RISC-V架构安全取证深度分析

sudo apt update && sudo apt install -y \
  openocd \
  riscv64-unknown-elf-toolchain \
  riscv64-linux-gnu-toolchain \
  picocom \
  minicom \
  python3-pip

pip3 install yara-python rz-ghidra r2pipe

git clone https://github.com/riscv/isa-simulator.git
cd isa-simulator && mkdir build && cd build
../configure --prefix=/usr/local
make -j$(nproc)
sudo make install

git clone https://github.com/riscv-software-src/riscv-ctg.git
git clone https://github.com/riscv-non-isa/riscv-arch-test.git

git clone https://github.com/radareorg/radare2.git
cd radare2 && sys/install.sh
r2 -v
r2 -a riscv -b 32 firmware.bin

openocd -f interface/ftdi/ft232r.cfg -f target/riscv/spi.cfg -c "
  init
  halt
  reg mstatus
  reg misa
  reg mtvec
  reg mepc
  reg mcause
  reg pmpcfg0
  reg pmpcfg1
  reg pmpcfg2
  reg pmpcfg3
  reg pmpaddr0
  reg pmpaddr1
  reg pmpaddr2
  reg pmpaddr3
  reg pmpaddr4
  reg pmpaddr5
  reg pmpaddr6
  reg pmpaddr7
  shutdown
"

import struct
import sys

PMP_R = 0x01
PMP_W = 0x02
PMP_X = 0x04
PMP_A_TOR = 0x08
PMP_A_NA4 = 0x10
PMP_A_NAPOT = 0x18
PMP_L = 0x40

MATCH_MODES = {
    0x00: "OFF",
    0x08: "TOR",
    0x10: "NA4",
    0x18: "NAPOT"
}

def decode_pmpcfg(reg_val):
    entries = []
    for i in range(4):
        cfg_byte = (reg_val >> (i * 8)) & 0xFF
        mode = cfg_byte & 0x18
        r = bool(cfg_byte & PMP_R)
        w = bool(cfg_byte & PMP_W)
        x = bool(cfg_byte & PMP_X)
        locked = bool(cfg_byte & PMP_L)
        entries.append({
            'index': i,
            'raw': hex(cfg_byte),
            'mode': MATCH_MODES.get(mode, "INVALID"),
            'R': r, 'W': w, 'X': x,
            'locked': locked
        })
    return entries

def napot_decode(pmpaddr_val):
    if pmpaddr_val == 0:
        return 0
    addr = pmpaddr_val
    size = 1
    bit = 1
    for i in range(64):
        if addr & (1 << i):
            size = 2 << i
            break
    base = (addr << 2) & ~(size - 1) if size > 0 else 0
    return size

def analyze_pmp(pmpcfg_regs, pmpaddr_regs):
    print("=" * 70)
    print("RISC-V PMP Configuration Forensic Analysis")
    print("=" * 70)

    all_entries = []
    for idx, cfg_val in enumerate(pmpcfg_regs):
        entries = decode_pmpcfg(cfg_val)
        for e in entries:
            e['global_idx'] = idx * 4 + e['index']
            all_entries.append(e)

    suspicious_patterns = []
    for e in all_entries:
        if e['mode'] == 'OFF':
            continue
        if e['R'] and e['W'] and e['X']:
            suspicious_patterns.append(
                f"  [CRITICAL] PMP[{e['global_idx']}]: RWX ALL ENABLED - "
                f"Full memory access without restriction"
            )
        if e['R'] and e['W'] and not e['X']:
            pass
        if e['mode'] == 'TOR':
            gidx = e['global_idx']
            if gidx > 0 and all_entries[gidx - 1]['mode'] == 'OFF':
                suspicious_patterns.append(
                    f"  [WARNING] PMP[{gidx}]: TOR mode but previous entry OFF"
                )
        print(f"  PMP[{e['global_idx']:2d}]: {e['mode']:5s} "
              f"R={int(e['R'])} W={int(e['W'])} X={int(e['X'])} "
              f"L={int(e['locked'])}  raw={e['raw']}")

    if suspicious_patterns:
        print("\n[!] SUSPICIOUS CONFIGURATIONS DETECTED:")
        for p in suspicious_patterns:
            print(p)
    else:
        print("\n[*] No obviously suspicious PMP configurations found.")

