Test 1

TEST 1

Test Case: BIS-2.7b.1 Test Name: TC_ASSESS_FIRMWARE_REVERSE_ENGINEERING_PROTECTIONS

---

Objective:

Testing, in presence of OEM team, to verify the security controls as provided by the vendor to hinder firmware reverse engineering.

---

Tools Used:

• Binwalk – for firmware unpacking and embedded content analysis

• Ghidra – for disassembly and analysis of binary structure

• (Optional) Radare2, Firmware-Mod-Kit, Hex editors, etc., if deeper analysis required

---

Test Execution Steps:

1. Arrange a session with the OEM team to oversee and validate the testing process.

2. Load the DUT firmware image into Binwalk to inspect embedded files, compression/encryption, and metadata.

3. Use Ghidra to disassemble the firmware binary and assess whether debugging symbols or source code references are present.

4. Check for:

   • Stripped symbols

   • Obfuscated control flows

   • Signs of encrypted segments

   • CRC/checksum protections

   • Tamper detection logic

5. Document findings and compare against vendor’s documentation on reverse engineering protections.

---

Expected Results for Pass:

• No verbose debugging symbols, function names, or developer comments are found.

• Binary analysis shows evidence of code obfuscation, encryption, or anti-debugging mechanisms.

• Reverse engineering attempts are hindered or yield minimal exploitable insight.

---

Test Observations:

(To be filled based on actual tool outputs and analysis during the test session. E.g., “Binwalk scan showed encrypted sections and no extractable ELF symbols. Ghidra analysis found stripped functions and absence of human-readable metadata.”)

---

Evidence Provided:

• Screenshots or logs from Binwalk and Ghidra scans

• Vendor confirmation of applied protection techniques

• Annotated disassembly reports or summaries

---

Test Case Result:

(Pass/Fail – based on whether all expected protections are verified.)

---

Overall Test Result:

(Pass/Fail – cumulative result for section 2.7b)

---