1

I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem.

The kernel is MIPS big endian. I loaded the kernel into IDA pro with start address of 0x80002000. The entry point is 0x801B2040.

The problem I have now is that all the functions are named as sub_. I need a symbol table to help me reverse this binary. Binwalk doesn't find any symbol tables and I'm not sure how to rebuild a symbol table, as I am new to this sort of stuff.

I read a post Rebuild symbol table, but that was about static and shared libraries, which my kernel is not.

Running file on my kernel gives

kernel: data

I don't know if the binary has a symbol table, but if it does, I don't know how to extract it. Or is there another way of reversing the binary?

Any help is appreciated.

EDIT: I have found what appears to be a symbol table. It has the libc string functions and lots of other functions. But there aren't many cross references to these function names in the disassembly. How do I use this?

  • does strings produce anything that looks like function names? – Igor Skochinsky Apr 8 '17 at 18:05
  • @Igor Skochinsky Running the command strings kernel | grep "()" seems to give a few functions arguments. Here is the output: pastebin.com/XeMxQU19 – Aaron Garton Apr 8 '17 at 18:36
  • names not arguments – Aaron Garton Apr 8 '17 at 18:59
  • I have found what appears to be a symbol table. It has many of the libc functions and lots of other functions. How do I use this? – Aaron Garton Apr 9 '17 at 20:24
  • add details to the post – Igor Skochinsky Apr 9 '17 at 20:25
2

It sounds like you aren't sure what you want to do exactly. Is there any part of the firmware you want to reverse engineer in particular? I suggest you first start by reading some blog posts on devttys0.com, as he seems like an excellent source for information about reverse-engineering router firmwares.

If a binary contains symbols, IDA Pro should automatically load them for you. Very often router firmwares have had their symbols stripped. However, the Linux kernel is licensed under the GPL, meaning that the manufacturer is obligated to provide the source code for the kernel. And Linksys does provide the source code for your router's kernel; you can start by looking at that.

Often, however, interesting stuff is in kernel modules and/or binaries in the rootfs, not the kernel itself. I downloaded the firmware for your router and extracted it with binwalk -Mrev, and binwalk was indeed able to extract the rootfs. Look through it to see if you can find anything interesting.

As an example, let's look at the main web CGI binary, usr/sbin/setup.cgi. Running file against this file gives the following:

usr/sbin/setup.cgi: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped

The binary has been stripped, but looking at the symbol table with readelf -s usr/sbin/setup.cgi, we can still see quite a few interesting function names. Next, we can look at the strings in the binary with strings. (I personally prefer using strings -n8 because often strings less than 8 characters are false positives, and when they aren't, they are usually unimportant anyways.) Often the strings of a binary can reveal quite a bit about what the binary does and how the binary works, and this is made easier by the fact that router manufacturers love using system(3) to run Linux shell commands.

Once you know that you have found an interesting binary, you can then load it into IDA Pro to disassemble it and start reverse-engineering it.

  • Thanks for the thorough answer :) Is binwalk -Mrev the same as binwalk -eM? And what is system(3), is it the same as system(cmd)? – Aaron Garton Jun 14 '17 at 9:11
  • 1
    @user2556381 They are basically the same thing, -r deletes leftover files like .squashfs filesystems once they've been extracted and -v is just verbose mode. The (3) in system(3) refers to the manpage section number; numbers are specified to differentiate between different manpages with the same names, such as the unlink shell command vs the syscall. To view the manpage for system(3), you would type man 3 system at the shell. (See man man for a list of these section numbers; this is the same as man 1 man.) The system() syscall is indeed called as system("command") from C. – Hitechcomputergeek Jun 17 '17 at 1:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.