Electronic Evidence

Size: px

Start display at page:

Download "Electronic Evidence"

岩韩
5 years ago
Views:

1 Android 深度取证基于原生闪存和 YAFFS2 文件系统的信息获取和分析 Bradley Schatz 博士 Schatz Forensic 公司总监兼任助理教授, 昆士兰科技大学 SyScan360 北京

2 背景

3 NAND 闪存普遍应用于移动和嵌入式设备移动电话记录着 : 他们在通话中说了什么他们同何人通话他们在哪里说的这些他们搜索了什么 ( 他们关注什么 ) 他们到访何地他们在何时充电 2013 Schatz Forensic

4 建立可靠证据的主要挑战获取完整的数据设备和操作系统差异数据转换成可用的证据设备和操作系统差异工具厂商不够科学严谨透明和独立可重复性至今仍达不到 2013 Schatz Forensic

5 Android 领域异构化引导器 : Redboot, HTC HBoot, Samsung 文件系统 : YAFFS2, Samsung RFS, EXT4 FTL: Integrated, MTD, Samsung XSR 内存设备 : Raw NAND flash (xn footprint), emmc 2013 Schatz Forensic

6 操作原理

7 Android 存储架构 Linux 内核 VFS YAFFS2 MTD MTD Device Specific Driver FAT Block Subsystem mmc driver Flash Controller NAND MMC Card 2013 Schatz Forensic

8 闪存除了保存实际数据还要存储元数据 Source: Samsung KA100O015E-BJT rev 1.0 Datasheet

9 元数据和数据在每个内存页中存储位置不同 Source: Micron TN Flash 101

10 一次内存清除操作包含多个内存页 Erase block = 64 pages 2013 Schatz Forensic

11 内存页必须串行写入被清除的区块 Page written before those to left 2013 Schatz Forensic

12 内存页只能被重复擦除写入固定次数 Linux Kernel VFS Wear Levelling YAFFS2 MTD MTD Device Specific Driver FAT Block Subsystem mmc driver Flash Controller NAND MMC Card 2013 Schatz Forensic

13 会有比特错误 Linux Kernel VFS Wear Levelling YAFFS2 MTD MTD Device Specific Driver FAT Block Subsystem mmc driver Error Correction (EEC) Flash Controller NAND MMC Card 2013 Schatz Forensic

14 MMC 整合闪存控制器和 NAND Linux Kernel VFS Wear Levelling YAFFS2 MTD FAT Block Subsystem MTD Device Specific Driver mmc driver Error Correction (EEC) Flash Controller NAND MMC Card Flash Translation Layer 2013 Schatz Forensic

15 YAFFS2 在空闲区域存储元数据 Spare (64 bytes) User Data (2048 bytes) EEC (Handled by MTD or Flash Controller) Packed Tags uint sequence uint objectid uint chunkid uint/ushort nbytes 2013 Schatz Forensic

16 YAFFS2 基础 : 文件写入 Object Header Data block 1 Data block 2 Object Header ChunkID = 0 ChunkID = 1 ChunkID = 2 ChunkID = 0 File Name = a Address = 0x0 Address = 2048 File Name = a Sequence = 0x1001 Sequence = 0x1001 Sequence = 0x1001 Sequence = 0x1001 Size = 0 Size = Schatz Forensic

17 2013 Schatz Forensic 提取数据

18 数据提取原则完整性准确性可重复性完整性 2013 Schatz Forensic

19 获取方法用 adb 进行文件复制伪物理方式 : 获得根用户, 复制 NAND 区块设备引导器物理方式 1: JTAG 访问闪存物理方式 2: 取下芯片 2013 Schatz Forensic

20 逻辑方法打开 ADB 连接并复制 - 受限的文件访问 - 历史版本文件无法访问 - 基于对内核的信任 2013 Schatz Forensic

21 引导器模式关掉引导器安全保护机制内存加载定制的启动镜像使用 Live 内存盘转储 - 清除大部分 ( 不是全部 ) 设备 - 范围有限 - 维护 live 内存盘 See: Cannon (2012) Into the Driod, Blackhat See: Vidas (2011) Toward a general collection methodology for Android devices, DFRWS 2013 Schatz Forensic

