Thread by @naehrdine

We just released Polypyus, a binary-only diffing tool programmed by @freebejan that runs independent from Ghidra and IDA and integrates into the workflow of other diffing tools. (1/n)
github.com/seemoo-lab/pol…

This was a long journey starting with @dennismantz who reverse-engineered the Nexus 5 Bluetooth firmware. It doesn't have any strings or symbols, but he located threads, HCI handlers & enabled firmware patching with InternalBlue mid 2018. (2/n)

I continued reverse-engineering based on the specification to locate SSP and LMP handlers. Even though I just found CVE-2018-19860 (without looking for parsing issues), all recent specification-compliant attacks are in there: ECDH, KNOB, BIAS. (3/n)

Due to a paper review that claimed the Nexus 5 would be too old, I ordered a recent CYW20735 evaluation board that arrived on December 6 2018. Just three days later I found all its symbols in WICED Studio :D (4/n)

Suddenly, binary diffing got interesting. BinDiff worked okayish with IDA 6.8. By picking the >90% matches, CYW20735 produced ~6% matched functions in the Nexus 5 firmware, but still with some false positives. (5/n)

Then, @AdmVonSchneider published a new BinDiff version and I tried it on IDA 7.2 (?). Suddenly, most matches were gone. As it turned out later, this was no BinDiff fault, but changed auto analysis in IDA. Weirdest bug report ever, because it worked and also didn't work. (6/n)

Of course, I also tried @matalaz' Diaphora. After fixing another bug, it worked for the Bluetooth firmware, but also did not find good matches, similar to BinDiff. (7/n)

Finally, @freebejan put some of my thoughts why all this was not working into high-performance code that diffs raw binaries within a few seconds. Amazing work :D A paper will follow soon :) (8/8)

Since people were asking how it works internally, here is Jan's final presentation, which covers the most important aspects why ARM Thumb2 disassembly was problematic and how the binary-only approach works. (9/8)
github.com/seemoo-lab/pol…