5

I am trying to disassemble the firmware for the Cisco Sx300 switch as found here: https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76

While some documentation for other iterations of Wind River's firmware exist, I have not encountered a working set of tools for this particular firmware.

Binwalk gives some results:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Cisco VxWorks firmware header, header size: 80 bytes, number of files: 15, image size: 6988894, firmware version: "1.2.7.76"
209           0xD1            LANCOM WWAN firmware
1483          0x5CB           LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 16016448 bytes
3984149       0x3CCB15        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 859164 bytes
4153128       0x3F5F28        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2962457 bytes
4847723       0x49F86B        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2122505 bytes
6914211       0x6980A3        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66664 bytes
6932632       0x69C898        XML document, version: "1.0"
6950635       0x6A0EEB        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 121427 bytes

However, extraction with the -e flag doesn't provide meaningful results. Several files are extracted, but others end up as corrupt archives, or file that are are too small to be actual files. I am not certain that the LZMA compressed data isn't false positive.

Disassembly with IDA fails, as I do not know the loader address.

This Cisco help resource suggests that there is some form of compression going on: https://supportforums.cisco.com/t5/small-business-support-documents/how-to-recover-a-reboot-loop-on-sx300/ta-p/3134953

This help support post confirms that the Firmware is ARM based, but I am not certain as to the exact make of the chip.

I am aware that previous iterations of the VxWork's Firmware had the loader address in the header. Analysis of the header did not find a useable address at the suggested location (0x14)

Very likely a VxWorks Header

I attempted to match up the strings in the firmware to string tables and was not able to find any string tables, despite a thorough search. This supports my notion that it is compressed, or otherwise packed.

Lastly, I searched through the binary for probable addresses in order to deduce the loader address. I was not able to find any commonly referenced addresses or ranges. This was especially hard, as none of the binary was able to be correctly analyzed by IDA.

Am I missing something easy and fundamental here? Is there a special technique for VxWorks firmware?

3

This supports my notion that it is compressed, or otherwise packed.

You are correct; most of this firmware image is compressed or encrypted. In order to be disassembled the binary will have to be decompressed/decrypted.

Evidence of compression/encryption:

  1. binwalk entropy plot binwalk entropy plot

    The entropy level throughout most of the file appears to appears to be close to the maximum possible.

  2. Visualization via binvis.io:

    A visualization of the entropy of the firmware is on the left and a visualization of the entropy of an uncompressed file is on the right:

    firmware entropy binvis.io bash entropy

  3. ent (A Pseudorandom Number Sequence Test Program)

    $ ent sx300_fw-12776.ros 
    Entropy = 7.999864 bits per byte.
    
    Optimum compression would reduce the size
    of this 6988974 byte file by 0 percent.
    
    Chi square distribution for 6988974 samples is 1330.86, and randomly
    would exceed this value 0.01 percent of the times.
    
    Arithmetic mean value of data bytes is 127.3134 (127.5 = random).
    Monte Carlo value for Pi is 3.145007550 (error 0.11 percent).
    Serial correlation coefficient is 0.002524 (totally uncorrelated = 0.0).
    

    See http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.