6

I managed to get the firmware for my IoT device but the firmware is in HEX. What is the best way to convert it to a binary so I can use binwalk? So far I've tried converting it with srec_cat hex.file -Intel -Output binary.file -Binary. I have tried to analyze the converted file with binwalk but the only results I get are:

SHA256 hash constants, little endian
Certificate in DER format (x509 v3), header length: 4, sequence length: 678

Am I doing something wrong?

Edit: after using binwalk -Ive binary.file I managed to extract some files. The files are not detected correctly but when I look at the files I see bits of text used on my device.

Edit 2: I don't think the firmware is compressed. But I'm not sure if it's encrypted. What's the best way to check this?

$ file binary.file
binary.file: data

Using strings -n 10 binary.file I get a seemingly valid list of strings.

  • Are you sure the firmware is not compressed/encrypted? – John Doe Nov 8 '16 at 6:40
  • Can you provide either the binary or a hexdump of the first few hundred bytes of the binary, plus some of the human-readable strings returned by strings? Information about the device itself, such as device name, manufacturer, processor, etc would also be helpful – julian Mar 20 '17 at 20:22
1

Converting your hex file to binary

Use xxd -p -r. For example:

echo -n "deadbeef" | xxd -p -r | od -tx1

So, in your case, xxd -p -r hex.file > binary.file should do the trick.

Encrypted or not

If you see unencrypted strings with messages typical to your device, your firmware is (most probably) not encrypted because it is unlikely only parts would encrypted and others not.

If the unencrypted strings are typical strings from glibc or other libraries, then, it is uncertain.

The fact your firmware includes a certificate does not mean it is encrypted. The certificate can be used to secure communications between the IoT and a remote server for instance.

1

As first step you should check the datasheet in order to get the endianness and the loading address. Then you can try to load your firmware with your favorite disassembler, for example with radare2 yuo can use a syntax similar to this

r2 -a your_arch -b bytes_num -m loading_address

Look at this for more details.

With IDA you should set the processor type/options and after the RAM and ROM addresses that you can get from the datasheet.

Look at this example.

  • If it's HEX file it already contains the ROM addresses. – Anton Kukoba May 10 '18 at 7:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.