Egg Hunt in Tesla Infotainment: A First Look at Reverse Engineering of Qt Binaries

As one of the most popular C++ extensions for developing graphical user interface (GUI) based applications, Qt has been widely used in desktops, mobiles, IoTs, automobiles, etc. Although existing binary analysis platforms (e.g., angr and Ghidra) could help reverse engineer Qt binaries, they still need to address many fundamental challenges such as the recovery of control flow graphs and symbols. In this paper, we take a first look at understanding the unique challenges and opportunities in Qt binary analysis, developing enabling techniques, and demonstrating novel applications. In particular, although callbacks make control flow recovery challenging, we notice that Qt's signal and slot mechanism can be used to recover function callbacks. More interestingly, Qt's unique dynamic introspection can also be repurposed to recover semantic symbols. Based on these insights, we develop QTRE for function callback and semantic symbol recovery for Qt binaries. We have tested QTRE with two suites of Qt binaries: Linux KDE and the Tesla Model S firmware, where QTRE additionally recovered 10,867 callback instances and 24,973 semantic symbols from 123 binaries, which cannot be identified by existing tools. We demonstrate a novel application of using QTRE to extract hidden commands from a Tesla Model S firmware. QTRE discovered 12 hidden commands including five unknown to the public, which can potentially be exploited to manipulate vehicle settings.