CN118444975A - Firmware analysis method, storage medium and device - Google Patents

Abstract

The application discloses a firmware analysis method, a storage medium and a device, wherein the first head information of a firmware file is matched with a first information mapping table by acquiring the first head information of the firmware file, so that the target type of the firmware file is determined, all information of the firmware file is not required to be scanned, the firmware analysis speed is improved, meanwhile, the firmware file is automatically analyzed by calling a corresponding target program file based on the target type, the file to be extracted is obtained, a command is not required to be manually input, the operation complexity is reduced, and the firmware analysis efficiency is improved.

Description

A firmware analysis method, storage medium and device

Technical Field

The present application relates to the field of computer technology, and in particular to a firmware parsing method, storage medium and device.

Background technique

Firmware is a type of software written into hardware devices. It is the most basic and lowest-level software in embedded systems and IoT devices. Users install software through firmware to achieve real-time control of applications and various system functions. Therefore, the security of firmware plays a vital role in embedded systems and IoT devices. By parsing the firmware, hidden security risks in the system can be discovered. Existing firmware parsing methods require scanning all bytes of the firmware file, and commands need to be manually entered during the parsing process, which is complex and time-consuming.

Summary of the invention

The embodiments of the present application provide a firmware parsing method, apparatus, storage medium and device, which do not require scanning all information of the firmware file and manually inputting commands, thereby reducing the operation complexity and improving the parsing speed. The technical solution is as follows:

A first aspect of an embodiment of the present application provides a firmware parsing method, including:

Get the first header information of the firmware file;

Matching the first header information with a first information mapping table to obtain a matching result, wherein the first information mapping table is used to match the header information of the firmware file to determine the target type of the firmware file;

Based on the matching result, determining a target type of the firmware file;

Based on the target type, the target program file is called to parse the firmware file to obtain a file to be extracted.

A second aspect of an embodiment of the present application provides a firmware parsing device, including:

A header information acquisition unit, used to acquire first header information of the firmware file;

a matching unit, configured to match the first header information with a first information mapping table to obtain a matching result, wherein the first information mapping table is used to match the header information of the firmware file to determine a target type of the firmware file;

a target type determining unit, configured to determine a target type of the firmware file based on the matching result;

The parsing unit is used to call the target program file to parse the firmware file based on the target type to obtain the file to be extracted.

A third aspect of the embodiments of the present application provides a computer device, including a processor, a memory, and an input and output interface;

The processor is connected to the memory and the input and output interface respectively, wherein the input and output interface is used for page interaction, the memory is used for storing program codes, and the processor is used for calling the program codes to execute the above method steps.

A fourth aspect of an embodiment of the present application provides a computer storage medium, which stores a computer program. The computer program includes program instructions. When the program instructions are executed by a processor, the above-mentioned method steps are executed.

In an embodiment of the present application, by obtaining the first header information of the firmware file, the first header information of the firmware file is matched with the first information mapping table to determine the target type of the firmware file. There is no need to scan all the information of the firmware file, which improves the speed of firmware parsing. At the same time, the corresponding target program file is called based on the target type to automatically parse the firmware file. There is no need to manually enter commands, which reduces the complexity of operations and improves the efficiency of firmware parsing.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a flow chart of a firmware parsing method provided in an embodiment of the present application;

FIG2 is a first information mapping table of a matching target type provided in an embodiment of the present application;

FIG3 is a flow chart of a firmware parsing method provided in an embodiment of the present application;

FIG4 is a second information mapping table of a matching target type provided in an embodiment of the present application;

FIG5 is a schematic diagram of the structure of a firmware parsing device provided in an embodiment of the present application;

FIG6 is a schematic diagram of the structure of a firmware parsing device provided in an embodiment of the present application;

FIG7 is a schematic diagram of the structure of a matching unit provided in an embodiment of the present application;

FIG8 is a schematic diagram of the structure of a target type determination unit provided in an embodiment of the present application;

FIG9 is a schematic diagram of the structure of a parsing unit provided in an embodiment of the present application;

FIG. 10 is a schematic diagram of the structure of a computer device provided in an embodiment of the present application.

