I'm trying to learn firmware analysis. The device I chosen was my Motorola SBG901 modem. I managed to dump the memory contents via JTAG using the FlashcatUSB adapter. The memory dump is about 8MB in size. Now this is where I am lost I'm trying to analyze the dump. But I don't know where to start. I have used binwalk on it which I believe brought back false positives as the output was as follow:
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
67434 0x1076A Certificate in DER format (x509 v3), header length: 4, sequence length: 803
68243 0x10A93 Certificate in DER format (x509 v3), header length: 4, sequence length: 1024
70361 0x112D9 Certificate in DER format (x509 v3), header length: 4, sequence length: 808
71175 0x11607 Certificate in DER format (x509 v3), header length: 4, sequence length: 988
81036 0x13C8C Certificate in DER format (x509 v3), header length: 4, sequence length: 866
81908 0x13FF4 Certificate in DER format (x509 v3), header length: 4, sequence length: 983
82897 0x143D1 Certificate in DER format (x509 v3), header length: 4, sequence length: 864
89278 0x15CBE Certificate in DER format (x509 v3), header length: 4, sequence length: 803
90087 0x15FE7 Certificate in DER format (x509 v3), header length: 4, sequence length: 1024
92205 0x1682D Certificate in DER format (x509 v3), header length: 4, sequence length: 808
93019 0x16B5B Certificate in DER format (x509 v3), header length: 4, sequence length: 988
102880 0x191E0 Certificate in DER format (x509 v3), header length: 4, sequence length: 866
103752 0x19548 Certificate in DER format (x509 v3), header length: 4, sequence length: 983
104741 0x19925 Certificate in DER format (x509 v3), header length: 4, sequence length: 864
111122 0x1B212 Certificate in DER format (x509 v3), header length: 4, sequence length: 803
111931 0x1B53B Certificate in DER format (x509 v3), header length: 4, sequence length: 1024
114049 0x1BD81 Certificate in DER format (x509 v3), header length: 4, sequence length: 808
114863 0x1C0AF Certificate in DER format (x509 v3), header length: 4, sequence length: 988
124724 0x1E734 Certificate in DER format (x509 v3), header length: 4, sequence length: 866
125596 0x1EA9C Certificate in DER format (x509 v3), header length: 4, sequence length: 983
126585 0x1EE79 Certificate in DER format (x509 v3), header length: 4, sequence length: 864
I believe binwalk gave false postive output as the dump probably isn't a packed image. I say this because I also ran strings on the dump and received a lot of readable strings a snippet is shown below:
I'm tryring to extract the firmware so I can use QEMU and try to do some vulnerability findings. I'm doing this for knowledge sake but I am inexperience with reading dump files. Can someone point me in the direction that would teach me how to decipher the memory dump and eventually extract the firmware. I really want to learn how to read the dump because I plan to analyze other firmwares hence I want to learn the essentials. For instance I know that there are firmwares that are packed/unpacked and/or encrypted/unencrypted. They usually consist of bootloaders, OS, filesystem, libraries, and apps (such as webserver). Can some point me in the direction of some useful resource that will teach me how to read dump and determine how to get the firmware out with all right files (filesystem, bootloader, apps, etc...)?
Thanks in advance