0

I'm trying to learn firmware analysis. The device I chosen was my Motorola SBG901 modem. I managed to dump the memory contents via JTAG using the FlashcatUSB adapter. The memory dump is about 8MB in size. Now this is where I am lost I'm trying to analyze the dump. But I don't know where to start. I have used binwalk on it which I believe brought back false positives as the output was as follow:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
67434         0x1076A         Certificate in DER format (x509 v3), header length: 4, sequence length: 803
68243         0x10A93         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024
70361         0x112D9         Certificate in DER format (x509 v3), header length: 4, sequence length: 808
71175         0x11607         Certificate in DER format (x509 v3), header length: 4, sequence length: 988
81036         0x13C8C         Certificate in DER format (x509 v3), header length: 4, sequence length: 866
81908         0x13FF4         Certificate in DER format (x509 v3), header length: 4, sequence length: 983
82897         0x143D1         Certificate in DER format (x509 v3), header length: 4, sequence length: 864
89278         0x15CBE         Certificate in DER format (x509 v3), header length: 4, sequence length: 803
90087         0x15FE7         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024
92205         0x1682D         Certificate in DER format (x509 v3), header length: 4, sequence length: 808
93019         0x16B5B         Certificate in DER format (x509 v3), header length: 4, sequence length: 988
102880        0x191E0         Certificate in DER format (x509 v3), header length: 4, sequence length: 866
103752        0x19548         Certificate in DER format (x509 v3), header length: 4, sequence length: 983
104741        0x19925         Certificate in DER format (x509 v3), header length: 4, sequence length: 864
111122        0x1B212         Certificate in DER format (x509 v3), header length: 4, sequence length: 803
111931        0x1B53B         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024
114049        0x1BD81         Certificate in DER format (x509 v3), header length: 4, sequence length: 808
114863        0x1C0AF         Certificate in DER format (x509 v3), header length: 4, sequence length: 988
124724        0x1E734         Certificate in DER format (x509 v3), header length: 4, sequence length: 866
125596        0x1EA9C         Certificate in DER format (x509 v3), header length: 4, sequence length: 983
126585        0x1EE79         Certificate in DER format (x509 v3), header length: 4, sequence length: 864

I believe binwalk gave false postive output as the dump probably isn't a packed image. I say this because I also ran strings on the dump and received a lot of readable strings a snippet is shown below:

Out from running strings on dump

I'm tryring to extract the firmware so I can use QEMU and try to do some vulnerability findings. I'm doing this for knowledge sake but I am inexperience with reading dump files. Can someone point me in the direction that would teach me how to decipher the memory dump and eventually extract the firmware. I really want to learn how to read the dump because I plan to analyze other firmwares hence I want to learn the essentials. For instance I know that there are firmwares that are packed/unpacked and/or encrypted/unencrypted. They usually consist of bootloaders, OS, filesystem, libraries, and apps (such as webserver). Can some point me in the direction of some useful resource that will teach me how to read dump and determine how to get the firmware out with all right files (filesystem, bootloader, apps, etc...)?

Thanks in advance

2

I believe binwalk gave false postive output

It is likely the output is not false positive. You can see the strings used in certificates.

For instance I know that there are firmwares that are packed/unpacked and/or encrypted/unencrypted

This is the direction you would want to check. Binwalk has an entropy analysis option, and it can display a graph of it. Encrypted or packed files will have high and uniform entropy.

I'm tryring to extract the firmware so I can use QEMU and try to do some vulnerability findings.

While the CPU architecture might be well-known, device like this will likely have a custom SoC with little to none available documentation. I don't think you will be to do a complete emulation of the device, so static analysis can be a preferred option.

Can someone point me in the direction

If you really have JTAG access, you can try dumping RAM, since it may contain unpacked/decrypted code. However, I suspect this is in fact a dump of SPI flash chip. Actual JTAG access may have been disabled by manufacturer.

  • Yea I guess its not false positive after all. I also have used the binwalk -E position to produce an entropy graph. An it mainly had two high entropy points. It seems to be encryption or LZMA compression. I am currently reading on finding out which it is (devttys0.com/2013/06/…). I just don't know where to start to get into firmware analysis so I chosen to just try my hand at extracting a firmware from a dump. I know its a long journey but its what grab my interest. Thanks – user1803784 Dec 16 '16 at 14:11
  • The thing about entropy graph is how uniform it is — if it's all flat with high entropy, there is likely encryption or compression present. – John Doe Dec 16 '16 at 14:30
  • You were right from the start it is a dump of the flash. Its not the packed firmware. Thanks. – user1803784 Jun 1 '17 at 21:45
2

If you only want the firmware, you can find it in this link. And this link might be of use. Apparently the chip on your box is a BCM3361, a MIPS32 according to Broadcom. I think you can emulate it with QEMU, no obvious issues there.

Your dump is more likely to be a mix of code and data. It's pretty hard to dissociate data from code; you'll have to go in with a substantial entropy analysis (data and code entropy are very different). You can check the different Binwalk options here, the explanations are pretty clear.

  • Thanks the files you gave me are very helpful. I haven't gotten a chance to actually try he emulation though. My main goal is just to learn how to identify the data from the dump and extract firmware files if possible. I can use the firmware file you gave me to look for vulnerabilities. But my main goal is to learn how to start from scratch with firmware analysis. I think I will just analyze the firmware in the tutorials I have found was trying to use my own .bin file. But I am learning so I shouldn't make it so difficult. Thanks again – user1803784 Dec 16 '16 at 14:06
  • Well, now that you got the firmware and you can run it on an emulator, you can study its memory mapping (data & instructions) : where is it stored and what is stored. In case you don't wanna use the firmware, you'll have to analyze the format using all available format reversing tools and techniques : intuition. – yaspr Dec 16 '16 at 14:50
  • The link to the firmware is no longer available by chance do you have another one I just learned how to emulate firmware with firmadyne I want to try out this firmware if possible. – user1803784 Jun 1 '17 at 21:46
  • Check the link again! – yaspr Jun 2 '17 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.