2

I am hacking a chinese smartwatch. I extracted a animated GIF from its firmware and edited it to test my tools. The new filesize was less than the old one, so I added zero's with trunk command on Linux. However, after writing back the ROM, it refuses to boot without showing me anything. A friend of mine suggested me that there might be a simple checksum at end of file. However, I am unable to determine what kind of checksum it is in order to add it to my edited file. I added two sample files in this google drive folder (0 and 1 .gif). The original userspace firmware is FILE_01_mtk. If I look at the first file, there are only a few bytes after the '3B' marker (probably end of GIF). However, the second GIF is completely different, with the '3B' alot before.

Can someone help me figure out what checksum or hash is used?

Thanks, Alexandre Croteau

2

You can dump the ROM, disassemble, find the code that loads and reads the GIF, and you are sure to find the checksum algorithm.

Other than that, you pretty much have to run a guessing game, remembering to check both endians. If you were the developer, what might you use? Usually they are either common or simplistic.

0

There is too little information to answer this properly, but I suspect there may be a checksum on the whole firmware and not just per file. Try changing some bytes here and there (both in the target file and outside) and see if it works or not. In the worst case you'll need to disassemble the code and try to find the checking routine.

  • I'd like to know what information is missing. I tried to dissassemble using IDAPro but I can't find something looking like a checksum algorithm. I'm all in to give more info as needed to get help as I only want to learn more. – Alexandre Croteau Jan 12 '17 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.