0

Would anyone be willing to help me with carving/extracting files from a firmware file? I've tried to extract with binwalk, but it didn't extract everything. I checked it out with ent to see if there's any encryption and there doesn't appear to be any from what I can tell.

It's firmware for Insta360 One camera and I want to inspect the file system/code to see how it works. Binwalk enumerates a unix filesystem, and I'm pretty sure the thing just runs on an ARM processor. Any help would be appreciated.

Here's a link to the .bin file

https://www.dropbox.com/s/ut9is9k1t6ih0gf/Insta360FW.bin?dl=0

| improve this question | |
  • And what tell you that is not extracted at all – realtebo Jul 8 '18 at 10:53
  • 1
    Can you narrow your question down to a specific problem? The strings command and a binwalk signature scan reveal a tremendous amount of information. If you can locate the firmware image entry point you can disassemble the code in the firmware. – julian♦ Jul 8 '18 at 15:18
  • Biswaprio - The best I can provide is the dropbox link there. You just have to click download and direct download in the top right corner. The camera is the Insta 360 one 360 cam. ---------------------- SYS_V - When I use the -Me flags to auto extract any found archives with binwalk, I end up with some empty folders and empty archives in the resulting extracted folder. I've tried using dd to copy and then extract specific areas, but I'm having a hard time locating a solution. – FakeHelicopterPilot Jul 8 '18 at 21:14
  • 2
    @FakeHelicopterPilot If nothing is compressed then there is nothing to extract. The signatures corresponding with compression are probably false positives, hence the empty folders. Looking at an entropy scan of the file shows that there are very few regions of high entropy and that these regions are very small. That means there is no compressed kernel or file system to extract. – julian♦ Jul 8 '18 at 21:33
6

From brief analysis of the file it looks that the Insta360 One camera is based on or variant of the Ambarella A9 SoC. So lets assume for the moment that we are dealing with Ambarella camera itself and its firmware as it's pretty hard IMO to develop your own HD camera HW and SW stack from scratch. There are some substantial evidence for that if one check strings in the firmware file:

  • /home/users/vincent/Insta360_ONE/insta360_one_u05/ambalink_sdk_3_10/output.oem/a12_ambalink/build/dbus-1.8.16/dbus/.libs
  • AmbarellaInc A9 Platform

Some further googling revealed that this SoC is also used in other products, among which is DJI Mavic drone. Following that lead, the following repo popped up with the tools that could be of help with your research: dji-firmware-tools

Before going further into file extraction, some words about the bin file itself. It is divided into several parts because I think of how the camera SoC loads things into RAM. Some parts are actually ELF files (part 00) and others are UBIFS partitions which you can inspect with the help of ubi_reader. So moving on to examples.

By using amba_fwpak.py, amba_romfs.py, arm_bin2elf.py it was possible to:

  • slice firmware into parts

    /ubidump/dji-firmware-tools # ./amba_fwpak.py -s -vv -m /Research/Insta360FW.bin 
/Research/Insta360FW.bin: Opening for search
/Research/Insta360FW.bin: Extracting entry  0, pos      252, len  6919456 bytes
/Research/Insta360FW.bin: Entry  0 checksum B77204FE
/Research/Insta360FW.bin: Extracting entry  1, pos  6919964, len  5079040 bytes
/Research/Insta360FW.bin: Entry  1 checksum F1EC7657
/Research/Insta360FW.bin: Extracting entry  2, pos 11999260, len  7266304 bytes
/Research/Insta360FW.bin: Entry  2 checksum F525FC58
/Research/Insta360FW.bin: Extracting entry  3, pos 19265820, len  6002936 bytes
/Research/Insta360FW.bin: Entry  3 checksum 13FB09E6
/Research/Insta360FW.bin: Extracting entry  4, pos 25269012, len 12976128 bytes
/Research/Insta360FW.bin: Entry  4 checksum 03A65A19

  • extract binaries - it's from one file, others have much more:

