0

everyone. I am a green apple in reversing. Recently i wanna reverse a switch but get some problems. i reaaaaaaaaly need your guys help.

first i extract the .bin file from the switch and use binwalk to analyse. but it shows nothing. then i rename the bin file into zip file and unzip it to a new bin file. this time binwalk told me this new bin seemed like a 7-zip file. so i rename it again as a .7z file and get a new bin second time.

For this time, i re-binwalk this new bin and i get this:

root@kali:/# binwalk -e ./root/Desktop/3900.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
15483795      0xEC4393        Copyright string: "Copyright(c) 1998-"
15483879      0xEC43E7        Copyright string: "Copyright(c) 2004-"
15508246      0xECA316        Unix path: /../../../software/config/cfgplane/cfg_msgp.c
15509456      0xECA7D0        Copyright string: "copyright-info enable"
15514394      0xECBB1A        Copyright string: "Copyright (c) 1998-%s Huawei Technologies Co., Ltd. All rights reserved."
15514526      0xECBB9E        Copyright string: "Copyright (c) 2004-%s 3Com Corporation and its licensors, All rights reserved."
15514690      0xECBC42        Copyright string: "Copyright (c) 2004-%s NEC Corporation. All rights reserved."
15514886      0xECBD06        Copyright string: "Copyright (c) 2004-%s Hangzhou H3C Technologies Co., Ltd. All rights reserved."
15515210      0xECBE4A        Copyright string: "Copyright(c) 1998-%s Huawei Tech. Co.,Ltd. All rights reserved."
15515486      0xECBF5E        Copyright string: "Copyright(c) 2004-%s 3Com Corporation and its licensors. All rights reserved."
15515566      0xECBFAE        Copyright string: "Copyright(c) 2004-%s NEC Corporation. All rights reserved."
15515736      0xECC058        Copyright string: "Copyright (c) 2004-%s Hangzhou H3C Technologies Co., Ltd. All rights reserved."
15518176      0xECC9E0        Copyright string: "copyright-info"
15530163      0xECF8B3        Copyright string: "copyright information"
15565459      0xED8293        Copyright string: "Copyright (c) 1998-%s by VRP Team Beijing Institute Huawei Tech, Inc"
15611066      0xEE34BA        Unix path: /../../../software/config/vosvfs/vfs_cmd.c
15614526      0xEE423E        Unix path: /../../../software/config/vosvfs/vfs_flsh.c
15626866      0xEE7272        Unix path: /../../../software/config/vosvfs/vfs_lio.c
15650452      0xEECE94        Base64 standard index table
15856182      0xF1F236        Unix path: /../../../software/ifnet/ifkern/if_func.c
15866478      0xF21A6E        Unix path: /../../../software/ifnet/ifkern/if_index.c
15868270      0xF2216E        Unix path: /../../../software/ifnet/ifkern/if_mib.c
15913506      0xF2D222        Unix path: /../../../software/ip/ipaddr/ip_addr.c
15949882      0xF3603A        Unix path: /../../../software/ip/ipicmp/ip_icmp.c
15985058      0xF3E9A2        Unix path: /../../../software/ip/ipmib/ip_mib.c
16088257      0xF57CC1        eCos RTOS string reference: "eCost"
16089638      0xF58226        Neighborly text, "NeighborspfVirtIfHelloInterval"
16112196      0xF5DA44        Neighborly text, "NeighborSolicitscmpInRedirects"
16112228      0xF5DA64        Neighborly text, "NeighborAdvertisementsupMembQueries"
16112669      0xF5DC1D        Neighborly text, "NeighborSolicitsmpOutRedirects"
16112701      0xF5DC3D        Neighborly text, "NeighborAdvertisementsupMembQueries"
16140727      0xF649B7        eCos RTOS string reference: "eCos"
16209471      0xF7563F        eCos RTOS string reference: "eCos"
16222603      0xF7898B        Neighborly text, "NeighborTablecDLDPNotification"
16222627      0xF789A3        Neighborly text, "NeighborEntryx"
16223179      0xF78BCB        Neighborly text, "NeighborBridgeMacidirection"
16223207      0xF78BE7        Neighborly text, "NeighborPortIndexrState"
16223263      0xF78C1F        Neighborly text, "NeighborStatenalPort"
16223287      0xF78C37        Neighborly text, "NeighborAgingTimeo"
16257031      0xF81007        eCos RTOS string reference: "eCos"
16330271      0xF92E1F        eCos RTOS string reference: "eCos"
16343083      0xF9602B        Neighborly text, "NeighborTablecDLDPNotification"
16343107      0xF96043        Neighborly text, "NeighborEntryx"
16343659      0xF9626B        Neighborly text, "NeighborBridgeMacidirection"
16343687      0xF96287        Neighborly text, "NeighborPortIndexrState"
16343743      0xF962BF        Neighborly text, "NeighborStatenalPort"
16343767      0xF962D7        Neighborly text, "NeighborAgingTimeo"
16380631      0xF9F2D7        eCos RTOS string reference: "eCos"
16421755      0xFA937B        Neighborly text, "NeighborTablecDLDPNotification"
16421779      0xFA9393        Neighborly text, "NeighborEntryx"
16422331      0xFA95BB        Neighborly text, "NeighborBridgeMacidirection"
16422359      0xFA95D7        Neighborly text, "NeighborPortIndexrState"
16422415      0xFA960F        Neighborly text, "NeighborStatenalPort"
16422439      0xFA9627        Neighborly text, "NeighborAgingTimeo"
16465775      0xFB3F6F        eCos RTOS string reference: "eCos"
16524211      0xFC23B3        Neighborly text, "NeighborLoss"
16600952      0xFD4F78        OpenSSH RSA public key
16600964      0xFD4F84        OpenSSH DSA public key
16601040      0xFD4FD0        Base64 standard index table
16653303      0xFE1BF7        Neighborly text, "Neighbor Information%s, %s, aging count %d"
16653330      0xFE1C12        Neighborly text, "neighbor %s(node %s)ormal"