Detailed ways

The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

The firmware parsing method and firmware parsing device provided in the embodiments of the present application can be applied to the scenario of parsing the firmware in the embedded system. The firmware is a program written in the memory that can directly control the hardware device, and is responsible for the lowest and most basic work in the embedded system and the Internet of Things device. The memory includes but is not limited to Flash, EPROM, EEPROM and other memories. The embedded system is a special-purpose computer system integrating software and hardware based on operating systems such as Windows and Linux. The firmware parsing device includes but is not limited to personal computers, laptops and other computer devices installed with operating systems.

The embodiment of the present application obtains the first header information of the firmware file and matches the first header information of the firmware file with the first information mapping table to determine the target type of the firmware file. There is no need to scan all the information of the firmware file, which improves the speed of firmware parsing. At the same time, the firmware file is automatically parsed by calling the corresponding target program file based on the target type. There is no need to manually enter commands, which reduces the complexity of operations and improves the efficiency of firmware parsing.

Please refer to Figure 1, which is a flowchart of a firmware parsing method provided in an embodiment of the present application. As shown in Figure 1, the method in the embodiment of the present application may include the following steps S101-S104.

S101, obtaining first header information of a firmware file;

Specifically, the first header information is obtained by scanning the file header of the firmware file. The file header is a piece of data at the beginning of the file. The first header information is the first few bytes of the firmware file, which contains an identifier and a feature code for identifying the file type. The embodiment of the present application obtains the first header information only by scanning the file header of the firmware file, without scanning all the information of the firmware file, thereby improving the speed of firmware parsing. Optionally, the firmware file can be downloaded from the official website of the firmware manufacturer, or obtained by reading the memory of the hardware device.

S102, matching the first header information with the first information mapping table to obtain a matching result;

Specifically, the first header information is matched with the file header bytes in the first information mapping table to obtain a matching result to determine the target type. The first information mapping table is used to match the header information of the firmware file to determine the target type of the firmware file. The target type is the MIME type. The MIME type is a mechanism for identifying the file type and content, which can ensure that the file is processed and identified in an expected manner in different network environments, platforms and operating systems. Please refer to Figure 2. The first information mapping table includes three columns: file header bytes, file extensions, and MIME types. The file extension is used to determine the type of the file, so as to know its format and purpose. There are many types of file extensions, such as: doc, jpeg, tar, zip, 7z, etc., but the file extension can be modified at will. The target type of the file can be identified by identifying the header bytes of the file. Taking the zip file as an example, the header bytes of the zip file are generally fixed 50 4B 03 04. Scan the first header information of the firmware file, and obtain the first header information as 50 4B 03 04, then it can be determined that the firmware file is a compressed file of the zip type, the file extension is zip, and the MIME type is application/zip.

S103, determining a target type of the firmware file based on the matching result;

Specifically, based on the matching result between the first header information and the first information mapping table, the MIME type of the firmware file is determined.

S104, based on the target type, calling the target program file to parse the firmware file to obtain a file to be extracted.

Specifically, based on the MIME type, the corresponding target program file is called to automatically parse the firmware file to obtain the file to be extracted, without manually entering the operation instructions, reducing the operational complexity of firmware parsing. The target program file is expressed in a plug-in architecture, specifically a decryption plug-in, a decompression plug-in and an extraction plug-in. The use of a plug-in architecture facilitates the development and maintenance of firmware parsing tools, and improves the flexibility and scalability of the development process. The firmware parsing tool is an application tool provided in the embodiment of the present application that can parse the firmware to obtain firmware information. The parsing process includes decryption processing and decompression processing. The file to be extracted is a file that can directly extract firmware information without decryption or decompression.

The embodiment of the present application obtains the first header information of the firmware file and matches the first header information of the firmware file with the first information mapping table to determine the target type of the firmware file. There is no need to scan all the information of the firmware file, which improves the speed of firmware parsing. At the same time, the firmware file is automatically parsed by calling the corresponding target program file based on the target type. There is no need to manually enter commands, which reduces the complexity of operation and improves the efficiency of firmware parsing. The plug-in parsing architecture is adopted to improve the flexibility and scalability of the development process and ensure the use effect of the firmware parsing tool.

Please refer to Figure 3, which is a flowchart of a firmware parsing method provided in an embodiment of the present application. As shown in Figure 3, the method in the embodiment of the present application may include the following steps S201-S209.

