Firmware Decompile - nicholasaleks/Damn-Vulnerable-Drone GitHub Wiki

Reverse engineering the ArduPilot firmware used in Damn Vulnerable Drone

Damn Vulnerable Drone > Attack Scenarios > Firmware Attacks > Firmware Decompile

Description

Firmware decompilation allows attackers to reverse engineer the flight control logic, parameter logic, and security flaws embedded in the compiled autopilot firmware. This technique is crucial for identifying hardcoded behaviors, exploitable functions, or undocumented MAVLink commands.

In Damn Vulnerable Drone, we’ll extract the running firmware binary used by the ArduPilot SITL instance, decompile it with Ghidra, and explore its internal structure for hacking opportunities.

Resources

⚠️ Solution Guide

Step 1. Locate the ArduPilot SITL Firmware Binary

Access the flight-controller Docker container:

docker exec -it flight-controller bash

Search for the arducopter binary:

find / -name "arducopter" 2>/dev/null

Expected output:

/home/ardupilot/ArduCopter/build/sitl/bin/arducopter

Step 2. Extract the Binary from the Container

From your host terminal, copy the file out:

docker cp ardupilot:/home/ardupilot/ArduCopter/build/sitl/bin/arducopter ./arducopter.bin

Step 3. Identify the Binary Format

Use the file utility:

file arducopter.bin

Expected output:

ELF 64-bit LSB executable, x86-64, dynamically linked

Step 4. Inspect the Binary

Quick static recon with strings:

strings arducopter.bin | less

Dump disassembly (optional):

objdump -D -M intel arducopter.bin > arducopter.asm

Step 5. Load the Firmware into Ghidra

  1. Open Ghidra
  2. Create a new non-shared project
  3. Import arducopter.bin
  4. Accept default analysis options
  5. Begin reversing

Search for MAVLink handlers, param_find(), strcpy, flight mode logic, and state machine transitions.

Step 6. (Optional) Decompile .apj Firmware from Real Drones

Download a real .apj firmware image:

wget https://firmware.ardupilot.org/Copter/stable/Pixhawk1/arducopter.apj

Extract using binwalk:

binwalk -e arducopter.apj

Explore extracted ELF binaries using the same steps above.

⚠️ **GitHub.com Fallback** ⚠️