16653477      0xFE1CA5        Neighborly text, "neighbor %s(node %s), aging count %d %s), aging count %d"
16653524      0xFE1CD4        Neighborly text, "neighbor %s(node %s), aging count %d02x"
16653751      0xFE1DB7        Copyright string: "Copyright (c) 2004-%s 3Com Corporation and its licensors, All rights reserved."
16653947      0xFE1E7B        Copyright string: "Copyright (c) Reserved."
16654087      0xFE1F07        Copyright string: "Copyright(c) 2004-%s Hangzhou H3C Tech. Co., Ltd. All rights reserved."
16654327      0xFE1FF7        Copyright string: "Copyright (c) 1998-%s Huawei Technologies Co.,Ltd. All rights reserved."
16657037      0xFE2A8D        Neighborly text, "Neighbor Informations(node %s)"
16657061      0xFE2AA5        Neighborly text, "Neighbor Information "
16657090      0xFE2AC2        Neighborly text, "neighbor %s(node %s)"
16670514      0xFE5F32        Unix path: /../../../software/vos/vosipc/ipc_intf.c
16680294      0xFE8566        Unix path: /../../../software/vos/vosipc/ipc_cmd.c
16724146      0xFF30B2        Unix path: /../../../software/lsw/devm/dev_api.c
16742510      0xFF786E        Unix path: /../../../software/lsw/devm/dev_cli.c
16775050      0xFFF78A        Unix path: /../../../software/lsw/devm/dev_cli2.c
16776610      0xFFFDA2        Unix path: /../../../software/lsw/devm/dev_dbp.c
16777922      0x10002C2       Unix path: /../../../software/lsw/devm/dev_di.c
16782142      0x100133E       Unix path: /../../../software/lsw/devm/dev_disp.c
16783018      0x10016AA       Unix path: /../../../software/lsw/devm/dev_drm.c
16786342      0x10023A6       Unix path: /../../../software/lsw/devm/dev_ekdm.c
16787106      0x10026A2       Unix path: /../../../software/lsw/devm/dev_ibc.c
16787458      0x1002802       Unix path: /../../../software/lsw/devm/dev_smth.c
16787634      0x10028B2       Unix path: /../../../software/lsw/devm/dev_ddm.c
16799838      0x100585E       Unix path: /../../../software/lsw/mam/mam_cfg.c
16802322      0x1006212       Unix path: /../../../software/lsw/mam/mam_hot.c
16806630      0x10072E6       Unix path: /../../../software/lsw/l2inf/src/inf_bdrn.c
16810006      0x1008016       Unix path: /../../../software/lsw/l2inf/src/inf_cfg1.c
16820550      0x100A946       Unix path: /../../../software/lsw/l2inf/src/inf_cfg2.c
16837078      0x100E9D6       Unix path: /../../../software/lsw/l2inf/src/inf_cmd.c
16838994      0x100F152       Unix path: /../../../software/lsw/l2inf/src/inf_func.c
16907862      0x101FE56       Unix path: /../../../software/lsw/l2inf/src/inf_init.c
16907970      0x101FEC2       Unix path: /../../../software/lsw/l2inf/src/inf_hot.c
16926534      0x1024746       Unix path: /../../../software/lsw/l2inf/src/inf_dbug.c
16933362      0x10261F2       Unix path: /../../../software/lsw/l2inf/src/inf_agg.c
16935970      0x1026C22       Unix path: /../../../software/lsw/l2inf/src/inf_irf.c
17022870      0x103BF96       Unix path: /../../../software/lsw/8021x/8021x_init.c
17023070      0x103C05E       Unix path: /../../../software/lsw/8021x/8021x_aut.c
17034054      0x103EB46       Unix path: /../../../software/lsw/8021x/8021x_cfg.c
17043978      0x104120A       Unix path: /../../../software/lsw/8021x/8021x_func.c
17061814      0x10457B6       Unix path: /../../../software/lsw/8021x/8021x_rcv.c
17062702      0x1045B2E       Unix path: /../../../software/lsw/8021x/8021x_snd.c
17064454      0x1046206       Unix path: /../../../software/lsw/8021x/8021x_tmr.c
17076050      0x1048F52       Neighborly text, "Neighbor %ld:  Aging Time: %ld(s)ld, Pkts Rvd: %ld, Pkts Err: %ld"
17076171      0x1048FCB       Neighborly text, "Neighbor Discovery Protocol Ver: %ld, Hello Timer: %ld(s), Aging Timer: %ld(s)g Timer: %ld(s)"
17076255      0x104901F       Neighborly text, "Neighbor Discovery Protocol is disabled.Protocol is enabled."
17077888      0x1049680       Neighborly text, "neighbor discovery protocol protocol"
17077933      0x10496AD       Neighborly text, "Neighbor discovery protocolent setting"
17206274      0x1068C02       Unix path: /../../../software/lsw/lacp/lacp_agt.c
17210514      0x1069C92       Unix path: /../../../software/lsw/lacp/lacp_al.c
17217766      0x106B8E6       Unix path: /../../../software/lsw/lacp/lacp_cfg.c
17224400      0x106D2D0       Ubiquiti partition header, header size: 56 bytes, name: "PARTNER_CHURN", base address: 0x52000000, data size: -1127147903 bytes
17226050      0x106D942       Unix path: /../../../software/lsw/lacp/lacp_fsm.c
17237842      0x1070752       Unix path: /../../../software/lsw/lacp/lacp_pub.c
17252458      0x107406A       Unix path: /../../../software/lsw/mac_auth/mac_auth.c
17261086      0x107621E       Unix path: /../../../software/lsw/mac_auth/mac_cfg.c
17429270      0x109F316       Unix path: /../../../software/lsw/port_sec/psec_func.c
17446945      0x10A3821       Neighborly text, "Neighbor discovery protocolor discovery protocol"
17447002      0x10A385A       Neighborly text, "Neighbor discovery protocolnt setting"
17449794      0x10A4342       Unix path: /../../../software/lsw/oadp/src/oadp_snd.c
17485268      0x10ACDD4       HTML document header
17485756      0x10ACFBC       HTML document footer
17485764      0x10ACFC4       HTML document header
17486039      0x10AD0D7       HTML document footer
17486048      0x10AD0E0       HTML document header
17486524      0x10AD2BC       HTML document footer
17486572      0x10AD2EC       HTML document header
