1

I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp.

Here's a link to the firmware.

  • Can you post a link to this firmware ? – w s Feb 14 '17 at 6:42
  • @ws I added a link to the post. – user3577138 Feb 14 '17 at 17:04
1

You can run binwalk with command line switch -A. If it will find specific opcodes it will report also the architecture. See Binwalk usage documentation for more details.

  • I doubt binwalk knows any DSPs. – Igor Skochinsky Feb 13 '17 at 13:30
  • @IgorSkochinsky You're right, I tried binwalk -A and nothing came up. – user3577138 Feb 13 '17 at 17:42
1

The architecture of the binary file cannot be reliably identified without access to the object code contained therein. In this case the object code is not accessible, since the binary is either compressed or encrypted.

Here is an entropy plot of the binary:

$ md5sum gxp1600fw.bin
b6a80bf243d66f3fabcc0a76d1420061  gxp1600fw.bin

binwalk entropy plot

Furthermore, binwalk does not detect any signatures in the file that typically demarcate a compressed block.

Not much can be said beyond speculating that this obfuscated file is probably composed of 6 different binaries:

00000000  f9 7a c9 23 67 78 70 31  36 30 30 72 65 63 6f 76  |.z.#gxp1600recov|
00000010  65 72 79 2e 62 69 6e 00  00 00 00 00 00 00 00 00  |ery.bin.........|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000040  00 00 00 00 67 78 70 31  36 30 30 63 6f 72 65 2e  |....gxp1600core.|
00000050  62 69 6e 00 00 00 00 00  00 00 00 00 00 00 00 00  |bin.............|
00000060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000080  00 00 00 00 67 78 70 31  36 30 30 62 61 73 65 2e  |....gxp1600base.|
00000090  62 69 6e 00 00 00 00 00  00 00 00 00 00 00 00 00  |bin.............|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0  00 00 00 00 67 78 70 31  36 30 30 70 72 6f 67 2e  |....gxp1600prog.|
000000d0  62 69 6e 00 00 00 00 00  00 00 00 00 00 00 00 00  |bin.............|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100  00 00 00 00 67 78 70 31  36 30 30 6c 63 6c 2e 62  |....gxp1600lcl.b|
00000110  69 6e 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |in..............|
00000120  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000140  00 00 00 00 67 78 70 31  36 30 30 6f 65 6d 2e 62  |....gxp1600oem.b|
00000150  69 6e 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |in..............|
00000160  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*

We can see 5 of the 6 segments in the entropy plot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.