3

I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything. I tried commands

binwalk -Me file.bin
binwalk --dd='.*' file.bin

strings command against a firmware image not show any human readable strings. Entropy command returns Falling entropy edge (0.689208) Or possibly, binary image is neither encrypted nor compressed?

enter image description here

Improve this question

1 Answer 1

Reset to default
5

I tried:

$> binwalk --opcodes Image1.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
348           0x15C           MIPS instructions, function epilogue
516           0x204           MIPS instructions, function epilogue
652           0x28C           MIPS instructions, function epilogue
780           0x30C           MIPS instructions, function epilogue
1160          0x488           MIPS instructions, function epilogue
1268          0x4F4           MIPS instructions, function epilogue
2208          0x8A0           MIPS instructions, function epilogue
....

So, it really looks like a raw MIPS binary to me. I guess that this firmware is for a router or something similar.

You should just force your disassembler to take this file as raw MIPS and process it.

Note: A 'raw binary' is just a file with raw opcodes in it without any specific recognizable format (such as ELF, PE or Mach-O). Raw formats are just intended to be mapped directly in memory without going through an operating system first. It is very common in the embedded software World.

Improve this answer
5
  • Yes, its firmware for eMTA modem, MIPS cpu. What linux based disassembler tool will be suitable for this? (for windows platform, I assume its IDA Pro, for sure). Is there way to convert raw opcodes into readable assembly code?
    – minto
    Commented Jul 30, 2018 at 10:16
  • I can advise you to read the answers of this SO question. It gives several good hints to solve your problem. And, you do not really need to convert the raw format into something else once you identified it. Just disassemble it. :)
    – perror
    Commented Jul 30, 2018 at 10:49
  • In this case, the other parts of firmware (bootloader, Perm.Nonvol, Dynamic Nonvol) also should be raw binary file format, ot they can be other format? At least one of them, Dynamic nonvol, have readable strings.
    – minto
    Commented Jul 30, 2018 at 12:09
  • It might be that the firmware is two parts: one part for a memory dump of the system and another part which will be the file-system which lies in a read-write mass memory. But, this is pure speculation, I do not have enough information to say more than wild guesses.
    – perror
    Commented Jul 30, 2018 at 12:16
  • For the other files, Bootloader and Permnonvol files have the same format, binwalk --opcodes show they are raw binary files with opcodes. Dynnonvol file is different, there are no opcodes, binwalk --dd='.*' extracted 6 files. So Flash Device regions have different format in my case.
    – minto
    Commented Jul 31, 2018 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.