How to extract D-Link DCS-4603 camera firmware

Question

I tried extract the firmware image from the binary file available at the D-Link DCS-4603 Vigilance Full HD PoE Dome Network Camera technical support page it by using binwalk but failed. Is there another way to extract the firmware? Or is there another tool that I can use? Or you can guide my extraction efforts?

Answer 1

Recommendation: since the firmware is obfuscated, recover the bootloader

The firmware may be encoded, compressed, encrypted, or some combination of these. In order for the firmware image to be loaded into memory and execute, it must be deobfuscated. Since the bootloader is responsible for this, it is likely that deobfuscation of the binary file containing the firmware image is performed by a routine or set of routines within the bootloader. Locating the code handling deobfuscation will enable you to deobfuscate the binary file containing the firmware image yourself.

Recovering the bootloader requires access to the hardware. Several resources exist that will guide you in your efforts to dump the bootloader from the hardware as well as locate the deobfuscation code:

Reverse Engineering Serial Ports

Reversing the WRT120N’s Firmware Obfuscation

Turning a Webcam Into a Backdoor

Belkin F9K1111 V1.04.10 Firmware Analysis

How do I extract a copy of an unknown firmware from a hardware device?

Analysis

There are 2 firmware versions available for download at the page in the link provided:

• version 1.00.00
• version 1.01

Both were analyzed.

The binary files are named DCS-4603_A1_FW_V1.00.00.bin (version 1.00) and DCS-4603_A1_FW_V1.01.00.bin (version 1.01) when the packages containing them are unzipped.

Both files are approximately 15MB each, with version 1.01 being slightly larger than version 1.00:

15521100 DCS-4603_A1_FW_V1.00.00.bin
15848708 DCS-4603_A1_FW_V1.01.00.bin

1. strings and hexdump

Preliminary analysis using strings -n and hexdump -C did not reveal beyond the absence of ASCII strings in either ~15MB file as well as no discernible file header.

2. Entropy Analysis

Entropy was consistently high throughout both files:

DCS-4603_A1_FW_V1.00.00.bin:

DCS-4603_A1_FW_V1.01.00.bin:

A smooth entropy line and consistent entropy level throughout tends to indicate encryption. Reference: Differentiate Encryption From Compression Using Math.

As can be seen in the plots above, there was a perturbation in the entropy level in both files at offset ~0x002EB870. This was investigated further in when both files were diffed.

These plots also show that there are no areas of very low entropy in between areas of higher entropy. Such low entropy areas can indicate padding between different types of data in the binary file.

3. Diffing the Binary Files

There are at least 2 interesting regions of commonality between the 2 binary files: the region between offset 0x00000000 and 0x000068F0 and the site of the perturbation revealed in the entropy plots above, the region between offsets 0x002EB870 and 0x002ED320.

Diff of region between offsets 0x00000000 and 0x000068F0 (length of 26864 bytes):

The first four bytes, 73 00 2E 30, may be a signature of some kind.

Diff of region between offsets 0x002EB870 and 0x002ED320 (length of 6832 bytes):

To my (very) inexperienced eye, these relatively large regions of commonality suggest compression or encoding rather than encryption of similar underlying data.

Final observation: D-Link's documentation for the camera explicitly discusses encoding capability (emphasis mine):

To maximize bandwidth efficiency and improve image quality, the DCS-4603 provides real-time video compression using the H.264 and MJPEG codecs, and supports separate profiles for simultaneous video streaming and recording.

However, this my not play any role in how the binary file containing the firmware image is obfuscated.

Conclusion

The fastest way to decode the binary file in order to extract the firmware image seems to be dumping the bootloader and analyzing it to pinpoint the obfuscation routine(s).

is there another tool that I can use?

firmware mod kit

Signsrch (Windows exe)

deezee