    print("=" * 70)

if __name__ == '__main__':
    pmpcfg = [0x00000000] * 4
    pmpaddr = [0x00000000] * 16

    if len(sys.argv) > 1:
        data = open(sys.argv[1], 'rb').read()
        if len(data) >= 80:
            for i in range(4):
                pmpcfg[i] = struct.unpack('<I', data[i*4:(i+1)*4])[0]
            for i in range(16):
                pmpaddr[i] = struct.unpack('<I', data[16+i*4:20+i*4])[0]

    analyze_pmp(pmpcfg, pmpaddr)

python3 jtagulator.py -b 115200 -p /dev/ttyUSB0

openocd -f interface/ftdi/ft232r.cfg -c "adapter speed 1000" \
  -c "transport select jtag" \
  -c "jtag newtap riscv cpu -irlen 5" \
  -c "target create riscv.cpu riscv -chain-position riscv.cpu" \
  -c "init" -c "halt" -c "reg pc" -c "shutdown"

#!/bin/bash
TARGET_IP=$1
OUTPUT_DIR="riscv_debug_forensics_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT_DIR"

openocd -f interface/ftdi/ft232r.cfg -f target/riscv/spi.cfg -c "
  init
  halt

  dump_image $OUTPUT_DIR/ram_dump.bin 0x80000000 0x100000
  dump_image $OUTPUT_DIR/flash_dump.bin 0x20000000 0x400000

  reg mstatus > $OUTPUT_DIR/mstatus.txt
  reg mepc > $OUTPUT_DIR/mepc.txt
  reg mcause > $OUTPUT_DIR/mcause.txt
  reg pmpcfg0 > $OUTPUT_DIR/pmpcfg0.txt
  reg pmpcfg1 > $OUTPUT_DIR/pmpcfg1.txt
  reg pmpaddr0 > $OUTPUT_DIR/pmpaddr0.txt
  reg pmpaddr1 > $OUTPUT_DIR/pmpaddr1.txt

  mdw 0x00000000 0x100 > $OUTPUT_DIR/vector_table_dump.txt

  shutdown
"

echo "[*] Debug session forensics dump saved to $OUTPUT_DIR/"
echo "[*] SHA256 checksums:"
sha256sum "$OUTPUT_DIR"/*.bin

import struct
import sys
import os

CUSTOM_OPCODES = {0x0B, 0x2B, 0x5B, 0x7B}

def extract_opcode(word):
    return word & 0x7F

def extract_funct3(word):
    return (word >> 12) & 0x07

def extract_funct7(word):
    return (word >> 25) & 0x7F

def analyze_instruction(word, offset):
    opcode = extract_opcode(word)
    if opcode in CUSTOM_OPCODES:
        funct3 = extract_funct3(word)
        funct7 = extract_funct7(word)
        rd = (word >> 7) & 0x1F
        rs1 = (word >> 15) & 0x1F
        rs2 = (word >> 20) & 0x1F
        imm = (word >> 20) & 0xFFF
        return {
            'offset': offset,
            'raw': hex(word),
            'opcode': hex(opcode),
            'funct3': funct3,
            'funct7': funct7,
            'rd': rd,
            'rs1': rs1,
            'rs2': rs2,
            'imm': imm
        }
    return None

def scan_binary(filepath):
    results = []
    with open(filepath, 'rb') as f:
        data = f.read()

    for i in range(0, len(data) - 3, 4):
        word = struct.unpack('<I', data[i:i+4])[0]
        inst = analyze_instruction(word, i)
        if inst:
            results.append(inst)

