Questions tagged [firmware-analysis]
The firmware-analysis tag has no usage guidance.
86
questions
1
vote
0
answers
60
views
Is this (router) firmware file encrypted?
I am new to reverse engineering. Nice community you folks have here.
I am trying to determine if this, VOX3v_CLOSED_19.2.0203.3261005.rbi (https://vfcc.publicacs.vodafone.co.uk/firmware/UK-CC/...
0
votes
0
answers
51
views
Help Extracting a CramFS filesystem from .img binary
I'm trying to extract a CramFS filesystem from a firmware binary for the FVS318Gv2. It downloads as a .zip file that can be decompressed to reveal a firmware .img file and a readme.htm. Running ...
1
vote
1
answer
57
views
finding unknown CRC 32 bit algorithm used in a firmware file
I want to modify a firmware image for a WiFi router. The image file consist of an UBI image, 0x04100000 bytes in size. Additonally, 20 bytes of unknown metadata have been appended to the UBI image ...
0
votes
2
answers
144
views
Firmware disassembler for c-sky processor (ck803s)
can you tell me why objdump does not correctly disassemble the firmware for the C-SKY (ck803s) processor? what is .long: between the lines, unknown instructions? or am I setting the parameters for ...
0
votes
0
answers
29
views
Modification/packaging of firmware for TV motherboards based on MSD3663
Is it possible to somehow unpack or modify the firmware for the TP.MSD3663S.PB805 TV motherboard? For example, edit configuration files, graphic images or change them. What programs should I use for ...
1
vote
1
answer
80
views
What to do when the .img is corrupted?
After getting rejected from a promising interview process with Company A, the interviewer reached out to me and provided me with Reverse Engineering challenges Company A provides publicly to work on.
...
0
votes
0
answers
28
views
Error when using Operation not supported using firmadyne
I'm using firmware-analysis-toolkits, and as part of the toolkit, it uses firmadyne. When trying to emulate a TP-LINK firmware, I'm encountering this error.
swRegWrite: Operation not supported
...
0
votes
0
answers
77
views
Extracting KIA care update firmware
I have a new KIA sportage NQ5 car. Now I want to enable wifi and turn on ADB so I can install custom app and use AA Wireless or Carplay wireless. Sadly, the old trick to access android setting app ...
0
votes
0
answers
383
views
Hello Watch 3+ smart watch firmware extracting
I have a firmware file of Hello Watch 3+ smart watch. I want to customize this firmware. I tried binwalk but no result. I am trying reverse engineering for the first time. Can you help me?
File link: ...
1
vote
0
answers
110
views
Got access to SWD, but I need to identify the chip
I was able to connect to the chip via SWD/openocd, but I can't figure out what chip it is (says SM9PQ1 2322-52 on chip, googled but cant find anything). I'm hoping to download the firmware after I ...
1
vote
2
answers
354
views
Using IDA 8.3 Freeware on a Z180 .bin file
The last time I tried my hand at disassembly it was in
1986-1988... a Z80 embedded processor PROM image file...
42K of code turned into 27000+ lines of assembler code...
using a disassembly program ...
1
vote
1
answer
376
views
How can I tell ghidra what structure an address register points to?
I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766).
In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
0
votes
0
answers
90
views
How to load correctly a SPC56AP54 dump in Ghidra or IDA?
I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
0
votes
0
answers
113
views
Tips on how to extract Apple firmware for a Broadcom Wireless chip, using binwalk or a similar tool?
TLDR: I have a dump of my wireless chip's RAM, but am having trouble separating firmware from, possibly the driver itself, from the nvram configuration portion.
So, I'm trying to enhance the ...
0
votes
0
answers
72
views
embedded Linux, UART & JTAG disabled, how to access system?
So i have this device running embedded Linux, UART and JTAG interfaces are disabled by software. The device creates a WiFi hotspot and i know the password. By entering the devices IP adress i can ...
1
vote
1
answer
110
views
Why I can't decompile this ARM function?
I have an ARM (thumb) function from Nokia's firmware:
ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6āp
ROM:10A5409C
ROM:10A5409C var_18 = -0x18
ROM:...
0
votes
0
answers
119
views
i would like to know how to reverse engineer a steam pc game thats limited to a 30min demo ill explain
I Have a steam game its a demo not very big company or anything you are limited to only 30 min of game play then at the end of the 30 min your session ends and you are brought to a screen encouraging ...
0
votes
0
answers
52
views
Firmware not attached to WinDBG while debugging Windows boot process
I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process.
Short ...
0
votes
1
answer
124
views
Bluetooth speaker firmware modification
I don't know if this is the right community to ask this to but I have this speaker and I want to change the startup, shutdown sound effect of it. It is not a chinese BT speaker but a Hama soundbarrel. ...
1
vote
1
answer
529
views
Would it be possible to reverse engineer the wooting 60he keyboard to create a new pcb?
Would it be possible to build a pcb that is essentially a copy of the wooting Hall effect pcbs but with different layouts? (Ie: 65% or 75% layouts)
Would it be possible to transfer the firmware from ...
2
votes
0
answers
283
views
ZTE F670 V1.1.10P3T21 encrypted config.bin
I want to decrypt config.bin
For this I found in cspd
following code
undefined4 CspDBInitPdtInterface(undefined4 *param_1)
{
dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml");
...
2
votes
0
answers
67
views
How can I patch out shm in Ghidra?