S201, obtaining first header information of a firmware file;

Specifically, the first header information is obtained by scanning the file header of the firmware file. The file header is a piece of data at the beginning of the file. The first header information is the first few bytes of the firmware file, which contains an identifier and a feature code for identifying the file type. The embodiment of the present application obtains the first header information only by scanning the file header of the firmware file, without scanning all the information of the firmware file, thereby improving the speed of firmware parsing. Optionally, the firmware file can be downloaded from the official website of the firmware manufacturer, or obtained by reading the memory of the hardware device.

S202, searching the first information mapping table for a target type corresponding to the header information that matches the first header information, and obtaining a matching result;

Specifically, the first header information is matched with the file header bytes in the first information mapping table to obtain a matching result to determine the target type. The first information mapping table is used to match the header information of the firmware file to determine the target type of the firmware file. The target type is the MIME type. The MIME type is a mechanism for identifying the file type and content, which can ensure that the file is processed and identified in an expected manner in different network environments, platforms and operating systems. Please refer to Figure 2. The first information mapping table includes three columns: file header bytes, file extensions, and MIME types. The file extension is used to determine the type of the file, so as to know its format and purpose. There are many types of file extensions, such as: doc, jpeg, tar, zip, 7z, etc., but the file extension can be modified at will. The target type of the file can be identified by identifying the header bytes of the file. Taking the zip file as an example, the header bytes of the zip file are generally fixed 50 4B 03 04. Scan the first header information of the firmware file, and obtain the first header information as 50 4B 03 04, then it can be determined that the firmware file is a compressed file of the zip type, the file extension is zip, and the MIME type is application/zip. If the match is successful, execute step S203; if the match is unsuccessful, execute step S204;

S203, if the match is successful, determining the target type of the firmware file based on the matching result;

Specifically, if the file header bytes identical to the first header information are matched in the first information mapping table, the match is successful, and the MIME type of the firmware file is determined based on the MIME type corresponding to the file header bytes.

S204, if the match is unsuccessful, scanning all the information of the firmware file to obtain a scanning result, and matching the file information of the firmware file with the second information mapping table based on the scanning result to determine the target type of the firmware file;

Specifically, if the file header byte identical to the first header information of the firmware file is not found in the first information mapping table, the match is unsuccessful. Linear scanning is performed on all the information of the firmware file to obtain a scanning result. The linear scanning is to scan from the first byte of the firmware file to the last byte. Based on the scanning result, the file information of the firmware file is matched with the second information mapping table. The second information mapping table is used to match the file information of the firmware file to determine the target type of the firmware file. The target type is the MIME type. The file information includes a file header and a file tail. The file tail is the end mark of the file. The file tail of some files also contains an identifier and a feature code for identifying the file type. Please refer to Figure 4. The second information mapping table includes four columns: file header byte, file tail byte, file extension, and MIME type. The file extension is used to determine the type of file, so as to know its format and purpose. There are many types of file extensions, such as: doc, jpeg, tar, zip, 7z, etc., but the file extension can be modified at will. The target type of the file can be identified by identifying the file header byte. The tail byte of some files is also fixed. Taking zip files as an example, the header bytes of zip files are generally fixed 50 4B 03 04, and the tail bytes are generally fixed 50 4B. Scan all the information of the firmware file. If the file header byte and the file tail byte of the firmware file match at least one of the file header byte and the tail byte in the second information mapping table, it can be determined that the firmware file is a compressed file of the zip type, the file extension is zip, and the MIME type is application/zip.

It is understandable that if the file header byte or file tail byte that is the same as the file information of the firmware file cannot be found in the second information mapping table, the firmware file is considered to be in a completely new format. The firmware file is manually analyzed, and the encryption algorithm or compression algorithm of the firmware file is obtained according to the firmware manufacturer, previous versions, etc., and the corresponding decryption algorithm and decompression algorithm are used for parsing and processing. At the same time, a MIME type is customized, and the detection rules for the MIME type of the firmware file are pre-set, and the MIME type and the file header byte that identifies the MIME type are added to the first information mapping table.

