I updated a device over a firmware update software and sniffed the whole traffic with wireshark. There is a TCP Stream with ~30MB which I exported as raw data. The resulting file is Zip archived data but it has a CRC error when I try to extract it with binwalk/7zip.

I also tried to export as hex dump and make xxd -r -p dump outfile.

In the pcap file are many TCP DUP ACK and TCP Out-Of-Order packets. I wonder if the exported binary takes over these dupes or out-of-order stuff.

I also tried chaosreader -r dump.pcap still corrupt.

Extracting the .exe with 7zip failed also with checksum error.

Any of you have any idea what I'm doing wrong?

  • Are those network packets ciphered with SSL keys or simple HTTP packets? If it was encrypted connection then you've to use Fiddler like tools to decrypt HTTPs traffic.
    – Biswapriyo
    Dec 6 '18 at 17:31
  • It's plaintext and no HTTP. After loading the firmware to the device it sends a command like "DO_FW_UPGRADE". It looks like an own protocol on port 5056/5053.
    – Johannes
    Dec 7 '18 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.