# A Vulnerability Scanning Method for Web Services in Embedded Firmware
## 4 Design
### Boundary Binary Recognition  
We identify boundary binary files by analyzing association relationships between the front end and the back end. After firmware unpacking, front-end code can generally be recognized by its unique file extensions. However, not all executable binary files within a firmware's file system are capable of processing front-end data except boundary binaries. Therefore, it is necessary to discern these boundary binary files through carefully designed methods.  
In the firmware back end, boundary binary files export device functionalities to the front end and handle user inputs received from the front end. Upon receiving data packets from the front end, the boundary binary files are required to parse and respond to the packets accordingly. Therefore, we can distill signature characteristics to recognize boundary binary files. We use the examples in Figures 3 and 4 to illustrate possible features. Figure 3 shows a packet submitted by a router configuration page which is used to set the wanMTU, wanSpeed, cloneType, and MAC parameters of the device. When the back-end boundary binary receives the data packet, it will process the data in it, and the processed code may contain features related to the front end, as shown in Figure 4. In Figure 4a, if an incorrect URL is requested in the packet, an HTML error page will be outputted because the URL cannot be found. In fact, boundary binary files can generate various HTML pages based on different response situations, and some of the code of these HTML pages exists in the form of strings in the boundary binary. In Figure 4b, the boundary binary checks whether some header fields in the packet exist. In fact, a boundary binary usually checks various headers of HTTP requests to complete packet verification, so the boundary binary file contains strings related to the HTTP header. In Figure 4c, the boundary binary obtains the parameters passed in the request body, where the parameters in the request body usually exist in the form of \"key1 = value 1 & key2 = value 2 &...\". The boundary binary obtains the corresponding value through the key, which is used for subsequent processing in the program. The three scenarios in Figure 4 correspond to three features associated with boundary binaries and the front end, and we can use these three points to identify boundary binary files.  
Figure 3: Packets from the front end. The data packet is sent by the front-end configuration page of a certain router. The data package includes parameter configuration information, which is used to set the device’s wanMTU, wanSpeed, cloneType, and mac parameters.  
Figure 2: Structure of WFinder. WFinder inputs firmware from actual devices and outputs potential bugs. WFinder identifies back-end boundary binary files by analyzing the correlation between the front end and back end and accurately identifies contaminated source and sink points through specific features and rules for an input-sensitive taint analysis.  
Observations indicate that each characteristic of a boundary binary includes specific feature keywords present within the binary file, thus enabling the identification of binaries through keyword matching. For Characteristics 1 and 2, we can collect HTTP header fields and HTML tags to serve as matching keywords. Characteristic 3 requires the extraction of parameter keywords used for data transfer in the front-end files. We then extract strings from each back-end binary and attempt to match them with our established feature keywords. We prioritize back-end files that possess three distinct characteristics, and then binaries with the highest numbers of matching feature keywords are considered boundary binaries, as expressed in Equation (1), where K1, K2, and K3 represent the sets of keywords derived from the three characteristics, and Si represents the set of keywords extracted from each binary file in the firmware.  
\[\text{Border}=\text{MAX}\left(\text{K1}\cup\text{K2}\cup\text{K3}\right)\cap \text{Si} \tag{1}\]