S205, based on the target type, calling the target program file to parse the firmware file to obtain the file to be extracted;

Specifically, based on the MIME type of the firmware file, the target program file corresponding to the MIME type is called for parsing and processing to obtain the file to be extracted, without manually entering the operation instructions, reducing the operational complexity of firmware parsing. The target program file is expressed in a plug-in architecture, specifically in the form of a decryption plug-in, a decompression plug-in, and an extraction plug-in. The use of a plug-in architecture facilitates the development and maintenance of firmware parsing tools, and improves the flexibility and scalability of the development process. The firmware parsing tool is an application tool provided in the embodiment of the present application that can parse the firmware to obtain firmware information. The parsing process includes decryption processing and decompression processing. The file to be extracted is a file that can directly extract firmware information without decryption or decompression.

It is understandable that if the firmware file is an encrypted file, the decryption plug-in corresponding to the MIME type of the firmware file is called to decrypt the firmware file to obtain the decrypted firmware file. The decryption process is based on the automatic decryption process. The automatic decryption process is to first pre-extract the encrypted information and determine whether the encrypted information meets the preset rules. The encrypted information is information such as the firmware manufacturer, encryption logic, encryption algorithm, etc. If it meets the requirements, the corresponding decryption algorithm is used for decryption. After the decryption is completed, the identification features of the firmware are summarized and added to the decryption process, so that the next decryption can directly determine the encryption information of the firmware file based on the identification features. The identification features include but are not limited to the firmware manufacturer, file header, byte sequence and other features. After the decryption is completed, the decompression plug-in is called to decompress the decrypted firmware file to obtain the file to be extracted.

If the firmware file is not an encrypted file, the decompression plug-in is directly called to decompress the firmware file to obtain the file to be extracted. The specific process of the decompression process is to identify the compression algorithm of the firmware file based on the MIME type and use the corresponding decompression algorithm to decompress it. It is understandable that some compression algorithms may be customized by the manufacturer. For such compression algorithms, even if the compression algorithm type is identified, the offset position of the compressed data cannot be accurately located. Therefore, the decompression process also includes a customized decompression algorithm. After the customized decompression algorithm is identified, different offset positions are taken to try to decompress the header information of the firmware file, and then the compression algorithm customized by the manufacturer is identified to complete the decompression process.

It can be understood that for firmware files with nested file compression, the nested file compression is to decompress multiple new compressed files from the firmware file, and the embodiment of the present application decompresses the firmware file through a cyclic iterative decompression algorithm. The cyclic iterative decompression algorithm means that after decompressing the firmware file, the file generated by the decompression is used as input, and scanning and recognition are continued. Based on the results of the scanning and recognition, it is determined whether there is a compressed file. If so, the corresponding decompression is performed according to the scanning and recognition results, and the file generated by the decompression is continued as input. The cyclic iterative algorithm of the embodiment of the present application is to call a decompression plug-in to decompress the firmware file to obtain a file to be parsed, obtain the second header information by scanning the file header of the file to be parsed, search the MIME type corresponding to the header information matching the second header information from the first information mapping table, obtain a matching result, and determine the MIME type of the file to be parsed based on the matching result. In response to the MIME type, if the file to be parsed is not a compressed file, the file to be parsed is used as a file to be extracted; if the file to be parsed is a compressed file, the corresponding decompression plug-in is called to decompress the file to be parsed to obtain the next file to be parsed, and the file to be parsed is used as input for scanning and identification, and whether to perform decompression is determined based on the result of the scanning and identification, until the file to be extracted is obtained.

S206, saving the to-be-extracted file into a to-be-extracted file set;

Specifically, the to-be-extracted files obtained by each decompression are saved in a to-be-extracted file set, and the to-be-extracted file set may be a folder.

S207: Call a corresponding extraction program based on the target type to extract firmware information from the files to be extracted in the set of files to be extracted.

Specifically, each MIME type has a corresponding extraction plug-in. The extraction plug-in corresponding to the file to be extracted is called based on the MIME type to extract firmware information from the file to be extracted. The firmware information includes but is not limited to the file system, function library, cross-compiler version, etc.

