I'm trying to reverse engineering my router firmware after reading an interesting article about an hidden backdoor inside router firmwares from a popular company.
Data has been extracted (using raspberry pi b+ spi) directly from flash because there isn't a downloadable firmware around.
partial serial output
Start to decompress!
Booting
Press 'ESC' to enter BOOT console...
Ext. phy is not found.
Boot from NOR/SPI flash
(c)Copyright Realtek, Inc. 2012
Project RTL8676S LOADER (LZMA)
Version 00.01.02a-rc (Nov 13 2014 17:15:26)
binwalk output
LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 70744 bytes
(lots of lines like this one)
findings
0x8000 to 0xE777: bootloader?
0x10000: rootfs start
first 0x13 byte: unknown data (header ?)
build date
string "router.img"
firmware data
I think firmware is encrypted. I can't extract bootloader, kernel and rootfs for static analysis. Is it possible to emulate using qemu? Fw link: flashimage pass: fi00
Thanks in advance