2

I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything. I tried commands

binwalk -Me file.bin
binwalk --dd='.*' file.bin

strings command against a firmware image not show any human readable strings. Entropy command returns Falling entropy edge (0.689208) Or possibly, binary image is neither encrypted nor compressed?

enter image description here

3

I tried:

$> binwalk --opcodes Image1.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
348           0x15C           MIPS instructions, function epilogue
516           0x204           MIPS instructions, function epilogue
652           0x28C           MIPS instructions, function epilogue
780           0x30C           MIPS instructions, function epilogue
1160          0x488           MIPS instructions, function epilogue
1268          0x4F4           MIPS instructions, function epilogue
2208          0x8A0           MIPS instructions, function epilogue
....

So, it really looks like a raw MIPS binary to me. I guess that this firmware is for a router or something similar.

You should just force your disassembler to take this file as raw MIPS and process it.

Note: A 'raw binary' is just a file with raw opcodes in it without any specific recognizable format (such as ELF, PE or Mach-O). Raw formats are just intended to be mapped directly in memory without going through an operating system first. It is very common in the embedded software World.

  • Yes, its firmware for eMTA modem, MIPS cpu. What linux based disassembler tool will be suitable for this? (for windows platform, I assume its IDA Pro, for sure). Is there way to convert raw opcodes into readable assembly code? – minto Jul 30 '18 at 10:16
  • I can advise you to read the answers of this SO question. It gives several good hints to solve your problem. And, you do not really need to convert the raw format into something else once you identified it. Just disassemble it. :) – perror Jul 30 '18 at 10:49
  • In this case, the other parts of firmware (bootloader, Perm.Nonvol, Dynamic Nonvol) also should be raw binary file format, ot they can be other format? At least one of them, Dynamic nonvol, have readable strings. – minto Jul 30 '18 at 12:09
  • It might be that the firmware is two parts: one part for a memory dump of the system and another part which will be the file-system which lies in a read-write mass memory. But, this is pure speculation, I do not have enough information to say more than wild guesses. – perror Jul 30 '18 at 12:16
  • For the other files, Bootloader and Permnonvol files have the same format, binwalk --opcodes show they are raw binary files with opcodes. Dynnonvol file is different, there are no opcodes, binwalk --dd='.*' extracted 6 files. So Flash Device regions have different format in my case. – minto Jul 31 '18 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.