The embodiment of the present application obtains the first header information of the firmware file and matches the first header information of the firmware file with the first information mapping table to determine the target type of the firmware file. There is no need to scan all the information of the firmware file, which improves the speed of firmware parsing. At the same time, the firmware file is automatically parsed by calling the corresponding target program file based on the target type. There is no need to manually enter commands, which reduces the complexity of operations and improves the efficiency of firmware parsing. The automatic decryption process in the decryption process and the cyclic iterative decompression algorithm in the decompression process realize the parsing and processing of firmware from different sources and different structures. The plug-in parsing architecture is adopted to improve the flexibility and scalability of the development process and ensure the use effect of the firmware parsing tool.

The firmware parsing device provided in the embodiment of the present application will be described in detail below in conjunction with Figures 5 to 8. It should be noted that the firmware parsing device in Figures 5 to 8 is used to execute the method of the embodiment shown in Figures 1 and 3 of the present application. For the convenience of explanation, only the part related to the embodiment of the present application is shown. For the specific technical details not disclosed, please refer to the embodiment shown in Figures 1 and 3 of the present application.

Please refer to Fig. 5, which is a schematic diagram of the structure of a firmware parsing device according to an embodiment of the present application. As shown in Fig. 5, the firmware parsing device 1 according to the embodiment of the present application may include: a header information acquisition unit 11, a matching unit 12, a target type determination unit 13 and a parsing unit 14.

The header information acquisition unit 11 is used to acquire the first header information of the firmware file;

A matching unit 12, configured to match the first header information with a first information mapping table to obtain a matching result, wherein the first information mapping table is used to match the header information of the firmware file to determine a target type of the firmware file;

A target type determination unit 13, configured to determine a target type of the firmware file based on the matching result;

The parsing unit 14 is used to call the target program file to parse the firmware file based on the target type to obtain the file to be extracted.

The embodiment of the present application obtains the first header information of the firmware file and matches the first header information of the firmware file with the first information mapping table to determine the target type of the firmware file. There is no need to scan all the information of the firmware file, which improves the speed of firmware parsing. At the same time, the firmware file is automatically parsed by calling the corresponding target program file based on the target type. There is no need to manually enter commands, which reduces the complexity of operation and improves the efficiency of firmware parsing. The plug-in parsing architecture is adopted to improve the flexibility and scalability of the development process and ensure the use effect of the firmware parsing tool.

Please refer to Figure 6, which is a schematic diagram of the structure of a firmware parsing device according to an embodiment of the present application. As shown in Figure 6, the firmware parsing device 1 according to the embodiment of the present application may include: a header information acquisition unit 11, a matching unit 12, a target type determination unit 13, a parsing unit 14, a file storage unit 15, and an information extraction unit 16.

The header information acquisition unit 11 is used to acquire the first header information of the firmware file;

A matching unit 12, configured to match the first header information with a first information mapping table to obtain a matching result, wherein the first information mapping table is used to match the header information of the firmware file to determine a target type of the firmware file;

Specifically, please refer to FIG. 7 , which is a schematic diagram of a matching unit structure provided in an embodiment of the present application. As shown in FIG. 7 , the matching unit 12 may include:

The target type search subunit 121 is used to search the first information mapping table for a target type corresponding to the header information that matches the first header information, and obtain a matching result.

A target type determination unit 13, configured to determine a target type of the firmware file based on the matching result;

Specifically, please refer to FIG8 , which is a schematic diagram of the structure of a target type determination unit according to an embodiment of the present application. As shown in FIG8 , the target type determination unit 13 may include:

A matching success subunit 131, configured to determine the target type of the firmware file based on the matching result if the matching is successful;

The match failure subunit 132 is used to scan and process all the information of the firmware file to obtain a scan result if the match is unsuccessful, and based on the scan result, match the file information of the firmware file with a second information mapping table to determine the target type of the firmware file, and the second information mapping table is used to match the file information of the firmware file to determine the target type of the firmware file.

The parsing unit 14 is used to call the target program file to parse the firmware file based on the target type to obtain a file to be extracted;

Specifically, please refer to FIG9 , which is a schematic diagram of the structure of a parsing unit provided in an embodiment of the present application. As shown in FIG9 , the parsing unit 14 may include:

The encrypted file parsing subunit 141 is used for, if the firmware file is an encrypted file, calling a corresponding decryption program to decrypt the firmware file to obtain a decrypted firmware file, and calling a decompression program to decompress the firmware file to obtain a file to be extracted;

The non-encrypted file parsing subunit 142 is used to call a decompression program to decompress the firmware file if the firmware file is not an encrypted file, so as to obtain a file to be extracted.