    return results

def main():
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <firmware_binary>")
        sys.exit(1)

    filepath = sys.argv[1]
    print(f"[*] Scanning {filepath} for RISC-V custom instructions...")
    print(f"[*] File size: {os.path.getsize(filepath)} bytes")

    results = scan_binary(filepath)

    if results:
        print(f"\n[!] Found {len(results)} custom instruction encodings:\n")
        print(f"{'Offset':>12s}  {'Raw':>12s}  {'Op':>6s}  "
              f"{'f3':>3s}  {'f7':>4s}  {'rd':>4s}  {'rs1':>4s}  {'rs2':>4s}  {'imm':>8s}")
        print("-" * 80)
        for r in results:
            print(f"  0x{r['offset']:08x}  {r['raw']:>12s}  {r['opcode']:>6s}  "
                  f"{r['funct3']:3d}  {r['funct7']:4d}  "
                  f"{r['rd']:4d}  {r['rs1']:4d}  {r['rs2']:4d}  {r['imm']:#8x}")

        opcode_groups = {}
        for r in results:
            key = r['opcode']
            opcode_groups[key] = opcode_groups.get(key, 0) + 1

        print(f"\n[!] Custom opcode distribution:")
        for op, count in sorted(opcode_groups.items()):
            print(f"    {op}: {count} occurrences")
    else:
        print("\n[*] No custom instruction encodings found.")

if __name__ == '__main__':
    main()

ghidra_headless analyze /tmp/riscv_project \
  -import firmware.bin \
  -processor RISCV:RV32IC \
  -cspec "default" \
  -scriptPath /opt/ghidra_scripts \
  -postScript RiscvCustomInstDetector.java

esptool.py --chip esp32c3 read_flash 0x0 0x100000 firmware_dump.bin

esptool.py --chip esp32c3 image_info firmware_dump.bin

riscv64-unknown-elf-objdump -D -b binary -m riscv:rv32 firmware_dump.bin | head -200

openocd -f interface/stlink.cfg -f target/gd32vf103.cfg -c "
  init
  halt
  flash read_bank 0 firmware_gd32vf.bin
  dump_image memory_dump.bin 0x20000000 0x20000
  shutdown
"

sha256sum firmware_original.bin
sha256sum firmware_dump.bin

binwalk firmware_dump.bin

strings firmware_dump.bin | grep -iE "(openocd|jtag|debug|backdoor|shell|cmd)"

radiff2 -s firmware_known_good.bin firmware_dump.bin

rabin2 -I firmware_dump.bin
rabin2 -S firmware_dump.bin
rabin2 -z firmware_dump.bin | head -50

ghidra_headless /tmp/project_dir Project1 \
  -import firmware.bin \
  -processor RISCV:RV32IC \
  -cspec "default" \
  -loader BinaryLoader \
  -loaderOptions "baseAddr=0x20000000" \
  -postScript AutoAnalysis.java

git clone https://github.com/lowRISC/verilator.git
cd verilator && make -j$(nproc)

verilator --lint-only -Wall \
  -Wno-DECLFILENAME \
  picorv32.v \
  --top-module picorv32

git clone https://github.com/chipsalliance/riscv-formal.git
cd riscv-formal
make verify-picorv32

# ChipWhisperer侧信道采集环境配置
pip install chipwhisperer

# 使用ChipWhisperer Nano采集ESP32-C3功耗迹线
python3 -c "
import chipwhisperer as cw
scope = cw.scope()
target = cw.target(scope, cw.targets.SimpleSerial)
scope.setup(gain=45, num_samples=2400)
target.simpleserial_write('p', b'\\x01')
trace = scope.capture()
print(f'Captured {len(trace.wave)} samples')
"

riscv64-unknown-elf-objdump -d opensbi firmware.bin
riscv64-unknown-elf-nm opensbi firmware.bin | grep -E "(pmp|csr|trap|ecall)"