22 伪物理模式 (nanddump) 需要手机解锁需要设备的 Root 权限做这些可利用的范围 - 利用确认 - Perception management 用 nanddump 转储 MTD 设备 - MTD 并不准确 - 没有闪存设备的全部权限 - 基于对手机内核的信任 2013 Schatz Forensic

23 伪物理模式 : 利用 <3>[ ] init: untracked pid 3882 exited <3>[ ] init: untracked pid 3883 exited <3>[ ] init: untracked pid 3884 exited <3>[ ] init: untracked pid 3885 exited <3>[ ] init: untracked pid 630 exited <6>[ ] [HTC_BATT]RSNSP=67,RARC=6,Vol=3781mV,Current=299mA,Temp=288C(1/10) <6>[ ] batt: ds2784_notify: 1 6 at ( :14: UTC) <6>[ ] batt: batt:power_supply_changed: battery at ( :14: UTC) <6>[ ] [HTC_BATT]RSNSP=67,RARC=6,Vol=3781mV,Current=301mA,Temp=288C(1/10) <6>[ ] [HTC_BATT]RSNSP=67,RARC=7,Vol=3781mV,Current=301mA,Temp=288C(1/10) <6>[ ] batt: ds2784_notify: 1 7 at ( :16: UTC) <6>[ ] batt: batt:power_supply_changed: battery at ( :16: UTC) <6>[ ] [HTC_BATT]RSNSP=67,RARC=7,Vol=3781mV,Current=301mA,Temp=290C(1/10) # cat /pro opc c/mtd dev: size erasesize name mtd0: 000a "misc" mtd1: "recovery" mtd2: "boot" mtd3: 0fa "system" mtd4: "cache" mtd5: 093a "userdata" 2013 Schatz Forensic

24 伪物理模式 : 获取 I/O 通道 # cat / mount rootfs / rootfs ro 0 0 tmpfs /dev tmpfs rw,mode= devpts /dev/pts devpts rw,mode= proc /proc proc rw 0 0 sysfs /sys sysfs rw 0 0 tmpfs /sqlite_stmt_journals tmpfs rw,size=4096k 0 0 none /dev/cpuctl cgroup rw,cpu 0 0 /dev/block/mtdblock3 /system yaffs2 ro 0 0 /dev/block/mtdblock5 /data yaffs2 rw,nosuid,nodev 0 0 /dev/block/mtdblock4 /cache yaffs2 rw,nosuid,nodev 0 0 tmpfs /app-cache tmpfs rw,size=8192k 0 0 /dev/block//vold/179:1 /sdcard vfat rw,dirsync,nosuid,nodev,noexec,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0 # mount -o exec,remount /dev/block//vold/179:1 /sdcard # cd /s sdcaard rd # chmod 755 nanddump # ls -l d---rwxr-x system sdcard_rw :01 LOST.DIR ----r-xr-x system sdcard_rw :47 nanddump 2013 Schatz Forensic

25 伪物理模式 : 提取 # ls /dev -l /dev/md td/ crw root root 90, :02 mtd5ro crw root root 90, :02 mtd5 crw root root 90, :02 mtd4ro crw root root 90, :02 mtd4 crw root root 90, :02 mtd3ro crw root root 90, :02 mtd3 crw root root 90, :02 mtd2ro crw root root 90, :02 mtd2 crw root root 90, :02 mtd1ro crw root root 90, :02 mtd1 crw root root 90, :02 mtd0ro cr--rw---- radio diag 90, :02 mtd0 #./nanddump --bb=dumpbad -o -f./mtd0.nanddump /dev/mtd/mtd0 ECC failed: 0 ECC corrected: 0 Number of bad blocks: 0 This doesn t match our theory of operation Number of bbt blocks: 0 Block size , page size 2048, OOB size 56 Dumping data starting at 0x and ending at 0x000a Schatz Forensic