A to-be-extracted file storage unit 15, used for storing the to-be-extracted file in a to-be-extracted file set;

The information extraction unit 16 is used to call a corresponding extraction program based on the target type to extract firmware information from the files to be extracted in the set of files to be extracted.

The embodiment of the present application obtains the first header information of the firmware file and matches the first header information of the firmware file with the first information mapping table to determine the target type of the firmware file. There is no need to scan all the information of the firmware file, which improves the speed of firmware parsing. At the same time, the firmware file is automatically parsed by calling the corresponding target program file based on the target type. There is no need to manually enter commands, which reduces the complexity of operations and improves the efficiency of firmware parsing. The automatic decryption process in the decryption process and the cyclic iterative decompression algorithm in the decompression process realize the parsing and processing of firmware from different sources and different structures. The plug-in parsing architecture is adopted to improve the flexibility and scalability of the development process and ensure the use effect of the firmware parsing tool.

Please refer to Figure 10, which provides a structural diagram of a computer device for an embodiment of the present application. As shown in Figure 10, the computer device 1000 may include: at least one processor 1001, such as a CPU, at least one network interface 1004, an input and output interface 1003, a memory 1005, and at least one communication bus 1002. Among them, the communication bus 1002 is used to realize the connection communication between these components. Among them, the network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk memory. The memory 1005 may also be at least one storage device located away from the aforementioned processor 1001. As shown in Figure 10, the memory 1005 as a computer storage medium may include an operating system, a network communication module, an input and output interface module, and a connection establishment application.

In one embodiment, the processor 1001 may be used to call a connection establishment application stored in the memory 1005, and specifically perform the following operations:

Get the first header information of the firmware file;

Matching the first header information with a first information mapping table to obtain a matching result, wherein the first information mapping table is used to match the header information of the firmware file to determine the target type of the firmware file;

Based on the matching result, determining a target type of the firmware file;

Based on the target type, the target program file is called to parse the firmware file to obtain a file to be extracted.

Optionally, when the processor 1001 matches the first header information with a first information mapping table to obtain a matching result, and the first information mapping table is used to match the header information of the firmware file to determine the target type of the firmware file, the processor 1001 specifically performs the following operations:

The target type corresponding to the header information matching the first header information is searched in the first information mapping table to obtain a matching result.

Optionally, when the processor 1001 determines the target type of the firmware file based on the matching result, the processor 1001 specifically performs the following operations:

If the match is successful, determining the target type of the firmware file based on the matching result;

If the match is unsuccessful, all the information of the firmware file is scanned and processed to obtain a scan result. Based on the scan result, the file information of the firmware file is matched with a second information mapping table to determine the target type of the firmware file. The second information mapping table is used to match the file information of the firmware file to determine the target type of the firmware file.

Optionally, when the processor 1001 executes the parsing process of the firmware file by calling the target program file based on the target type to obtain the file to be extracted, the following operations are specifically performed:

If the firmware file is an encrypted file, calling a corresponding decryption program to decrypt the firmware file to obtain a decrypted firmware file, and calling a decompression program to decompress the firmware file to obtain a file to be extracted;

If the firmware file is not an encrypted file, a decompression program is called to decompress the firmware file to obtain a file to be extracted.

Optionally, after the processor 1001 executes the parsing process of the firmware file by calling the target program file based on the target type and obtains the file to be extracted, the processor 1001 further performs the following operations:

Saving the to-be-extracted file into a to-be-extracted file set;

A corresponding extraction program is called based on the target type to extract firmware information from the files to be extracted in the set of files to be extracted.

The embodiment of the present application obtains the first header information of the firmware file and matches the first header information of the firmware file with the first information mapping table to determine the target type of the firmware file. There is no need to scan all the information of the firmware file, which improves the speed of firmware parsing. At the same time, the firmware file is automatically parsed by calling the corresponding target program file based on the target type. There is no need to manually enter commands, which reduces the complexity of operations and improves the efficiency of firmware parsing. The automatic decryption process in the decryption process and the cyclic iterative decompression algorithm in the decompression process realize the parsing and processing of firmware from different sources and different structures. The plug-in parsing architecture is adopted to improve the flexibility and scalability of the development process and ensure the use effect of the firmware parsing tool.

