3

Introduction

For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its some custom VXWORX/RTOS system with custom firmware header and obfuscation.

I have no access to the Device itself, i.e. I can not debug the firmware update process.

What I have found out so far

There are two types of files in the firmware, easy XOR obfuscated files. I was able to detetect the single byte XOR key by quick analysis in hex editor. The second type is a bit more obfuscated. This is used for more sensitive data. But fortunately I have some of the files as clear text, downloaded directly from the Device via the Web interface.

These second, strong obfuscated and/or compressed type have following characteristics:

  • small files are encoded with a little overhead (25%)
  • larger files are compressed, but far from ideal (25-30% for HTML/Text)
    • I tried several compression algorithms on the clear-text file to make sure they dont match the size of the encoded file
  • A single byte change can lead to multiple byte changed in the endoded versions

Examples

First comes the original file, then the encoded as found in the firmware.

  • o_000000.gif

    00000000  47 49 46 38 39 61 04 00  04 00 80 00 00 00 00 00  |GIF89a..........|
    00000010  ff ff ff 21 f9 04 01 00  00 01 00 2c 00 00 00 00  |...!.......,....|
    00000020  04 00 04 00 00 02 04 84  8f 09 05 00 3b           |............;|   
    0000002d
    
    00000000  40 04 07 ff 04 09 c4 b1  3b 9c 90 58 12 43 09 18  |@.......;..X.C..|
    00000010  4c 03 f3 8f 28 f4 65 86  93 e7 fe e1 9f d5 5c 82  |L...(.e.......\.|
    00000020  66 76 ea c1 0c 42 a9 ad  e3 bd f4 65              |fv...B.....e|
    0000002c
    
  • o_0000ff.gif

    00000000  47 49 46 38 39 61 04 00  04 00 80 00 00 00 00 ff  |GIF89a..........|
    00000010  ff ff ff 21 f9 04 01 00  00 01 00 2c 00 00 00 00  |...!.......,....|
    00000020  04 00 04 00 00 02 04 84  8f 09 05 00 3b           |............;|   
    0000002d                                                                      
    
    00000000  40 04 04 c2 60 1f 9c 7c  10 20 b0 24 86 13 ff 14  |@...`..|. .$....|
    00000010  7a 32 c3 49 27 12 c4 ee  73 c7 7c f9 ff 55 52 86  |z2.I'...s.|..UR.|
    00000020  ee ee 53 58 21 e8 55 31  b2 4f 9e 0f b5           |..SX!.U1.O...|
    0000002d
    
  • iframe.html

    00000000  0d 0a 0d 0a 0d 0a 3c 69  66 72 61 6d 65 20 73 72  |......<iframe sr|
    00000010  63 3d 22 68 74 74 70 3a  2f 2f 77 77 77 2e 73 6f  |c="http://www.so|
    00000020  6c 61 72 6c 6f 67 31 30  30 2e 64 65 2f 76 69 73  |larlog100.de/vis|
    00000030  75 2f 6b 61 72 77 61 74  68 2f 62 61 6e 6e 65 72  |u/karwath/banner|
    00000040  2e 68 74 6d 6c 22 20 77  69 64 74 68 3d 22 32 30  |.html" width="20|
    00000050  30 22 20 68 65 69 67 68  74 3d 22 31 32 30 22 20  |0" height="120" |
    00000060  6e 61 6d 65 3d 22 53 6f  6c 61 72 4c 6f 67 42 61  |name="SolarLogBa|
    00000070  6e 6e 65 72 22 20 73 63  72 6f 6c 6c 69 6e 67 3d  |nner" scrolling=|
    00000080  22 6e 6f 22 20 66 72 61  6d 65 62 6f 72 64 65 72  |"no" frameborder|
    00000090  3d 22 30 22 3e 0d 0a 3c  70 3e 49 68 72 20 42 72  |="0">..<p>Ihr Br|
    000000a0  6f 77 73 65 72 20 6b 61  6e 6e 20 6c 65 69 64 65  |owser kann leide|
    000000b0  72 20 6b 65 69 6e 65 20  65 69 6e 67 65 62 65 74  |r keine eingebet|
    000000c0  74 65 74 65 6e 20 46 72  61 6d 65 73 20 61 6e 7a  |teten Frames anz|
    000000d0  65 69 67 65 6e 3a 0d 0a  53 69 65 20 6b 26 6f 75  |eigen:..Sie k&ou|
    000000e0  6d 6c 3b 6e 6e 65 6e 20  64 69 65 20 65 69 6e 67  |ml;nnen die eing|
    000000f0  65 62 65 74 74 65 74 65  20 53 65 69 74 65 20 26  |ebettete Seite &|
    00000100  75 75 6d 6c 3b 62 65 72  20 64 65 6e 20 66 6f 6c  |uuml;ber den fol|
    00000110  67 65 6e 64 65 6e 20 56  65 72 77 65 69 73 0d 0a  |genden Verweis..|
    00000120  61 75 66 72 75 66 65 6e  3a 20 3c 61 20 68 72 65  |aufrufen: <a hre|
    00000130  66 3d 22 68 74 74 70 3a  2f 2f 77 77 77 2e 73 6f  |f="http://www.so|
    00000140  6c 61 72 6c 6f 67 31 30  30 2e 64 65 2f 76 69 73  |larlog100.de/vis|
    00000150  75 2f 6b 61 72 77 61 74  68 2f 62 61 6e 6e 65 72  |u/karwath/banner|
    00000160  2e 68 74 6d 6c 22 3e 42  61 6e 6e 65 72 3c 2f 61  |.html">Banner</a|
    00000170  3e 3c 2f 70 3e 0d 0a 3c  2f 69 66 72 61 6d 65 3e  |></p>..</iframe>|
    00000180
    
