0

I'm trying to patch strings in my firmware with a hex editor but I keep getting a checksum error when I go to re-flash the modded firmware onto my device. The device is a Roland gr-55 guitar synthesizer and here is a link to the firmware. Firmware download

So I run binwalk on the gr55.bin file and it tells me it's compressed with lha compression. So when I decompress it, it gives me appli.bin file. From there I open appli.bin with a hex editor and change the names of a couple strings. This is where I'm lost, I orignally just tried to re-compress the appli.bin file with lha compression and flash it to my device but nothing happens. I've tried using Firmware-mod-kit but it says my file is unsupported. I changed a few bytes in the compressed gr55.bin file and tried to flash it to see what happens and my device displayed the words checksum error.

The tutorials I have watched where they patch binaries they disassemble the firmware, find where the checksum function is and disable it. I don't have the cpu of my device yet so I'm unable to disassemble the firmware. All the forms and tutorials I found, where they rebuild firmware images seem to show examples of routers which have squashfs file systems and seems different from what I'm dealing with.

So I don't know how to properly rebuild my firmware image so when I go to re-flash I don't get a checksum error. Can somebody please help or point me in the right direction.

Improve this question

1 Answer 1

Reset to default
1

This seems to be a difficult target. Disclaimer: I have no idea about embedded/real-world device reverse engineering.

The way I'd approach the task is disassembling the firmware, find the checksum code, understand it, find where it looks for the checksum, then patch the firmware and calculate the proper checksum with the gained inside and patch it in.

If you check the "appli.bin" binary, you'll find the word "check sum", so the code is probably in there.

And this is where it gets difficult. In order to reverse engineer anything, we need to know what CPU is inside the GR55.

I found this excellent sheet: https://www.joness.com/gr300/service/GR-55_SERVICE_NOTES.pdf

It seems the main CPU is the R8A02021ABG, some Renesas CPU or something. IDA Pro has support for some Renesas CPUs but even with that knowledge and some more googling (http://forum.pianoworld.com/ubbthreads.php/topics/2385759/roland-bk-9-internals.html - the Roland BK9 seems to use the same CPU), I couldn't get IDA to disassemble more than 3-4 instructions anywhere inside appli.bin.

It's possible I just don't know what I'm doing but my expectation was that if I found the right CPU, telling IDA to disassemble code somewhere should at least produce a bunch of consecutive instructions even if I don't know anything about the appli.bin layout.

Some other page said IDA doesn't have processor support for the specific series used here.

You may be out of luck if that's the case because the only option then is guessing the right checksum algorithhm and where.

Improve this answer
1
  • Ya it seems I'm stuck in the same spot as you. I'll probably try your method and try to get the firmware disassembled. I have another post on here where someone helps me try to find the main cpu, it's on my profile, the person had a lot of good info if you want to check it out. I'm pretty sure the cpu is a renesas sh7727 but I think I'm going to send the device to a decapping service to be sure. Do you mind telling me what setting you used on ida. Thanks for the info.
    – Dukes Mayonnaise
    Dec 9, 2018 at 4:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.