1

I am trying to reverse engineer the firmware upgrading process of BE126 wifi repeater which has a MIPS CPU.

I couldn't find a firmware upgrade image in the manufacturer site.

I have the toolchain for the processor.

I dumped the flash of the device,the flash consists of 3 partitions: 1.the boot partition 2.compressed Linux kernel 3.rootfs

In the boot partition the has an LZMA compressed file that by running strings on the decompressed output appear to be u-boot and it has some strings concerning the upgrading process

Unfortunately the second stage u-boot is in binary format without the uImage header how can i disassemble it?

I know i need to find the loading address but i don't know how,most of the research i found on the internet for such things had the uImage header that has the loading address.

I tried to reverse the first stage boot loader,I know the loading address but not the size of the code section.

an output of binwalk on the boot partition:

   DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
6488          0x1958          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 107408 bytes
70881         0x114E1         Zlib compressed data, default compression
83275         0x1454B         Zlib compressed data, default compression
95669         0x175B5         Zlib compressed data, default compression
136417        0x214E1         Zlib compressed data, default compression

the Zlib data are configuration files.

binwalk on the extracted LZMA:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
86608         0x15250         CRC32 polynomial table, big endian
99996         0x1869C         HTML document header
100720        0x18970         HTML document footer
100772        0x189A4         HTML document header
101132        0x18B0C         HTML document footer
101184        0x18B40         HTML document header
101523        0x18C93         HTML document footer
101576        0x18CC8         HTML document header
101824        0x18DC0         HTML document footer
101876        0x18DF4         HTML document header
102226        0x18F52         HTML document footer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.