Tearing Down (Sonic)Walls: Reverse-Engineering SonicOSX Firmware Encryption

Speakers: Jon Williams, Caleb Gross

Does SonicOSX raise the bar for SonicWall device security – or simply hinder legitimate research? In this talk, we’ll walk through cracking SonicOSX: extracting keys, decrypting firmware, and analyzing its architecture. Whether you’re a vuln researcher or just starting in RE, you’ll get a hands-on guide to tackling modern firmware security, along with an open-source tool to decrypt NSv firmware.

Presentation given at DistrictCon 2025.

Summary

Researchers introduced Sonic Crack, a command-line tool that automates extracting, decrypting, and analyzing encrypted firmware from SonicWall NSv virtual images. This tool enables security professionals to analyze firewall firmware the same way attackers do—without the usual restrictions.

Why We Built Sonic Crack

• SonicWall firewalls are widely used by enterprises, yet vulnerabilities in them have been exploited for initial access attacks.
• Many devices don’t provide direct root access, making firmware analysis difficult.
• Attackers still manage to reverse-engineer firmware, so defenders should have that capability too.

What Sonic Crack Does

• Takes a SonicWall NSv VMware image and extracts cryptographic keys.
• Decrypts the firmware and dumps the root file system.
• Allows researchers to inspect the SonicOS binary, which controls firewall functions.

Live Exploit Demo: The SSL-VPN Authentication Bypass

• A recent SonicWall vulnerability allowed attackers to hijack VPN sessions.
• By decrypting the firmware, we quickly analyzed the patch and developed an exploit.
• The exploit:
  • Extracted a session ID from an active VPN user.
  • Bypassed MFA and authentication controls.
  • Allowed full session takeover, granting network access.

Breaking SonicWall Firmware Encryption

• SonicWall encrypts firmware using various formats:
  • SIG – Encrypted, monolithic binary (no embedded key).
  • SWI – Contains some embedded decryption keys.
  • LUKS – Used in older versions.
• We cracked the SIG format, allowing full decryption of modern SonicOS firmware.

Using AI to Automate Patch Analysis

• Problem: SonicWall releases patches with stripped binaries—analyzing them manually is slow.
• Solution: We built an AI-driven ranking tool to find vulnerabilities faster.
• How it works:
  • Extract function call chains and decompiled code from patched/unpatched binaries.
  • Use LLMs to rank the most relevant changes.
  • Result: Found the root cause of the SSL-VPN vulnerability in minutes instead of days.

Finding a Zero-Day During Research

• While analyzing SonicWall firmware, we found a zero-day vulnerability in the SSL-VPN service.
• The exploit crashes the firewall whenever a user connects via VPN.
• Disclosure: We’re following responsible disclosure, and full details will be released in April.

Key Takeaways & Call to Action

• Encrypted firmware doesn’t stop attackers—it only makes research harder for defenders.
• Vendors should lower barriers to security research or implement private bug bounty programs.
• Sonic Crack is now public—use it to analyze firmware, find vulnerabilities, and improve security.
• Check our blog in April for details on the zero-day.