17486771      0x10AD3B3       HTML document footer
17486780      0x10AD3BC       HTML document header
17487112      0x10AD508       HTML document footer
17487120      0x10AD510       HTML document header
17487466      0x10AD66A       HTML document footer
17487476      0x10AD674       HTML document header
17487685      0x10AD745       HTML document footer
17487696      0x10AD750       HTML document header
17488016      0x10AD890       HTML document footer
17516670      0x10B487E       Copyright string: "copyright C 1988 by the Institute of Electrical and "
17518516      0x10B4FB4       Copyright string: "Copyright 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The "
17518648      0x10B5038       Copyright string: "copyrighted by The"
17519959      0x10B5557       Copyright string: "copyright notice, "
17520092      0x10B55DC       Copyright string: "copyright notice, "
17520260      0x10B5684       Copyright string: "Copyright 1994-2002 FreeBSD, Inc. All rights reserved."
17520871      0x10B58E7       Copyright string: "copyright notice and this permission  *"
17520951      0x10B5937       Copyright string: "copyright notice appears in all  *"
17521134      0x10B59EE       Copyright string: "Copyright (c) David L. Mills 1992-2003  *"
17521554      0x10B5B92       Copyright string: "copyright notice applies to all files collectively called"
17521777      0x10B5C71       Copyright string: "Copyright law to grant that status or there are a variety of "
17522425      0x10B5EF9       Copyright string: "copyright notices impose conditions for redistribution, use "
17522850      0x10B60A2       Copyright string: "copyright claims of the distributing "
17522914      0x10B60E2       Copyright string: "copyright notices. Note that Linux "distributions" "
17523152      0x10B61D0       Copyright string: "copyright terms that are at odds with the OpenBSD license can not be included "
17523312      0x10B6270       Copyright string: "copyright notices based on the Berkeley model. Such material can be included "
17523858      0x10B6492       Copyright string: "copyrighted by individuals who have "
17525203      0x10B69D3       Copyright string: "copyrighted code. "
17525823      0x10B6C3F       Copyright string: "copyright is similar to the Berkeley copyright, except that it "
17525860      0x10B6C64       Copyright string: "copyright, except that it "
17525934      0x10B6CAE       Copyright string: "copyrights, which prevents the general distribution of "
17526252      0x10B6DEC       Copyright string: "copyright is similar to the Berkeley copyright, except "
17526289      0x10B6E11       Copyright string: "copyright, except "
17526396      0x10B6E7C       Copyright string: "copyright notice effectively releases any rights "
17526464      0x10B6EC0       Copyright string: "copyright, or where the material is the product of an "
17526652      0x10B6F7C       Copyright string: "copyright owner has "
17526721      0x10B6FC1       Copyright string: "copyrighted by manufacturers or "
17526943      0x10B709F       Copyright string: "copyrights, "
17527015      0x10B70E7       Copyright string: "copyrights can be included in "
17527062      0x10B7116       Copyright string: "copyright or included licensing terms similar to the Berkeley "
17527162      0x10B717A       Copyright string: "copyrights, or material to which AT&T has "
17527305      0x10B7209       Copyright string: "copyrights to much "Unix" code and documentation, "
17527451      0x10B729B       Copyright string: "copyrighted material. Material with Berkeley copyrights, or copyrights "
17527496      0x10B72C8       Copyright string: "copyrights, or copyrights "
17527511      0x10B72D7       Copyright string: "copyrights "
17527538      0x10B72F2       Copyright string: "copyright holder, while imposing minimal conditions on the use "
17527617      0x10B7341       Copyright string: "copyright is the model for the OpenBSD copyright. It retains the "
17527656      0x10B7368       Copyright string: "copyright. It retains the "
17527717      0x10B73A5       Copyright string: "copyrights. "
17527980      0x10B74AC       Copyright string: "copyright holder decide to "go commercial" he can not revoke permissions "
17528136      0x10B7548       Copyright string: "copyright holder can not retroactively say that an individual or class of "
17529073      0x10B78F1       Copyright string: "copyright, rather all "
17529141      0x10B7935       Copyright string: "copyright notice or associated "
17529184      0x10B7960       Copyright string: "copyright arises from the creation of a work and not the text or a "
17529378      0x10B7A22       Copyright string: "copyright on a derivative work can neither grant additional "
17529500      0x10B7A9C       Copyright string: "copyright holder "
17529872      0x10B7C10       Copyright string: "copyright law, usually subject to a variety of conditions. At one extreme "
17530100      0x10B7CF4       Copyright string: "copyright laws. "
17530284      0x10B7DAC       Copyright string: "copyrights arise from the creation of a work, rather than through a "
17530440      0x10B7E48       Copyright string: "copyright holder/distributor with respect to liability "
17530525      0x10B7E9D       Copyright string: "copyright law and with disclaimers that state "
17530688      0x10B7F40       Copyright string: "copyright to the material or to part of "
17530775      0x10B7F97       Copyright string: "copyrights, but rather notices "