I've been trying to emulate a Mips binary in qemu, but I kept getting an error for shared memory allocation. I decompiled the function where it happens in Ghidra:
local_18 = dm_shmInit(0);
if (...
4
votes
0
answers
208
views
remove the computrace by flashing the bios
Is there a way to remove the computrace by flashing the bios or deleting/altering the contents of it? Someone gave me a laptop and I found out that it was not usable because it was equipped with ...
2
votes
0
answers
585
views
How to extract the firmware from the flash chip of the router?
Hi, I've been struggling with a subject since 2 weeks.
I have MSS5004W model router from RicherLink. The board is RL-S4005ef. This device has OpenWrt installed but it's not normally supported by that ...
4
votes
1
answer
139
views
💻 This code does not crash on ARM (qemu). Why?
I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7.
I'm able to emulate the userspace process ...
2
votes
0
answers
189
views
In IDA freeware, how to create a new database in IDC and load a file into it?
I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder.
What ...
3
votes
0
answers
72
views
Reverse engineering LCD memory map
I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
3
votes
0
answers
158
views
rooting D-link DIR-x5460 - Weird Firmware
I have a D-link DIR-X5460 and I'm trying to get a shell on it.
I connected to the UART interface and tried some default passwords, but none work.
I downloaded the FW from D-link's website, decrypted ...
2
votes
0
answers
305
views
.bin firmware Standalone Binwalk returns garbage, Binwalk -I returns something but seems corrupted. Binwalk -X returns hundreds of raw deflate streams
As the title says I have the firmware of the WAX214 wifi access point. The firmware is actively preventing me from using the full available functionality of the device so I am trying to reverse it to ...
2
votes
0
answers
45
views
LZ4N file format - file decoding
I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format.
Non of linux available lz4 tools do ...
2
votes
0
answers
671
views
Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code
I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this).
After the analysis I get only few codelines with a lot of similar messages:
...
2
votes
0
answers
313
views
How to disassemble Renesas RX210 MCU firmware?
I am a beginner in firmware reverse engineering. I have a dump file of Renesas RX210 MCU firmware but, I don't know how to disassemble it. Is any recommended software to disassemble it?
2
votes
0
answers
203
views
Fix screen resolutions to landscape in bios
I've got an x86 tablet (Dere D10). It works fine, except the screen reports portait resolutions (1200x1920, 768x1024, 600x800, etc.) which causes bootloaders (windows recovery menu, grub, ventoy, etc.)...
2
votes
0
answers
86
views
LG C1 Firmware Flashing/Modifying
I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
4
votes
0
answers
120
views
How to analyze EFI dynamically?
I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver.
I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
1
vote
1
answer
904
views
ARM - Understanding a "base address" when reversing firmware
I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
2
votes
0
answers
193
views
Prevention of reverse engineering of a microcontroller's firmware
What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller?
Options I see so far:
Flood it with epoxy with quartz or metal dust to make ...
3
votes
2
answers
2k
views
Mitsubishi MAC-577IF2-E WIFI controller Firmware file
I recently installed Mitsubishi AC with Mitsubishi MAC-577IF2-E
Wi-Fi controller, and as always nowadays these devices communicate with Cloud servers first, then with you, which practically means you ...
3
votes
2
answers
2k
views
Disassembling ARM based Camera Firmware
I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file.
Binwalk is unable to extract the known zip files.
binwalk -e digicap.dav
DECIMAL ...
1
vote
0
answers
466
views
Firmware RE (Beginner)
I'm trying to learn RE, and I thought I'd look at some firmware that interests me. I'm looking at the Roland TD-11 drum module firmware, which is available for download from the Roland website
I ...
1
vote
0
answers
112
views
Reverse Engineering SNES adapter
A good "Hello world" for everybody here
I've bought a Mayflash PC052 adapter to convert an original SNES-mini controller (CLV-202) to a USB port on PC or PS4...
The thing is, this CLV-202 ...
4
votes
0
answers
854
views
How to extract sound file from a small 1MB binary
I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
2
votes
2
answers
2k
views
Harman Kardon firmware reverse engineering
First of all, I'm very new to reverse engineering, but I know about hex, binary, opcodes, et cetera.
I'm trying to reverse engineer a Harman Kardon firmware file, because I think there are some API ...
1
vote
0
answers
285
views
Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset
I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP.
The device has a custom android repo ...
0
votes
1
answer
2k
views
decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)? [closed]
Although I have no hope really I will leave this here in case someone has the ability and time to help.
This is from a modem/router widely used in countries like Germany, Greece and others from ...
2
votes
0
answers
787
views
ZTE AES-256-CBC Encrypted backup config file
i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output
Encrypted Data Start Position: 227
...
1
vote
0
answers
117
views
How does one start with reversing router config encryption?
There is not enough info on the web from what I have seen.
Most write ups/guides/blog-posts are like this:
They provide only the decrypt/encrypt script-tool with how to run it and nothing else
They ...
3
votes
0
answers
502
views
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.
So i start searching for the way to do that...
I used HxH ...
1
vote
1
answer
108
views
Why do some firmware binaries have more than 1 file system structures
As I unpack and explore the packing structure of firmware, I am noticing that some firmware will have several file system structures. I can't seem to find any documentation as to why one device may ...
1
vote
2
answers
1k
views
Reverse engineering TP-Link TD-W8961N V3
I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware.
After following the same question here
i used the script zynos.py for unpacking the firmware and i got some files
-rw-r--r-...