An embodiment of the present application also provides a computer storage medium, which can store multiple program instructions. The program instructions are suitable for being loaded by a processor and executing the method steps of the embodiments shown in Figures 1 and 3 above. The specific execution process can be found in the specific description of the embodiments shown in Figures 1 and 3, and will not be repeated here.

Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims (10)

1. A firmware analysis method, comprising: Get the first header information of the firmware file; Matching the first header information with a first information mapping table to obtain a matching result, wherein the first information mapping table is used to match the first header information of the firmware file to determine a target type of the firmware file; Based on the matching result, determining a target type of the firmware file; Based on the target type, the target program file is called to parse the firmware file to obtain a file to be extracted. 2. The method according to claim 1, wherein determining the target type of the firmware file based on the matching result comprises: If the match is successful, determining the target type of the firmware file based on the matching result; If the match is unsuccessful, all the information of the firmware file is scanned and processed to obtain a scan result. Based on the scan result, the file information of the firmware file is matched with a second information mapping table to determine the target type of the firmware file. The second information mapping table is used to match the file information of the firmware file to determine the target type of the firmware file. 3. The method according to claim 1, characterized in that the step of calling the target program file to parse the firmware file based on the target type to obtain the file to be extracted comprises: If the firmware file is an encrypted file, calling a corresponding decryption program to decrypt the firmware file to obtain a decrypted firmware file, and calling a decompression program to decompress the firmware file to obtain a file to be extracted; If the firmware file is not an encrypted file, a decompression program is called to decompress the firmware file to obtain a file to be extracted. 4. The method according to claim 3, characterized in that if the firmware file is an encrypted file, calling a corresponding decryption program to perform decryption processing to obtain a decrypted firmware file comprises: If the firmware file is an encrypted file, determining the encryption algorithm of the firmware file based on an automatic decryption process; The firmware file is decrypted using a corresponding decryption algorithm according to the encryption algorithm. 5. The method according to claim 3, characterized in that the calling of a decompression program to decompress the firmware file to obtain the file to be extracted comprises: Calling a decompression program to decompress the firmware file to obtain a file to be parsed; Acquire second header information of the file to be parsed, and match the second header information with the first information mapping table to obtain a matching result; Based on the matching result, determining the target type of the file to be parsed; In response to the target type, if the file to be parsed is not a compressed file, treating the file to be parsed as a file to be extracted; If the file to be parsed is a compressed file, a decompression program is called to decompress the compressed file to obtain the file to be parsed, and the step of obtaining the second header information of the file to be parsed is performed until the file to be extracted is obtained. 6. The method according to claim 5, characterized in that the calling of a decompression program to decompress the firmware file to obtain the file to be parsed comprises: Based on the target type identification compression algorithm, the firmware file is decompressed using a corresponding decompression algorithm to obtain a file to be parsed. 7. The method according to claim 1, characterized in that the method further comprises: Saving the to-be-extracted file into a to-be-extracted file set; A corresponding extraction program is called based on the target type to extract firmware information from the files to be extracted in the set of files to be extracted. 8. A firmware analysis device, comprising: A header information acquisition unit, used to acquire first header information of the firmware file; a matching unit, configured to match the first header information with a first information mapping table to obtain a matching result, wherein the first information mapping table is used to match the header information of the firmware file to determine a target type of the firmware file; a target type determining unit, configured to determine a target type of the firmware file based on the matching result; The parsing unit is used to call the target program file to parse the firmware file based on the target type to obtain the file to be extracted. 9. A computer device, characterized in that it comprises a processor, a memory, and an input and output interface; The processor is connected to the memory and the input/output interface respectively, wherein the input/output interface is used for page interaction, the memory is used for storing program code, and the processor is used for calling the program code to execute the method according to any one of claims 1-7. 10. A computer storage medium, characterized in that the computer storage medium stores a computer program, wherein the computer program comprises program instructions, and when the program instructions are executed by a processor, the method according to any one of claims 1 to 7 is executed.