Rebuilding a symbol table for a firmware binary

Question

I am trying to reverse engineer the Linksys WAG120N router firmware. I've been able to unpack it and extract the bootloader, kernel and filesystem.

The kernel is MIPS big endian. I loaded the kernel into IDA pro with start address of 0x80002000. The entry point is 0x801B2040.

The problem I have now is that all the functions are named as sub_. I need a symbol table to help me reverse this binary. Binwalk doesn't find any symbol tables and I'm not sure how to rebuild a symbol table, as I am new to this sort of stuff.

I read a post Rebuild symbol table, but that was about static and shared libraries, which my kernel is not.

Running file on my kernel gives

kernel: data

I don't know if the binary has a symbol table, but if it does, I don't know how to extract it. Or is there another way of reversing the binary?

Any help is appreciated.

EDIT: I have found what appears to be a symbol table. It has the libc string functions and lots of other functions. But there aren't many cross references to these function names in the disassembly. How do I use this?

Answer 1

It sounds like you aren't sure what you want to do exactly. Is there any part of the firmware you want to reverse engineer in particular? I suggest you first start by reading some blog posts on devttys0.com, as he seems like an excellent source for information about reverse-engineering router firmwares.

If a binary contains symbols, IDA Pro should automatically load them for you. Very often router firmwares have had their symbols stripped. However, the Linux kernel is licensed under the GPL, meaning that the manufacturer is obligated to provide the source code for the kernel. And Linksys does provide the source code for your router's kernel; you can start by looking at that.

Often, however, interesting stuff is in kernel modules and/or binaries in the rootfs, not the kernel itself. I downloaded the firmware for your router and extracted it with binwalk -Mrev, and binwalk was indeed able to extract the rootfs. Look through it to see if you can find anything interesting.

As an example, let's look at the main web CGI binary, usr/sbin/setup.cgi. Running file against this file gives the following:

usr/sbin/setup.cgi: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped

The binary has been stripped, but looking at the symbol table with readelf -s usr/sbin/setup.cgi, we can still see quite a few interesting function names. Next, we can look at the strings in the binary with strings. (I personally prefer using strings -n8 because often strings less than 8 characters are false positives, and when they aren't, they are usually unimportant anyways.) Often the strings of a binary can reveal quite a bit about what the binary does and how the binary works, and this is made easier by the fact that router manufacturers love using system(3) to run Linux shell commands.

Once you know that you have found an interesting binary, you can then load it into IDA Pro to disassemble it and start reverse-engineering it.