riscv64-unknown-elf-readelf -s opensbi firmware.bin | grep -iE "(pmp|security|crypto)"

strings opensbi firmware.bin | grep -iE "(debug|jtag|uart|shell)"

title: RISC-V Debug Module Suspicious Access
id: riscv-debug-access-001
status: experimental
description: Detects suspicious access patterns to RISC-V Debug Module registers
references:
  - https://github.com/riscv/riscv-debug-spec
author: BlueTeam Forensics
date: 2026/07/22
tags:
  - attack.credential_access
  - attack.t1005
  - attack.t1210
  - riscv
  - forensics
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    Image|endswith:
      - '/openocd'
      - '/riscv64-unknown-elf-gdb'
  selection_debug_actions:
    CommandLine|contains:
      - 'reg pmpcfg'
      - 'reg pmpaddr'
      - 'reg mstatus'
      - 'reg mtvec'
      - 'dump_image'
      - 'load_image'
      - 'flash write'
      - 'mdb '
      - 'mwb '
      - 'reset halt'
  condition: selection_cmd and selection_debug_actions
  timeframe: 5m
level: high
falsepositives:
  - Legitimate firmware development activities
  - Authorized security audit procedures

title: RISC-V Firmware Integrity Mismatch
id: riscv-firmware-integrity-002
status: experimental
description: Detects firmware integrity verification failures on RISC-V devices
author: BlueTeam Forensics
date: 2026/07/22
tags:
  - attack.defense_evasion
  - attack.t1027
  - riscv
  - forensics
logsource:
  category: file_integrity
  product: linux
detection:
  selection:
    EventType:
      - 'FileModified'
      - 'FileCreated'
    TargetFilename|contains:
      - '/dev/mtd'
      - '/sys/firmware'
      - '/opt/riscv_firmware'
  condition: selection
  timeframe: 1h
level: critical
falsepositives:
  - Authorized firmware update procedures

#!/bin/bash
FIRMWARE_FILE=$1
KNOWN_GOOD_DB=$2
OUTPUT_DIR="riscv_fw_scan_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT_DIR"

if [ ! -f "$FIRMWARE_FILE" ]; then
    echo "[!] Usage: $0 <firmware_file> [known_good_db]"
    exit 1
fi

echo "[*] RISC-V Firmware Integrity Scanner"
echo "[*] Target: $FIRMWARE_FILE"
echo "[*] File size: $(stat -f%z "$FIRMWARE_FILE") bytes"

FW_HASH=$(sha256sum "$FIRMWARE_FILE" | awk '{print $1}')
echo "[*] SHA256: $FW_HASH"

echo "[*] Scanning for ELF header..."
head -c 4 "$FIRMWARE_FILE" | xxd | head -1 > "$OUTPUT_DIR/header.txt"

echo "[*] Extracting strings..."
strings "$FIRMWARE_FILE" > "$OUTPUT_DIR/strings.txt"
STRINGS_COUNT=$(wc -l < "$OUTPUT_DIR/strings.txt")
echo "[*] Extracted $STRINGS_COUNT strings"

echo "[*] Scanning for suspicious strings..."
grep -iE "(jtag|openocd|gdb|debug|backdoor|shell|password|secret|key|token)" \
  "$OUTPUT_DIR/strings.txt" > "$OUTPUT_DIR/suspicious_strings.txt"
SUSPIC_COUNT=$(wc -l < "$OUTPUT_DIR/suspicious_strings.txt")
echo "[*] Found $SUSPIC_COUNT suspicious strings"

echo "[*] Scanning for RISC-V custom instructions..."
python3 -c "
import struct, sys
CUSTOM_OPCODES = {0x0B, 0x2B, 0x5B, 0x7B}
count = 0
with open('$FIRMWARE_FILE', 'rb') as f:
    data = f.read()
for i in range(0, len(data) - 3, 4):
    word = struct.unpack('<I', data[i:i+4])[0]
    if (word & 0x7F) in CUSTOM_OPCODES:
        count += 1
        print(f'  Custom inst at offset 0x{i:08x}: {hex(word)}')
print(f'Total custom instructions found: {count}')
" > "$OUTPUT_DIR/custom_instructions.txt"

