Timeline for What's the easiest way to determine the OS contained in a firmware binary?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 20, 2013 at 1:04 | comment | added | devttys0 |
As an example, if you see strings that read something like Decompressing the main image or Decompressing kernel would indicate that the code is at least responsible for decompressing other data in the firmware image. It might also reference the specific compression algorithm used, such as LZMA or GZIP.
|
|
| Apr 19, 2013 at 11:58 | comment | added | gigawatt | Sorry, I'm so new at this I don't know what strings would be of interest. I've mentioned that I've found a /dev/tty and a /dev/lp along with stdin, stdout, and stderr. I just don't know the significance of them. | |
| Apr 19, 2013 at 3:46 | comment | added | devttys0 | Well if there are valid opcodes, at least part of it isn't compressed/encrypted. That code is probably a boot loader or decompressor stub, which may or may not have any information (or even knowledge) of the OS type. I'd look for strings/functionality that might indicate what else is in the firmware. | |
| Apr 18, 2013 at 17:40 | comment | added | gigawatt | Yeah, I've dug around the strings (in the correct endianness) but haven't seen anything that screams the OS. I'm not sure how the OPcodes will help but I have them all translated thanks to IdaPro. | |
| Apr 16, 2013 at 20:26 | history | answered | devttys0 | CC BY-SA 3.0 |