    /ubidump/dji-firmware-tools/file # ../amba_romfs.py -vv -s -p /Research/insta/Insta360FW_part_01.a9s 
/Research/insta/Insta360FW_part_01.a9s: Opening for search
/Research/insta/Insta360FW_part_01.a9s: Extracting entry 0: orccode.bin, 4376293 bytes
/Research/insta/Insta360FW_part_01.a9s: Extracting entry 1: orcme.bin, 432320 bytes
/Research/insta/Insta360FW_part_01.a9s: Extracting entry 2: default_binary.bin, 262144 bytes

  • converts one of the parts into a ELF file for static research - the base address comes from Insta360FW_part_00.a9h file:

    /ubidump/dji-firmware-tools # ./amba_sys2elf.py -vv -e -l 0xA0001000 -p /Research/insta/Insta360FW_part_00.a9s 
/Research/insta/Insta360FW_part_00.a9s: Opening for conversion to ELF
/Research/insta/Insta360FW_part_00.a9s: Opening         /Research/insta/Insta360FW_part_00.a9h
/Research/insta/Insta360FW_part_00.a9s: Memory base address set to 0xa0001000
/Research/insta/Insta360FW_part_00.a9s: Searching for sections
/Research/insta/Insta360FW_part_00.a9s: Matching '.ARM.exidx' section at 0x0054af80: 1 exception entries
/Research/insta/Insta360FW_part_00.a9s: Set '.ARM.exidx' section at file pos 0x0054af80, size 0x00000008
/Research/insta/Insta360FW_part_00.a9s: Set '.text' section at file pos 0x00000000, size 0x0054af80
/Research/insta/Insta360FW_part_00.a9s: Set '.data' section at file pos 0x0054af88, size 0x0014e598
/Research/insta/Insta360FW_part_00.a9s: Set '.bss' section at file pos 0x00699520, size 0x9f967ae0
/Research/insta/Insta360FW_part_00.a9s: ELF template 'amba_sys2elf_template.elf' copied to 'Insta360FW_part_00.elf', 5140 bytes
/Research/insta/Insta360FW_part_00.a9s: Section '.text' memory address set to 0xa0001000, alignment 0x40
/Research/insta/Insta360FW_part_00.a9s: Section '.ARM.exidx' memory address set to 0xa054bf80, alignment 0x40
/Research/insta/Insta360FW_part_00.a9s: Section '.data' memory address set to 0xa054bf88, alignment 0x08
/Research/insta/Insta360FW_part_00.a9s: Section '.bss' memory address set to 0xa069a520, alignment 0x20
/Research/insta/Insta360FW_part_00.a9s: Updating entry point and section headers
/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.text' from binary pos 0x00000000
/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.ARM.exidx' from binary pos 0x0054af80
/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.data' from binary pos 0x0054af88
/Research/insta/Insta360FW_part_00.a9s: Preparing ELF section '.bss' from binary pos 0x00699520
/Research/insta/Insta360FW_part_00.a9s: Writing changes to 'Insta360FW_part_00.elf'

And UBI partition looks similar to the following:

/ubidump # ubireader_display_info /Research/insta/Insta360FW_part_04.a9s
UBI File
---------------------
    Min I/O: 2048
    LEB Size: 126976
    PEB Size: 131072
    Total Block Count: 99
    Data Block Count: 97
    Layout Block Count: 2
    Internal Volume Block Count: 0
    Unknown Block Count: 0
    First UBI PEB Number: 0

    Image: 891379931
    ---------------------
        Image Sequence Num: 891379931
        Volume Name:linux
        PEB Range: 0 - 98

        Volume: linux
        ---------------------
            Vol ID: 0
            Name: linux
            Block Count: 97

            Volume Record
            ---------------------
                alignment: 1
                crc: '0xeae44dff'
                data_pad: 0
                errors: ''
                flags: 0
                name: u'linux'
                name_len: 5
                padding: u'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
                rec_index: 0
                reserved_pebs: 389
                upd_marker: 0
                vol_type: 'dynamic'

So I think this should be enough for you to get started. Good luck and have fun!

| improve this answer | |
  • 1
    Wow, PhoeniX. I really appreciate all the trouble you went to with this. Thanks so much for the detailed breakdown. – FakeHelicopterPilot Jul 10 '18 at 3:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.