Introduction
For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its some custom VXWORX/RTOS system with custom firmware header and obfuscation.
I have no access to the Device itself, i.e. I can not debug the firmware update process.
What I have found out so far
There are two types of files in the firmware, easy XOR obfuscated files. I was able to detetect the single byte XOR key by quick analysis in hex editor. The second type is a bit more obfuscated. This is used for more sensitive data. But fortunately I have some of the files as clear text, downloaded directly from the Device via the Web interface.
These second, strong obfuscated and/or compressed type have following characteristics:
- small files are encoded with a little overhead (25%)
- larger files are compressed, but far from ideal (25-30% for HTML/Text)
- I tried several compression algorithms on the clear-text file to make sure they dont match the size of the encoded file
- A single byte change can lead to multiple byte changed in the endoded versions
Examples
First comes the original file, then the encoded as found in the firmware.
o_000000.gif
00000000 47 49 46 38 39 61 04 00 04 00 80 00 00 00 00 00 |GIF89a..........| 00000010 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 |...!.......,....| 00000020 04 00 04 00 00 02 04 84 8f 09 05 00 3b |............;| 0000002d 00000000 40 04 07 ff 04 09 c4 b1 3b 9c 90 58 12 43 09 18 |@.......;..X.C..| 00000010 4c 03 f3 8f 28 f4 65 86 93 e7 fe e1 9f d5 5c 82 |L...(.e.......\.| 00000020 66 76 ea c1 0c 42 a9 ad e3 bd f4 65 |fv...B.....e| 0000002co_0000ff.gif
00000000 47 49 46 38 39 61 04 00 04 00 80 00 00 00 00 ff |GIF89a..........| 00000010 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 |...!.......,....| 00000020 04 00 04 00 00 02 04 84 8f 09 05 00 3b |............;| 0000002d 00000000 40 04 04 c2 60 1f 9c 7c 10 20 b0 24 86 13 ff 14 |@...`..|. .$....| 00000010 7a 32 c3 49 27 12 c4 ee 73 c7 7c f9 ff 55 52 86 |z2.I'...s.|..UR.| 00000020 ee ee 53 58 21 e8 55 31 b2 4f 9e 0f b5 |..SX!.U1.O...| 0000002diframe.html
00000000 0d 0a 0d 0a 0d 0a 3c 69 66 72 61 6d 65 20 73 72 |......<iframe sr| 00000010 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 6f |c="http://www.so| 00000020 6c 61 72 6c 6f 67 31 30 30 2e 64 65 2f 76 69 73 |larlog100.de/vis| 00000030 75 2f 6b 61 72 77 61 74 68 2f 62 61 6e 6e 65 72 |u/karwath/banner| 00000040 2e 68 74 6d 6c 22 20 77 69 64 74 68 3d 22 32 30 |.html" width="20| 00000050 30 22 20 68 65 69 67 68 74 3d 22 31 32 30 22 20 |0" height="120" | 00000060 6e 61 6d 65 3d 22 53 6f 6c 61 72 4c 6f 67 42 61 |name="SolarLogBa| 00000070 6e 6e 65 72 22 20 73 63 72 6f 6c 6c 69 6e 67 3d |nner" scrolling=| 00000080 22 6e 6f 22 20 66 72 61 6d 65 62 6f 72 64 65 72 |"no" frameborder| 00000090 3d 22 30 22 3e 0d 0a 3c 70 3e 49 68 72 20 42 72 |="0">..<p>Ihr Br| 000000a0 6f 77 73 65 72 20 6b 61 6e 6e 20 6c 65 69 64 65 |owser kann leide| 000000b0 72 20 6b 65 69 6e 65 20 65 69 6e 67 65 62 65 74 |r keine eingebet| 000000c0 74 65 74 65 6e 20 46 72 61 6d 65 73 20 61 6e 7a |teten Frames anz| 000000d0 65 69 67 65 6e 3a 0d 0a 53 69 65 20 6b 26 6f 75 |eigen:..Sie k&ou| 000000e0 6d 6c 3b 6e 6e 65 6e 20 64 69 65 20 65 69 6e 67 |ml;nnen die eing| 000000f0 65 62 65 74 74 65 74 65 20 53 65 69 74 65 20 26 |ebettete Seite &| 00000100 75 75 6d 6c 3b 62 65 72 20 64 65 6e 20 66 6f 6c |uuml;ber den fol| 00000110 67 65 6e 64 65 6e 20 56 65 72 77 65 69 73 0d 0a |genden Verweis..