    00000000  0b a2 e7 6d 2c f7 7b 0a  ca 5a 13 c9 74 80 16 29  |...m,.{..Z..t..)|
    00000010  f1 42 98 94 65 32 93 53  5b ed 8b 95 b8 4b d3 d8  |.B..e2.S[....K..|
    00000020  69 75 b3 48 84 28 5e aa  d7 6b 80 99 49 96 39 dd  |iu.H.(^..k..I.9.|
    00000030  91 69 4c 13 ab 5e 7c 67  c6 7c 35 ed 68 c6 9c 55  |.iL..^|g.|5.h..U|
    00000040  d5 96 d8 01 cf f6 30 52  95 b1 4a 67 53 91 22 fd  |......0R..JgS.".|
    00000050  f3 7d ac 72 f8 5a 63 f9  d1 4c 19 88 0e ed 53 6c  |.}.r.Zc..L....Sl|
    00000060  01 cf 6e 5f 76 0c cb 7d  1f 7d b7 62 f1 18 19 6e  |..n_v..}.}.b...n|
    00000070  2f 47 db 7b 31 ac b7 1e  53 3a 8d 48 91 0e ed 56  |/G.{1...S:.H...V|
    00000080  dc 5d 55 29 cf d6 4c b7  72 db eb 46 35 04 ab b5  |.]U)..L.r..F5...|
    00000090  59 6f ed c3 9f 0d 73 86  36 ca 78 95 22 89 53 ff  |Yo....s.6.x.".S.|
    000000a0  3b b7 9a f7 6a 9f fa f5  a7 5e b2 28 10 02 05 6f  |;...j....^.(...o|
    000000b0  19 46 34 27 3b e4 2f 11  5f ec f8 8f e4 ff fa 65  |.F4';./._......e|
    000000c0  a0 e7 d7 76 ad fb f2 75  eb 22 81 00 20 4f 1d 78  |...v...u.".. O.x|
    000000d0  13 f4 e9 a0 e7 d7 02 a7  ed 5b eb 29 91 5f 6a df  |.........[.)._j.|
    000000e0  92 a8 ab c2 cf 83 d3 5a  d3 55 7f 9d a3 76 52 d7  |.......Z.U...vR.|
    000000f0  2d b0 03 9f ec 60 a5 2b  62 94 ce a7 22 45 fb e6  |-....`.+b..."E..|
    00000100  fb 58 e5 f0 b4 c7 f3 a2  98 33 10 1d da a6 d8 03  |.X.......3......|
    00000110  9e e1 88 77 6a 9a c1 c2  d6 39 c3 9f 0d 63 da d1  |...wj....9...c..|
    00000120  8d 42                                             |.B|
    00000122
    

Example File Downloads

Binary versions of original and encoded files are provided.

examples.zip

examples2.zip

Update1: Second example uploaded with encrypted binary files. They all have in clear text a MX header like this.

    hexdump -C extsd_new.exe
    00000000  4d 58 07 00 0f 00 01 00  03 00 26 00 ff ff 2e 00  |MX........&.....|
    00000010  00 03 00 00 00 00 00 00  2c 00 00 00 3c 14 be 54  |........,...<..T|
    00000020  00 00 00 00 00 00 00 00  00 00 00 00 ce 00 1b 00  |................|
    00000030  b9 68 0d be ce 1a 89 f7  1e a9 b5 80 8c c8 05 01  |.h..............|
    00000040  00 8e d8 05 13 00 8e c0  fd f3 a5 fc 2e 80 6c 12  |..............l.|
    00000050  01 73 e7 92 af ad 0e 0e  0e 06 1f 07 16 bd 31 00  |.s............1.|
    00000060  bb 0f 80 55 cb 55 50 58  21 0b 13 03 08 8d 43 8c  |...U.UPX!.....C.|
    00000070  ba 30 ad 68 62 5a 2b 00  30 1a 00 20 2d 00 00 1b  |.0.hbZ+.0.. -...|
    00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
    *
    00000130  ff ba 24 00 2e 89 16 40  02 ff b4 30 cd 21 8b 2e  |..$....@...0.!..|
  • 1
    A bit odd. If you check extsd_new.exe.enc, you see multiple lines of just FF FF FF FF. That's an odd sight when you assume this file to be compressed or encrypted. Can you compare the file size of extsd_new (encoded vs. plain) - is this maybe an uncompressed file? – Johann Aydinbas May 15 '18 at 0:04
  • 1
    there's also this clear UPX! that would suggest UPX exe packer? Also this MX could be a hidden form of MZ from an DOS executable? – Paweł Łukasik May 15 '18 at 6:25
-1

I recommend trying using binwalk again. binwalk has it's own extraction utility which decompresses/deflates files of many different file types.

Use it like so...

binwalk -Me file_name

I hope this helps!

  • 1
    Thanks for your time, but this is more of a comment/remark than an answer. – 0xC0000022L Jun 13 '18 at 20:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.