echo "[*] Running binwalk analysis..."
binwalk "$FIRMWARE_FILE" > "$OUTPUT_DIR/binwalk.txt" 2>&1

echo "[*] Checking for known backdoor patterns..."
YARA_RESULT=""
if command -v yara &> /dev/null; then
    if [ -f "riscv_backdoor.yar" ]; then
        yara riscv_backdoor.yar "$FIRMWARE_FILE" > "$OUTPUT_DIR/yara_results.txt" 2>&1
        echo "[*] YARA scan results saved."
    fi
fi

echo "[*] Analyzing code entropy..."
python3 -c "
import math, collections
with open('$FIRMWARE_FILE', 'rb') as f:
    data = f.read()
entropy_vals = []
block_size = 256
for i in range(0, len(data), block_size):
    block = data[i:i+block_size]
    freq = collections.Counter(block)
    e = -sum((c/len(block)) * math.log2(c/len(block)) for c in freq.values())
    entropy_vals.append(e)
high_entropy = sum(1 for e in entropy_vals if e > 7.5)
print(f'Entropy blocks: {len(entropy_vals)}')
print(f'High entropy blocks (>7.5): {high_entropy}')
if high_entropy > 0:
    print('[!] WARNING: High entropy regions detected - possible encryption/packing')
" > "$OUTPUT_DIR/entropy_analysis.txt"

echo ""
echo "[*] === SCAN COMPLETE ==="
echo "[*] Results saved to: $OUTPUT_DIR/"
echo "[*] Suspicious strings: $SUSPIC_COUNT"
cat "$OUTPUT_DIR/custom_instructions.txt"
cat "$OUTPUT_DIR/entropy_analysis.txt"

import json
import sys
import hashlib
from datetime import datetime

PMP_CONFIG_BASELINES = {
    "esp32c3": {
        "pmpcfg": [0x0000001F, 0x00000000, 0x00000000, 0x00000000],
        "pmpaddr": [0x00000000, 0x10000000, 0x00000000, 0x00000000,
                     0x00000000, 0x00000000, 0x00000000, 0x00000000,
                     0x00000000, 0x00000000, 0x00000000, 0x00000000,
                     0x00000000, 0x00000000, 0x00000000, 0x00000000],
        "description": "ESP32-C3 default PMP configuration"
    },
    "gd32vf103": {
        "pmpcfg": [0x0000001F, 0x0000001B, 0x00000000, 0x00000000],
        "pmpaddr": [0x00000000, 0x10000000, 0x00000000, 0x20000000,
                     0x30000000, 0x00000000, 0x00000000, 0x00000000,
                     0x00000000, 0x00000000, 0x00000000, 0x00000000,
                     0x00000000, 0x00000000, 0x00000000, 0x00000000],
        "description": "GD32VF103 default PMP configuration"
    }
}

def parse_pmpcfg(val):
    entries = []
    for i in range(4):
        byte = (val >> (i * 8)) & 0xFF
        entries.append({
            'R': bool(byte & 0x01),
            'W': bool(byte & 0x02),
            'X': bool(byte & 0x04),
            'A': (byte >> 3) & 0x03,
            'L': bool(byte & 0x40)
        })
    return entries

def detect_anomalies(pmpcfg, pmpaddr, chip_type=None):
    findings = []

    all_entries = []
    for reg_idx, cfg_val in enumerate(pmpcfg):
        entries = parse_pmpcfg(cfg_val)
        for i, e in enumerate(entries):
            e['idx'] = reg_idx * 4 + i
            all_entries.append(e)