26 2013 Schatz Forensic JTAG 提取 : 手机拆解

27 JTAG 提取 : 确定 JTAG 位置 Source: RIFF Box JTAG Manager

28 2013 Schatz Forensic JTAG 提取 : 连接 Jig 和电源线

29 2013 Schatz Forensic JTAG 提取 : 连接到 JTAG 适配器

30 JTAG 提取 : 转储闪存 Dismantle phone Find JTAG pins (usually done by grey market) Attach JIG/Solder wires to JTAG adapter Dump flash with software! Grey market hardware/software! Finicky + Complete acquisition + No kernel involvement 2013 Schatz Forensic

31 JTAG 提取! 灰色硬件市场 / 软件! 过分讲究, 难度较大 + 完全提取 + 不涉及内核 2013 Schatz Forensic

32 卸载芯片提取又一次拆解手机找到闪存确定焊料熔点无铅检测试剂盒卸载闪存卡普顿胶带热电偶温度监控受控的芯片温度 (BGA 红外返修或热空气 ) 2013 Schatz Forensic

33 Source: Samsung KA100O015E-BJT rev 1.0 Datasheet

34 2013 Schatz Forensic 卸载芯片提取 : 闪存芯片卸载以后

35 卸载芯片提取芯片清洁去除多余的焊料去除多余的 BGA 底部填充使用异丙醇去清除焊球再成型用聚酰亚胺胶带芯片到底部模版黏贴焊料用热空气融掉焊料 2013 Schatz Forensic

36 卸载芯片的提取 : 模版和芯片的焊球再成型 2013 Schatz Forensic

37 卸载芯片提取获取芯片特定轨迹的适配器芯片大小种类很多获取芯片内容全能的程序员完全靠自己来做 2013 Schatz Forensic

38 卸载芯片提取? 闪存内容的热效应? 湿气 + 热效应! 难度还是很大! 工具昂贵 2013 Schatz Forensic

39 闪存卷的分析

40 解释方法 1. 确定闪存镜像格式 2. 确定分区布局 3. Yaffs2: I 确定 tags 布局字节图 [1] 作为一个直感增强的工具 4. 解释 YAFFS 结构 [1] Conti et al (2010) Automated mapping of large binary objects using primitive fragment type classification 2013 Schatz Forensic

41 字节绘图工具源镜像中德每个字节 = 一个灰色范围的值 [1] 组织 : 用视觉来将空闲区域和用户数据区域分开多列 ( 自上向下填充, 然后向右 ) [1] Conti et al (2010) Automated mapping of large binary objects using primitive fragment type classification 2013 Schatz Forensic

42 确定闪存镜像的格式 : 内联的空闲 vs 尾部空闲 2012 Schatz Forensic JTAG acquisition w/ spare at end JTAG image normalised to inline spare

43 Source: 2011 Schatz Forensic 空闲区域和用户数据之间的清晰的区分

44 空闲区域和用户数据之间的清晰的区分 EEC Source: 2011 Schatz Forensic

45 Source: 2011 Schatz Forensic 分区布局的识别

46 在内核 dmesg 时观察闪存分区是最直接的 <6>[ ] msm_nand: allocated dma buffer at ffa01000, dma_addr 3b1ac000 <6>[ ] msm_nand: read CFG0 = aa5400c0 CFG1 = 6746e <6>[ ] msm_nand: CFG0 cw/page=3 ud_sz=512 ecc_sz=10 spare_sz=4 <6>[ ] msm_nand: NAND_READ_ID = 5500bcec <6>[ ] msn_nand: nandid 5500bcec status c03120 <6>[ ] msm_nand: manuf Samsung (0xec) device 0xbc blocksz pagesz 800 size <6>[ ] msm_nand: save CFG0 = e85408c0 CFG1 = 4745e <6>[ ] msm_nand: CFG0: cw/page=3 ud_sz=516 ecc_sz=10 spare_sz=0 num_addr_cycles=5 <6>[ ] msm_nand: DEV_CMD1: f00f3000 <6>[ ] msm_nand: NAND_EBI2_ECC_BUF_CFG: 1ff <5>[ ] Creating 6 MTD partitions on "msm_nand": <5>[ ] 0x00001ff x : "misc" <5>[ ] 0x x : "recovery" <5>[ ] 0x x c0000 : "boot" <5>[ ] 0x c0000-0x c0000 : "system" <5>[ ] 0x c0000-0x000016bc0000 : "cache" <5>[ ] 0x000016bc0000-0x00001ff60000 : "userdata"

