Unpacking ROM dump

Question

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode for firmware"), manual searching for know signatures (packers, CPU, filesystems) has not produced any result. In hex you can see pieces of repeating open text (0x6AD869h - 0x6AE6D3, 0x949C35 - EOF), first few string of file are this strings with some bit shift(probably), but i could't find a some system for this. Open text:

00949c40  53 65 65 6b 20 41 47 52  45 45 4d 45 4e 54 20 66  |Seek AGREEMENT f|
00949c50  6f 72 20 74 68 65 20 64  61 74 65 20 6f 66 20 63  |or the date of c|
00949c60  6f 6d 70 6c 65 74 69 6f  6e 2e 00 53 65 65 6b 20  |ompletion..Seek |
00949c70  41 47 52 45 45 4d 45 4e  54 20 66 6f 72 20 74 68  |AGREEMENT for th|
00949c80  65 20 64 61 74 65 20 6f  66 20 63 6f 6d 70 6c 65  |e date of comple|
00949c90  74 69 6f 6e 2e 00 53 65  65 6b 20 41 47 52 45 45  |tion..Seek AGREE|

First few strings:

00000000  da 7c 77 5b 08 c6 31 c5  45 d1 eb bd 4f 57 20 66  |.|w[..1.E...OW f|
00000010  6e 73 20 74 68 80 8a 56  61 74 65 20 6f 83 8a 51  |ns th..Vate o..Q|
00000020  6e 6d 70 6c 65 74 69 5b  6e 3f d6 e3 65 0f 8d f4  |nmpleti[n?..e...|
00000030  a8 e4 94 e0 2e 28 37 20  31 4c 66 6f 72 20 74 68  |.....(7 1Lfor th|
00000040  65 20 64 61 74 74 f6 13  67 20 63 6f 6d 95 c6 57  |e datt..g com..W|
00000050  74 69 6f 6e fd 4f 2b 26  42 6e 39 17 14 08 52 ad  |tion.O+&Bn9...R.|
00000060  18 17 a4 15 20 77 b9 6a  a0 74 48 65 a0 64 03 44  |.... w.j.tHe.d.D|
00000070  31 82 c1 66 25 66 6d 6e  3d 03 1d 15 44 26 39 0e  |1..f%fmn=...D&9.|
00000080  61 24 0e 45 18 45 33 2e  37 36 45 4d 45 4e 54 20  |a$.E.E3.76EMENT |
00000090  66 6f 72 20 74 68 65 20  39 61 74 65 21 6f a4 13  |for the 9ate!o..|
000000a0  63 6f 6d 70 6c 65 74 06  92 91 d1 a3 e4 1a ac b5  |complet.........|

See:

• Firmware.rom
• hex dump

Can anyone advise how to encrypt/unpack this, or what am I doing wrong?

Answer 1

Seek AGREEMENT for the date of completion.\0 or Seek AGREEMENT for the date of completion.  is a key applied by either addition or XORing input with output. You can see how it lines up with the hexdump. It should be relatively easy to write a program which would remove this level of obfuscation.

00000000  da 7c 77 5b 08 c6 31 c5  45 d1 eb bd 4f 57 20 66  |.|w[..1.E...OW f|
00000010  6e 73 20 74 68 80 8a 56  61 74 65 20 6f 83 8a 51  |ns th..Vate o..Q|
00000020  6e 6d 70 6c 65 74 69 5b  6e 3f d6 e3 65 0f 8d f4  |nmpleti[n?..e...|
00000030  a8 e4 94 e0 2e 28 37 20  31 4c 66 6f 72 20 74 68  |.....(7 1Lfor th|
00000040  65 20 64 61 74 74 f6 13  67 20 63 6f 6d 95 c6 57  |e datt..g com..W|
00000050  74 69 6f 6e fd 4f 2b 26  42 6e 39 17 14 08 52 ad  |tion.O+&Bn9...R.|

00000000  53 65 65 6b 20 41 47 52  45 45 4d 45 4e 54 20 66  |Seek AGREEMENT f|
00000010  6f 72 20 74 68 65 20 64  61 74 65 20 6f 66 20 63  |or the date of c|
00000020  6f 6d 70 6c 65 74 69 6f  6e 2e 00 53 65 65 6b 20  |ompletion..Seek |
00000030  41 47 52 45 45 4d 45 4e  54 20 66 6f 72 20 74 68  |AGREEMENT for th|
00000040  65 20 64 61 74 65 20 6f  66 20 63 6f 6d 70 6c 65  |e date of comple|
00000050  74 69 6f 6e 2e 00                                 |tion..          |