    for e in all_entries:
        if e['A'] == 0:
            continue
        if e['R'] and e['W'] and e['X']:
            findings.append({
                'level': 'critical',
                'type': 'RWX_PERMISSION',
                'detail': f"PMP[{e['idx']}] has RWX all permissions enabled",
                'mitre': 'T1562.001'
            })
        if e['R'] and not e['L']:
            findings.append({
                'level': 'medium',
                'type': 'UNLOCKED_READ',
                'detail': f"PMP[{e['idx']}] read permission without lock"
            })

    if chip_type and chip_type in PMP_CONFIG_BASELINES:
        baseline = PMP_CONFIG_BASELINES[chip_type]
        for i in range(4):
            if pmpcfg[i] != baseline['pmpcfg'][i]:
                findings.append({
                    'level': 'high',
                    'type': 'CONFIG_DEVIATION',
                    'detail': f"pmpcfg{i} deviates from baseline: "
                              f"got {hex(pmpcfg[i])}, expected {hex(baseline['pmpcfg'][i])}",
                    'mitre': 'T1562.001'
                })
        for i in range(16):
            if pmpaddr[i] != baseline['pmpaddr'][i]:
                findings.append({
                    'level': 'medium',
                    'type': 'ADDR_DEVIATION',
                    'detail': f"pmpaddr{i} deviates from baseline: "
                              f"got {hex(pmpaddr[i])}, expected {hex(baseline['pmpaddr'][i])}"
                })

    return findings

def generate_report(findings, chip_type, output_file):
    report = {
        'timestamp': datetime.now().isoformat(),
        'chip_type': chip_type,
        'total_findings': len(findings),
        'critical': sum(1 for f in findings if f.get('level') == 'critical'),
        'high': sum(1 for f in findings if f.get('level') == 'high'),
        'medium': sum(1 for f in findings if f.get('level') == 'medium'),
        'findings': findings
    }

    with open(output_file, 'w') as f:
        json.dump(report, f, indent=2)

    print(f"\n{'='*60}")
    print(f"PMP Configuration Forensic Report")
    print(f"{'='*60}")
    print(f"Chip Type:     {chip_type}")
    print(f"Findings:      {len(findings)}")
    print(f"Critical:      {report['critical']}")
    print(f"High:          {report['high']}")
    print(f"Medium:        {report['medium']}")
    print(f"{'='*60}\n")

    for f in findings:
        level_str = f.get('level', 'info').upper()
        print(f"[{level_str}] {f['type']}: {f['detail']}")
        if 'mitre' in f:
            print(f"         MITRE ATT&CK: {f['mitre']}")
        print()

    return report

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <pmp_dump_file> [chip_type]")
        print(f"  chip_type: esp32c3, gd32vf103")
        sys.exit(1)

    chip_type = sys.argv[2] if len(sys.argv) > 2 else None

    pmpcfg = [0] * 4
    pmpaddr = [0] * 16

    with open(sys.argv[1], 'rb') as f:
        data = f.read()
    if len(data) >= 80:
        import struct
        for i in range(4):
            pmpcfg[i] = struct.unpack('<I', data[i*4:(i+1)*4])[0]
        for i in range(16):
            pmpaddr[i] = struct.unpack('<I', data[16+i*4:20+i*4])[0]

    findings = detect_anomalies(pmpcfg, pmpaddr, chip_type)
    output_file = f"pmp_forensic_report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.json"
    generate_report(findings, chip_type or 'unknown', output_file)