i find nothing meaningful, if i use command: binwalk -Me 3900.bin, i get a bunch of nonsense. No single file could be analyzed in IDA pro. Only some html files were extracted.

And i doubt if this new bin file is some sort of file operation system but not recognized by binwalk.

So i don't know how to continue my reversing. if anyone could give any advice, i will appreciate a lot.

Any answer is welcome!

Thanks a lot!

  • Just to be clear, you're talking about a network switch, right? Or do you mean something else, like the Nintendo Switch console? – flarn2006 May 2 '18 at 19:55
  • I'm a college student. I'm learning how to unpack Cisco switch firmware recently. Can you tell me how to extract file components of Cisco switch firmware? thanks. – user30356 Dec 2 at 3:55
1

The answer is in your binwalk log several times:

16140727 0xF649B7 eCos RTOS string reference: "eCos"

This line means that your switch has an eCos RTOS (Real-Time Operating System), in which case you have only one binary file containing the OS and the application logic.

You can continue the reversing process by finding out the start address (typically somewhere above 0x80000000) and loading the binary into your favorite disassembler as a binary file.

0

I don't know the answer specifically. It looks like you might have gotten the file system with the web interface there.

When I do binwalk on a Cisco switch image I get:

user@user-KVM:~$ binwalk Downloads/c2960-lanbasek9-mz.150-2.SE4.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
168           0xA8            bzip2 compressed data, block size = 900k
9137337       0x8B6CB9        bzip2 compressed data, block size = 900k

That first chunk is probably a file header. It is 168 bytes long. I'd opt for the second part being interesting. I've used dd in linux to pull off components of files like this previously. That might be useful here too.

Recap, I have an original TAR file that I downloaded. I untarred that and got into the directory where the bin file lives. This is what I used binwalk on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.