47 /proc/mtd 不会给出顺序 ( 分区可能是乱序的 ) # cat /pro opc c/mtd dev: size erasesize name mtd0: 000a "misc" mtd1: "recovery" mtd2: "boot" mtd3: 0fa "system" mtd4: "cache" mtd5: 093a "userdata"

48 YAFFS2 卷可以用对象头部条纹来区分 JTAG dump of HTC Desire

49 YAFFS2 文件 ( 对象 ) 元数据在用户数据区域中存储 User Data (2048 bytes) struct ObjectHeader { int type; Uint parentobjectid; Short sum NoLongerUsed; char[256] name; //nullterminated short reserved; uint long yst_mode; uint uid; int yst_gid; Packed Tags uint sequence uint } objectid uint chunkid uint/ushort nbytes 2012 Schatz Forensic

YAFFS2 文件 ( 对象 ) 元数据在用户数据区域中存储 User Data (2048 bytes) Offset 0x200 to user data end == 0xFF * struct ObjectHeader { int type; Uint parentobjectid; Short sum NoLongerUsed; char[256] name;

50 YAFFS2 文件 ( 对象 ) 元数据在用户数据区域中存储 User Data (2048 bytes) Offset 0x200 to user data end == 0xFF * struct ObjectHeader { int type; Uint parentobjectid; Short sum NoLongerUsed; char[256] name; //nullterminated short reserved; uint long yst_mode; uint uid; int yst_gid; Packed Tags uint sequence uint } objectid uint chunkid uint/ushort nbytes * Carving criteria identified by Pooters (2011) Yaffs2 Object Headers DFRWS 2013 Schatz Forensic

51 对象头部条纹的解释 Object Type, Metadata Name (null termination is black) Offset 0x200 to user data end == 0xFF (white) 2012 Schatz Forensic

52 理论说明压缩的标记和 ECC 应当在空闲区域 2012 Schatz Forensic

53 目前压缩的标记位置和布局是冲突的结果 Source: Quick & Alzabbi (2011) Forensic analysis of the Android File System YAFFS2 Source: Bang et al (2011) DFRWS 2011 Forensic Challenge

54 YAFFS2 基础 : 简单文件写入 Object Header Data block 1 Data block 2 Object Header ChunkID = 0 ChunkID = 1 ChunkID = 2 ChunkID = 0 File Name = a Address = 0x0 Address = 2048 File Name = a Sequence = 0x1001 Sequence = 0x1001 Sequence = 0x1001 Sequence = 0x1001 Size = 0 Size = Schatz Forensic

55 文件块标识符 ChunkID 在连续写入的大文件是可以区分的 EEC ChunkId (incrementally brightening line downwards) Source: 2012 Schatz Forensic

56 在被清除的块中序号是恒定的 Constant lines for blocksize length Source: 2012 Schatz Forensic

57 56 个字节的空闲空间和我们目前的物理闪存理论似乎不一致 y #./nanddump --bb=dumpbad -o -f./mtd0.nanddump /dev/mtd/mtd0 ECC failed: 0 ECC corrected: 0? Number of bad blocks: 0 Number of bbt blocks: 0 Block size , page size 2048, OOB size 56 Dumping data starting at 0x and ending at 0x000a

58 为何对象头部填充到了用户数据区域? 2012 Schatz Forensic Chip off dump of KA100O015M-AJTT

59 这些竖线是怎么回事?? 2012 Schatz Forensic

60 EEC ( 注意这里熵值很高 ) 在用户数据区域吗?? 2012 Schatz Forensic

61 闪存控制器是个潜在的问题 Linux Kernel VFS Flash controller virtualises the view of the page YAFFS2 MTD MTD Device Specific Driver FAT mmc driver Flash Controller NAND MMC Card 2012 Schatz Forensic

