICOPERANDSDECOMPILER ANNOTATION
0x00010480e92d4800push{r11, lr}; Prolog: save frame pointer and return address
0x00010484e28db004addr11, sp, #4; Setup frame pointer
0x00010488e24dd020subsp, sp, #32; Allocate 32 bytes stack frame
0x0001048ce59f0044ldrr0, [pc, #68]; Load ptr to XOR encrypted C2 string (/dev/watchdog)
0x00010490e3a010demovr1, #0xde; r1 = XOR key 0xDEADBEEF byte 0
0x00010494eb000112bl0x000108e4 <table_unlock>; Call Mirai string decryptor routine
0x00010498e3a01002movr1, #2; r1 = O_RDWR (2)
0x0001049ceb0001f0bl0x00010c64 <open>; open('/dev/watchdog', O_RDWR)
0x000104a0e2504000subsr4, r0, #0; Check if fd > 0
0x000104a45a000004bpl0x000104bc <wdt_disable>; Branch if watchdog device opened successfully
0x000104a8e3a00002movr0, #2; AF_INET (2)
0x000104ace3a01001movr1, #1; SOCK_STREAM (1)
0x000104b0e3a02006movr2, #6; IPPROTO_TCP (6)
0x000104b4eb000210bl0x00010cfc <socket>; Create outbound scanner TCP socket
0x000104b8e1a05000movr5, r0; Store socket fd in r5
0x000104bce1a00004movr0, r4; wdt_disable: r0 = fd
0x000104c0e59f101cldrr1, [pc, #28]; r1 = WDIOC_SETOPTIONS (0x5704)
0x000104c4e59f201cldrr2, [pc, #28]; r2 = WDIOS_DISABLECARD (0x0001)
0x000104c8eb000234bl0x00010da0 <ioctl>; ioctl(fd, WDIOC_SETOPTIONS, &disable)

ABI Architecture: ARM AAPCS (R0-R3 args, R0 ret)PC = 0x00010480

R0:0x00000000
R1:0x00000000
R2:0x00000000
R3:0x00000000
R4:0x00000000
R5:0x00000000
SP:0x7EFFF820
LR:0x00010484
PC:0x00010480
CPSR:0x60000010

Endianness Byte Decoder

MIPS Big Endian stores most significant byte at lowest memory address. Little Endian reverses the multi-byte integer in memory.

Logical 32-bit Value:0xDEADBEEF
Big Endian (mipseb/PPC):[ DE | AD | BE | EF ]
Little Endian (ARM/mipsel):[ EF | BE | AD | DE ]

Ghidra SLEIGH Multi-Arch Specs

ARM32: Conditional execution suffixes (EQ, NE, CS, MI, PL, VS).
MIPS: Branch delay slot execution (next instruction executes regardless of branch).
PPC32: Link Register (LR) & Count Register (CTR) branch handling.
RISC-V: 32 general-purpose registers x0-x31, compressed 16-bit C-extension opcodes.