1

I'm trying to reverse engineering my router firmware after reading an interesting article about an hidden backdoor inside router firmwares from a popular company.

Data has been extracted (using raspberry pi b+ spi) directly from flash because there isn't a downloadable firmware around.

partial serial output

Start to decompress!
Booting
Press 'ESC' to enter BOOT console...
Ext. phy is not found. 
Boot from NOR/SPI flash
(c)Copyright Realtek, Inc. 2012
Project RTL8676S LOADER (LZMA)
Version 00.01.02a-rc (Nov 13 2014 17:15:26)

binwalk output

LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 70744 bytes
(lots of lines like this one)

findings

0x8000 to 0xE777: bootloader?
0x10000: rootfs start
  first 0x13 byte: unknown data (header ?)
  build date
  string "router.img"
  firmware data

I think firmware is encrypted. I can't extract bootloader, kernel and rootfs for static analysis. Is it possible to emulate using qemu? Fw link: flashimage pass: fi00

Thanks in advance

3

From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out the initial "Start to decompress!" message at PC 0x80001e38. Hopefully that should get you started.

  • Thanks. It's a good starting point indeed. Do you think it's a single file (like VxWorks) as filesytem? – L. Darens Jun 26 '17 at 16:20
  • Following your answer, I found that router os is ThreadX (RTOS) and bootloader is TBS bootloader. Can't find some good info/tools online... But there's some GPL source. – L. Darens Jun 26 '17 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.