62 为何对象头部填充到了用户数据区域 Schatz Forensic

63 为何对象头部填充到了用户数据区域 Schatz Forensic

64 列重定位 Vertical line was here 2012 Schatz Forensic

65 列重定位 Vertical lines now here 2012 Schatz Forensic

66 列重定位 EEC Was Here 2012 Schatz Forensic

67 列重定位 EEC Now Here 2012 Schatz Forensic

68 列重定位 Everything else is shifted left 2012 Schatz Forensic

69 YAFFS2 文件系统分析

70 目前 YAFFS2 的免费实现还难以兼容物理镜像即使是伪物理的镜像得到的结果也很不稳定不支持历史对象版本的保存 2012 Schatz Forensic

71 YAFFS2 文件建立分配的空间稀疏分布 Object Header Object Header Object Header Object Header ChunkID = 0 ChunkID = 0 ChunkID = 0 ChunkID = 0 Sequence = 0x1001 Sequence = 0x1001 Sequence = 0x1001 Sequence = 0x1001 File Name = a File Name = a File Name = a File Name = a Size = 0 Size = 0 *sparse* Size = 0x1000 Size = 0x Schatz Forensic

72 YAFFS2 块置换 Object Header Data block 2 Data block 2 Object Header ChunkID = 0 ChunkID = 1 ChunkID = 1 ChunkID = 0 Sequence = 0x1001 Address = 0x0 Address = 0x0 Sequence = 0x1002 File Name = a Sequence = 0x1001 Sequence = 0x1002 File Name = a Size = 0 Expired New data block Size = Schatz Forensic

73 YAFFS2 版本恢复 Newest version: sequence 0x1002 and lower Object Header Data block 2 Data block 2 Object Header ChunkID = 0 ChunkID = 1 ChunkID = 1 ChunkID = 0 Sequence = 0x1001 Address = 0x0 Address = 0x0 Sequence = 0x1002 File Name = a Sequence = 0x1001 Sequence = 0x1002 File Name = a Size = 0 Expired New data block Size = Schatz Forensic

YAFFS2 版本恢复 Newest version: sequence 0x1001 and lower Newest version: sequence 0x1002 and lower Object Header Data block 2 Data block 2 Object Header ChunkID = 0 ChunkID = 1 ChunkID = 1 ChunkID

74 YAFFS2 版本恢复 Newest version: sequence 0x1001 and lower Newest version: sequence 0x1002 and lower Object Header Data block 2 Data block 2 Object Header ChunkID = 0 ChunkID = 1 ChunkID = 1 ChunkID = 0 Sequence = 0x1001 Address = 0x0 Address = 0x0 Sequence = 0x1002 File Name = a Sequence = 0x1001 Sequence = 0x1002 File Name = a Size = 0 Expired New data block Size = Schatz Forensic

75 提取方法

76 提取方法 JTAG or RAM 引导器提取恢复 PIN 在线提取必要的时候使用 PIN 关掉无线电打开 ADB 侵入 ( 是否验证通过了?) 收集 dmesg, /proc/mtd 的信息伪物理模式进行提取逻辑方式提取 ( 作为验证 ) 2012 Schatz Forensic

77 结论

78 贡献字节图有助于确定原始字节序列的结构部分解决了过于研究工作中存在的不一致性问题图形元素与识别出的结构元素相对应提出了一个通用取证方法有助于进行 JTAG 分析 2012 Schatz Forensic

79 未来工作分区自动规范化热效应对 NAND 完整性产生的影响如何用 JTAG 进行动态内存分析? emmc 2012 Schatz Forensic

80 致谢 Andrew Hoog and co (Viaforensics) 在该领域较早开始并持续到现在的研究 Tim Vidas 用于测试 YAFFS2 的虚拟机 DFRWS 为促进研究工作提出问题 2012 Schatz Forensic

81 Bradley Schatz 博士计算机取证专家 Schatz Forensic 公司总监兼任助理教授, QUT web: Hard drive x-ray image by Jeff Kubina

1

SDT Uclinux SDT.alf.c 44blib.alf 44blib.c jtag ADS.alf.c make menuconfig make dep make clean make lib_only make user_only make romfs make image make uclinux ext2 cash lcd frambuffer 1 armsys-c uclinux