I am currently trying to reverse-engineer the firmware of an E-Cigarette but I cannot find any clues with the common tools. Heres everything I found so far.

  • Binwalk doesnt recognize anything even with -E or -A.

  • Entropy = 7.611435 bits per byte.

  • Optimum compression would reduce the size of this 80896 byte file by 4 percent.

  • Chi square distribution for 80896 samples is 99630.01, and randomly would exceed this value less than 0.01 percent of the times.

  • Arithmetic mean value of data bytes is 117.2996 (127.5 = random).

  • Monte Carlo value for Pi is 3.078178312 (error 2.02 percent).

  • Serial correlation coefficient is 0.107920 (totally uncorrelated = 0.0).

Is it possible that this file is encrypted or compressed?

Here is a visualization of the entropy:

Entropy

And here is the graph of the entropy: Entropy_graph

Here is a download of the Firmware. https://www.file-upload.net/download-13422170/HW718V40_20171008.firmware.html

New contributor
Cubzer is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Can you share a link to the file? If not, can you post the entropy plot generated by binwalk -E <your file> ? The distribution of higher-entropy data is not as uniform as what I would expect from compressed or encrypted data. Furthermore, there are sizable low entropy regions. What are the results of running strings -n 9 <your file> ? Have you looked at a hex dump of the first few hundred bytes? – julian Dec 6 at 23:13
  • Hi I added the download to my question. I looked at the hexdump of the file and tried to disassemble it with radare2 and different flavours but nothing helpful came out of it. Im not at home so i unfortunatly cant provide you with a entropy Plot. The ASCII strings in the hexdump are also nothing that makes sense to me but maybe you find something. Thanks for the help. – Cubzer Dec 7 at 10:58
  • 1
    Wouldn’t it be wise to first identify the processor, and from that (hopefully) the instruction set? – eggyal Dec 9 at 22:28

The data in the file is neither compressed or encrypted.

----------------------------------v

For the details, see this gist. <-------------------------------

----------------------------------^

Basically:

We can determine whether data in a file is compressed or encrypted or not by looking at the distribution of byte values within the file.

  • we expect byte frequencies in encrypted data to have no patterns and be (very) close to uniformly distributed
  • we expect byte frequencies of compressed data to be close to uniformly distributed even if there are patterns evident in a relative frequency histogram.

The relative frequencies of byte values in the high entropy region of HW718V40_20171008.firmware and the associated cumulative distribution function indicate that the data in this file is neither compressed nor encrypted.

plots of data in file

A CDF of a uniform distribution will be a straight line with a slope of 1 running from (0,0) to (1,1) on a CDF plot. Byte values in compressed and encrypted data should be nearly uniformly distributed, so it follows that their CDFs should be nearly straight lines with slopes very close to 1.

As indicated in the CDF below, the distribution of byte values of the data in the compressed file and the encrypted file is extremely close to uniform. However, this is clearly not the case with the high-entropy data from file HW718V40_20171008.firmware.

Note: bash.gpg is AES-encrypted, the bin file is a compressed firmware file. Their CDFs are practically on top of each other, indicating nearly identical near-uniform distributions.

Again, a full explanation can be found in the gist file mentioned at the beginning.

CDF

Your Answer

Cubzer is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.