Memory dump analysis

Question

I'm trying to learn firmware analysis. The device I chosen was my Motorola SBG901 modem. I managed to dump the memory contents via JTAG using the FlashcatUSB adapter. The memory dump is about 8MB in size. Now this is where I am lost I'm trying to analyze the dump. But I don't know where to start. I have used binwalk on it which I believe brought back false positives as the output was as follow:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
67434         0x1076A         Certificate in DER format (x509 v3), header length: 4, sequence length: 803
68243         0x10A93         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024
70361         0x112D9         Certificate in DER format (x509 v3), header length: 4, sequence length: 808
71175         0x11607         Certificate in DER format (x509 v3), header length: 4, sequence length: 988
81036         0x13C8C         Certificate in DER format (x509 v3), header length: 4, sequence length: 866
81908         0x13FF4         Certificate in DER format (x509 v3), header length: 4, sequence length: 983
82897         0x143D1         Certificate in DER format (x509 v3), header length: 4, sequence length: 864
89278         0x15CBE         Certificate in DER format (x509 v3), header length: 4, sequence length: 803
90087         0x15FE7         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024
92205         0x1682D         Certificate in DER format (x509 v3), header length: 4, sequence length: 808
93019         0x16B5B         Certificate in DER format (x509 v3), header length: 4, sequence length: 988
102880        0x191E0         Certificate in DER format (x509 v3), header length: 4, sequence length: 866
103752        0x19548         Certificate in DER format (x509 v3), header length: 4, sequence length: 983
104741        0x19925         Certificate in DER format (x509 v3), header length: 4, sequence length: 864
111122        0x1B212         Certificate in DER format (x509 v3), header length: 4, sequence length: 803
111931        0x1B53B         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024
114049        0x1BD81         Certificate in DER format (x509 v3), header length: 4, sequence length: 808
114863        0x1C0AF         Certificate in DER format (x509 v3), header length: 4, sequence length: 988
124724        0x1E734         Certificate in DER format (x509 v3), header length: 4, sequence length: 866
125596        0x1EA9C         Certificate in DER format (x509 v3), header length: 4, sequence length: 983
126585        0x1EE79         Certificate in DER format (x509 v3), header length: 4, sequence length: 864

I believe binwalk gave false postive output as the dump probably isn't a packed image. I say this because I also ran strings on the dump and received a lot of readable strings a snippet is shown below:

I'm tryring to extract the firmware so I can use QEMU and try to do some vulnerability findings. I'm doing this for knowledge sake but I am inexperience with reading dump files. Can someone point me in the direction that would teach me how to decipher the memory dump and eventually extract the firmware. I really want to learn how to read the dump because I plan to analyze other firmwares hence I want to learn the essentials. For instance I know that there are firmwares that are packed/unpacked and/or encrypted/unencrypted. They usually consist of bootloaders, OS, filesystem, libraries, and apps (such as webserver). Can some point me in the direction of some useful resource that will teach me how to read dump and determine how to get the firmware out with all right files (filesystem, bootloader, apps, etc...)?

Thanks in advance

Answer 1

I believe binwalk gave false postive output

It is likely the output is not false positive. You can see the strings used in certificates.

For instance I know that there are firmwares that are packed/unpacked and/or encrypted/unencrypted

This is the direction you would want to check. Binwalk has an entropy analysis option, and it can display a graph of it. Encrypted or packed files will have high and uniform entropy.

I'm tryring to extract the firmware so I can use QEMU and try to do some vulnerability findings.

While the CPU architecture might be well-known, device like this will likely have a custom SoC with little to none available documentation. I don't think you will be to do a complete emulation of the device, so static analysis can be a preferred option.

Can someone point me in the direction

If you really have JTAG access, you can try dumping RAM, since it may contain unpacked/decrypted code. However, I suspect this is in fact a dump of SPI flash chip. Actual JTAG access may have been disabled by manufacturer.

Answer 2

If you only want the firmware, you can find it in this link. And this link might be of use. Apparently the chip on your box is a BCM3361, a MIPS32 according to Broadcom. I think you can emulate it with QEMU, no obvious issues there.

Your dump is more likely to be a mix of code and data. It's pretty hard to dissociate data from code; you'll have to go in with a substantial entropy analysis (data and code entropy are very different). You can check the different Binwalk options here, the explanations are pretty clear.