I updated a device over a firmware update software and sniffed the whole traffic with wireshark. There is a TCP Stream with ~30MB which I exported as raw data. The resulting file is Zip archived data but it has a CRC error when I try to extract it with binwalk/7zip.

I also tried to export as hex dump and make xxd -r -p dump outfile.

In the pcap file are many TCP DUP ACK and TCP Out-Of-Order packets. I wonder if the exported binary takes over these dupes or out-of-order stuff.

I also tried chaosreader -r dump.pcap still corrupt.

Extracting the .exe with 7zip failed also with checksum error.

Any of you have any idea what I'm doing wrong?

  • Are those network packets ciphered with SSL keys or simple HTTP packets? If it was encrypted connection then you've to use Fiddler like tools to decrypt HTTPs traffic. – Biswapriyo Dec 6 '18 at 17:31
  • It's plaintext and no HTTP. After loading the firmware to the device it sends a command like "DO_FW_UPGRADE". It looks like an own protocol on port 5056/5053. – Johannes Dec 7 '18 at 7:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.