I-Cruise, inkampani egxile kubuchwepheshe bokushayela okuzenzakalelayo, amakhodi omthombo wephrojekthi , ehlinzeka ngamathuluzi okuhlaziya izithombe ze-firmware ezisekelwe ku-Linux nokuhlonza ubungozi obungaba khona kanye nokuvuza kwedatha kuzo. Ikhodi ibhalwe ngolimi lwe-Go futhi ilayisensi ngaphansi kwe-Apache 2.0.
Isekela ukuhlaziywa kwezithombe kusetshenziswa i-ext2/3/4, FAT/VFat, SquashFS kanye nezinhlelo zefayela le-UBIFS. Ukuze uvule isithombe, kusetshenziswa izinsiza ezijwayelekile, njenge-e2tools, mtools, squashfs-tools kanye ne-ubi_reader. I-FwAnalyzer ikhipha isihlahla somkhombandlela esithombeni bese ihlola okuqukethwe ngokusekelwe kusethi yemithetho. Imithetho ingaboshelwa kumethadatha yesistimu yefayela, uhlobo lwefayela, nokuqukethwe. Okukhiphayo kuwumbiko ngefomethi ye-JSON, efinyeza ulwazi olukhishwe ku-firmware nokubonisa izexwayiso kanye nohlu lwamafayela angahambisani nemithetho ecutshunguliwe.
Isekela ukuhlola amalungelo okufinyelela kumafayela nezinkomba (isibonelo, ithola ukufinyelela kokubhala kwawo wonke umuntu futhi isethe i-UID/GID engalungile), inquma ukuba khona kwamafayela asebenzisekayo anefulegi le-suid kanye nokusetshenziswa kwamathegi e-SELinux, ikhomba okhiye bokubethela abakhohliwe futhi okungenzeka amafayela ayingozi. Okuqukethwe kugqamisa amaphasiwedi alahliwe obunjiniyela nedatha yokulungisa iphutha, kugqamisa ulwazi lwenguqulo, kuhlonza/kuqinisekise ihadiwe kusetshenziswa amahashi e-SHA-256, nokusesha kusetshenziswa imaski engaguquki nezinkulumo ezivamile. Kungenzeka ukuxhumanisa imibhalo ye-analyzer yangaphandle nezinhlobo ezithile zamafayela. Ku-firmware esekelwe ku-Android, imingcele yokwakha iyachazwa (isibonelo, kusetshenziswa imodi ye-ro.secure=1, i-ro.build.type state kanye nokwenza kusebenze kwe-SELinux).
I-FwAnalyzer ingasetshenziswa ukwenza lula ukuhlaziywa kwezinkinga zokuphepha ku-firmware yenkampani yangaphandle, kodwa injongo yayo eyinhloko iwukuqapha ikhwalithi ye-firmware ephethwe noma ehlinzekwa abathengisi benkontileka abavela eceleni. Imithetho ye-FwAnalyzer ikuvumela ukuthi ukhiqize ukucaciswa okunembile kwesimo se-firmware futhi uhlonze ukuchezuka okungamukeleki, njengokunikeza amalungelo okufinyelela angalungile noma ukushiya okhiye abayimfihlo kanye nekhodi yokususa iphutha (isibonelo, ukuhlola kukuvumela ukuthi ugweme izimo ezifana nalezi. isetshenziswe ngesikhathi sokuhlolwa kweseva ye-ssh, iphasiwedi yobunjiniyela, ukufunda /etc/config/shadow noma ukwakhiwa kwesiginesha yedijithali).
Source: opennet.ru