rule RISC-V_Debug_Backdoor {
    meta:
        description = "Detects RISC-V debug module backdoor patterns"
        author = "BlueTeam Forensics"
        date = "2026/07/22"
        reference = "RISC-V Debug Spec v0.13"
        mitre_attack = "T1542, T1210"
    strings:
        $debug_module_addr = { 00 01 00 00 }
        $sba_read_pattern = { 23 20 ?? ?? 3C }
        $abstract_cmd = { 23 20 ?? ?? 1C }
        $pmp_open_wide = { 1F 00 00 00 }
        $jtag_string = "JTAG" ascii nocase
        $openocd_str = "openocd" ascii nocase
        $custom_opcode_c0 = { ?? ?? ?? 0B }
        $custom_opcode_c1 = { ?? ?? ?? 2B }
    condition:
        uint32(0) == 0x464C457F and
        (2 of ($debug*, $sba*, $abstract*) or
         $pmp_open_wide or
         (1 of ($jtag*, $openocd*) and 1 of ($custom_opcode*)))
}

rule RISC-V_Custom_Instruction_Implant {
    meta:
        description = "Detects potential custom instruction implants in RISC-V firmware"
        author = "BlueTeam Forensics"
        date = "2026/07/22"
        mitre_attack = "T1195, T1027"
    strings:
        $c0_0 = { ?? 00 00 0B }
        $c0_1 = { ?? 00 80 0B }
        $c1_0 = { ?? 00 00 2B }
        $c1_1 = { ?? 00 80 2B }
        $c2_0 = { ?? 00 00 5B }
        $c3_0 = { ?? 00 00 7B }
    condition:
        #c0_0 + #c0_1 + #c1_0 + #c1_1 + #c2_0 + #c3_0 > 10
}

rule RISC-V_Secure_Boot_Bypass {
    meta:
        description = "Detects RISC-V secure boot bypass indicators"
        author = "BlueTeam Forensics"
        date = "2026/07/22"
        mitre_attack = "T1542.001, T1562.001"
    strings:
        $mtvec_mod = { 35 00 ?? ?? }
        $mstatus_mod = { 33 30 ?? ?? }
        $pmpcfg_write = { 30 30 ?? ?? 23 }
        $open_sbi_bypass = "opensbi" ascii nocase
        $secure_boot_off = "secure_boot=0" ascii nocase
    condition:
        uint32(0) == 0x464C457F and
        ($mtvec_mod and $mstatus_mod) or
        ($pmpcfg_write and $secure_boot_off)
}

[forensic-analysis]$ openocd -f riscv_debug.cfg -c "init; halt; reg mstatus"
mstatus: 0x0000000000000000
  [debug_mode] Debug mode: ACTIVE
  [mie] Machine interrupt enable: 0
  [mpie] Previous MIE: 0

[forensic-analysis]$ openocd -c "dump_image extracted_flash.bin 0x20000000 0x400000"
[forensic-analysis]$ strings extracted_flash.bin | grep -i "debug"
DEBUG_AUTH_DISABLED=1
JTAG_OPEN=1
SECURE_BOOT=0

sha256sum extracted_flash.bin
riscv64-unknown-elf-objdump -D -b binary -m riscv:rv32 extracted_flash.bin > disasm.txt

grep -n "CUSTOM\|0b$\|2b$\|5b$\|7b$" disasm.txt > custom_inst_hits.txt

radiff2 -s firmware_known_good.bin extracted_flash.bin

python3 pmp_analyzer.py pmp_dump.bin esp32c3

esptool.py --chip esp32c3 read_flash 0x0 0x400000 affected_device.bin
sha256sum affected_device.bin
binwalk affected_device.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
-----------------------------------------------------------
0             0x0             ESP32-C3 bootloader header
8192          0x2000          ESP32-C3 application image
65536         0x10000         ESP32-C3 OTA data partition

import r2pipe

r2 = r2pipe.open("affected_device.bin")
r2.cmd("aaa")
r2.cmd("e asm.arch=riscv")
r2.cmd("e asm.bits=32")

functions = r2.cmdj("aflj")
for func in functions:
    if 'c2' in func['name'].lower() or 'tunnel' in func['name'].lower():
        print(f"[SUSPICIOUS] Function: {func['name']} at {hex(func['offset'])}")

disasm = r2.cmd("pdf @ 0x420000")
print(disasm)