Analyze Unknown Microcontroller Firmware Binary and Determine File Offset and Instruction Set Architecture

microcontroller-find.sh

#!/bin/sh

#
# A Small Shell script to check a binary for different microcontroller cpu architectures.
#
# This works by importing the binary into a project in Ghidra
# And then iteratively attempting to analyze chunks of the binary firmare
# all while timing the analysis.
#
# The theory is Ghidra should take noticeably longer to analyze a valid 
# architecture/binary combination than an invalid one.
#
# Author: Nicholas Starke
# Date: 9/22/2019
#
# Usage is:
# 
# $ sh microcontroller-find.sh [project-name] [path-to-binary] [logfile-path]
#

NAME=$1
FILE_PATH=$2
LOG_FILE=$3
INC=65536
PROJ=$(date +%s)
LENGTH=$(stat --printf="%s" $FILE_PATH)
ITER=$((LENGTH/INC))
ITER=$(printf "%.2f" "$ITER")
PROC=$(nproc)

# LANG Values for Microprocessors: (Note these should be in microcontroller-language-defs.txt)
#
# 8051:BE:16:default
# 80251:BE:24:default
# 80390:BE:24:default
# 8051:BE:24:mx51
# 6502:LE:16:default
# 6502:BE:16:default
# x86:LE:16:Real Mode
# 8085:LE:16:default
# CR16AB:LE:16:default
# CR16C:LE:16:default
# TI_MSP430:LE:16:default
# z80:LE:16:default
# z8401x:LE:16:default
# z180:LE:16:default
# z182:LE:16:default
# 6805:BE:16:default
# PIC-24E:LE:24:default
# PIC-24F:LE:24:default
# PIC-24H:LE:24:default
# dsPIC30F:LE:24:default
# dsPIC33F:LE:24:default
# dsPIC33E:LE:24:default
# PIC-18:LE:24:PIC-18
# PIC-16:LE:16:PIC-16
# PIC-16:LE:16:PIC-16F
# PIC-12:LE:16:PIC-12C5xx
# PIC-17:LE:16:PIC-17C7xx
# PIC-16:LE:16:PIC-16C5x
# avr8:LE:16:default
# avr8:LE:16:extended
# avr8:LE:16:atmega256

for LANG in $(cat ./micro-language-defs.txt); do
	START=0
	for I in $(seq 0 $ITER); do
		mkdir $HOME/ghidra_projects/$NAME-$PROJ-$LANG-$START
		BEGIN=$(date +%s) 
		analyzeHeadless $HOME/ghidra_projects/$NAME-$PROJ-$LANG-$START $NAME-$PROJ-$LANG-$START -processor $LANG -import $FILE_PATH -max-cpu $PROC -loader BinaryLoader -loader-fileOffset $START -deleteProject
		END=$(date +%s)
		TIME=$((END - BEGIN))
		echo "$LANG,$START,$TIME" >> $LOG_FILE
		START=$((START+INC))
	done
done

Will come in handy in the near future.

Where does the analyzeHeadless comes from?