| 00000120 61 75 66 72 75 66 65 6e 3a 20 3c 61 20 68 72 65 |aufrufen: <a hre| 00000130 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 6f |f="http://www.so| 00000140 6c 61 72 6c 6f 67 31 30 30 2e 64 65 2f 76 69 73 |larlog100.de/vis| 00000150 75 2f 6b 61 72 77 61 74 68 2f 62 61 6e 6e 65 72 |u/karwath/banner| 00000160 2e 68 74 6d 6c 22 3e 42 61 6e 6e 65 72 3c 2f 61 |.html">Banner</a| 00000170 3e 3c 2f 70 3e 0d 0a 3c 2f 69 66 72 61 6d 65 3e |></p>..</iframe>| 00000180 00000000 0b a2 e7 6d 2c f7 7b 0a ca 5a 13 c9 74 80 16 29 |...m,.{..Z..t..)| 00000010 f1 42 98 94 65 32 93 53 5b ed 8b 95 b8 4b d3 d8 |.B..e2.S[....K..| 00000020 69 75 b3 48 84 28 5e aa d7 6b 80 99 49 96 39 dd |iu.H.(^..k..I.9.| 00000030 91 69 4c 13 ab 5e 7c 67 c6 7c 35 ed 68 c6 9c 55 |.iL..^|g.|5.h..U| 00000040 d5 96 d8 01 cf f6 30 52 95 b1 4a 67 53 91 22 fd |......0R..JgS.".| 00000050 f3 7d ac 72 f8 5a 63 f9 d1 4c 19 88 0e ed 53 6c |.}.r.Zc..L....Sl| 00000060 01 cf 6e 5f 76 0c cb 7d 1f 7d b7 62 f1 18 19 6e |..n_v..}.}.b...n| 00000070 2f 47 db 7b 31 ac b7 1e 53 3a 8d 48 91 0e ed 56 |/G.{1...S:.H...V| 00000080 dc 5d 55 29 cf d6 4c b7 72 db eb 46 35 04 ab b5 |.]U)..L.r..F5...| 00000090 59 6f ed c3 9f 0d 73 86 36 ca 78 95 22 89 53 ff |Yo....s.6.x.".S.| 000000a0 3b b7 9a f7 6a 9f fa f5 a7 5e b2 28 10 02 05 6f |;...j....^.(...o| 000000b0 19 46 34 27 3b e4 2f 11 5f ec f8 8f e4 ff fa 65 |.F4';./._......e| 000000c0 a0 e7 d7 76 ad fb f2 75 eb 22 81 00 20 4f 1d 78 |...v...u.".. O.x| 000000d0 13 f4 e9 a0 e7 d7 02 a7 ed 5b eb 29 91 5f 6a df |.........[.)._j.| 000000e0 92 a8 ab c2 cf 83 d3 5a d3 55 7f 9d a3 76 52 d7 |.......Z.U...vR.| 000000f0 2d b0 03 9f ec 60 a5 2b 62 94 ce a7 22 45 fb e6 |-....`.+b..."E..| 00000100 fb 58 e5 f0 b4 c7 f3 a2 98 33 10 1d da a6 d8 03 |.X.......3......| 00000110 9e e1 88 77 6a 9a c1 c2 d6 39 c3 9f 0d 63 da d1 |...wj....9...c..| 00000120 8d 42 |.B| 00000122
Example File Downloads
Binary versions of original and encoded files are provided.
Update1: Second example uploaded with encrypted binary files. They all have in clear text a MX header like this.
hexdump -C extsd_new.exe
00000000 4d 58 07 00 0f 00 01 00 03 00 26 00 ff ff 2e 00 |MX........&.....|
00000010 00 03 00 00 00 00 00 00 2c 00 00 00 3c 14 be 54 |........,...<..T|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 ce 00 1b 00 |................|
00000030 b9 68 0d be ce 1a 89 f7 1e a9 b5 80 8c c8 05 01 |.h..............|
00000040 00 8e d8 05 13 00 8e c0 fd f3 a5 fc 2e 80 6c 12 |..............l.|
00000050 01 73 e7 92 af ad 0e 0e 0e 06 1f 07 16 bd 31 00 |.s............1.|
00000060 bb 0f 80 55 cb 55 50 58 21 0b 13 03 08 8d 43 8c |...U.UPX!.....C.|
00000070 ba 30 ad 68 62 5a 2b 00 30 1a 00 20 2d 00 00 1b |.0.hbZ+.0.. -...|
00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000130 ff ba 24 00 2e 89 16 40 02 ff b4 30 cd 21 8b 2e |[email protected].!..|
extsd_new.exe.enc, you see multiple lines of just FF FF FF FF. That's an odd sight when you assume this file to be compressed or encrypted. Can you compare the file size of extsd_new (encoded vs. plain) - is this maybe an uncompressed file?