1

I'm trying to reverse engineering my router firmware after reading an interesting article about an hidden backdoor inside router firmwares from a popular company.

Data has been extracted (using raspberry pi b+ spi) directly from flash because there isn't a downloadable firmware around.

partial serial output 

Start to decompress!
Booting
Press 'ESC' to enter BOOT console...
Ext. phy is not found. 
Boot from NOR/SPI flash
(c)Copyright Realtek, Inc. 2012
Project RTL8676S LOADER (LZMA)
Version 00.01.02a-rc (Nov 13 2014 17:15:26)

binwalk output 

LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 70744 bytes
(lots of lines like this one)

findings 

0x8000 to 0xE777: bootloader?
0x10000: rootfs start
  first 0x13 byte: unknown data (header ?)
  build date
  string "router.img"
  firmware data

I think firmware is encrypted. I can't extract bootloader, kernel and rootfs for static analysis. Is it possible to emulate using qemu? Fw link: flashimage pass: fi00

Thanks in advance

Improve this question
1
  • i have the same case like you now, Did you found the true file system and extracted ? Please give me hint. Thanks
    – Deject.d
    May 22, 2022 at 15:26

1 Answer 1

Reset to default
3

From what I can see, it appears to be a binary image for a MIPS processor (big endian). The image appears to be loaded at offset 0x80000000. There is a subroutine at 0x80001d70 offset which prints out the initial "Start to decompress!" message at PC 0x80001e38. Hopefully that should get you started.

Improve this answer
2
  • Thanks. It's a good starting point indeed. Do you think it's a single file (like VxWorks) as filesytem?
    – L. Darens
    Jun 26, 2017 at 16:20
  • Following your answer, I found that router os is ThreadX (RTOS) and bootloader is TBS bootloader. Can't find some good info/tools online... But there's some GPL source.
    – L. Darens
    Jun 26, 2017 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.