Unable to extract IP camera firmware

Question

I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found nothing of value.

Binwalk returned absolutely nothing

xxd at least gave me back the firmware version

xxd -a s1131_402ES.img | head 00000000: 342e 3032 4530 0000 302e 3030 0000 0000 4.02E0..0.00.... 00000010: 1314 0000 1314 0000 0004 0000 8000 b003 ................ 00000020: 1f06 0000 0000 0000 0000 0000 0000 0000 ................ 00000030: 0000 0000 0000 0000 0000 0000 0000 8000 ................ 00000040: 0000 0000 0000 0000 0000 8000 0000 2003 .............. . 00000050: 0000 0000 0000 0000 0000 a003 9601 0000 ................ 00000060: 0100 0000 0000 0000 0100 0000 0000 0000 ................ 00000070: 0000 0000 0000 0000 0000 0000 0000 797d ..............y} 00000080: 5e12 3e81 1370 6400 a6fa c4e5 058b 3136 ^.>..pd.......16 00000090: 5630 f8f0 2878 5f56 7788 279b a597 114c V0..(x_Vw.'....L

A complete hex dump revealed no recognizable string

FDisk said there was no recognizable file system

7zip thinks it's corrupt

I'm thinking that it has to be some type of binary image but since no tools, I've tried have given any indication that any recognizable partitions or files existed, maybe it's obfuscated or has some type of encryption.

Answer 1

When performing firmware analysis, examination of an entropy plot should always be the first step, since this is the fastest way of determining whether the file is compressed or encrypted.

In this case, an entropy plot and the byte frequency distribution of the file indicate that it is encrypted. Hence, no signatures and nonsense strings.

Specifically:

• entropy level is very close to the maximum throughout the file.
• the distribution of byte values is close to uniform, indicating that the file is more likely to be encrypted than compressed.

Entropy plot produced via binwalk -E s1131_402ES.img:

Byte frequency distribution:

The code used to produce these plots as well as some discussion of the reasoning behind this choice of visualization can be found in this gist, and is included as a script here:

import numpy as np
import matplotlib.pyplot as plt
plt.rcParams['figure.figsize'] = [15, 5]
import seaborn as sns; sns.set()

def plot_relative_frequency_distribution(data, filename):

    # unvariate
    ax = sns.distplot(np.array(list(data)), 
                      bins=256, 
                      kde=False,
                      hist_kws={'alpha':0.8},
                      norm_hist=True, 
                      color='blue');
    ax.set(xlabel='Byte Value (base 10)', 
            ylabel='Relative Frequency', 
            title='Relative Frequency Histogram of Byte Values')
    # control x axis range
    ax.set_xlim(-10, 260)
    #ax.set_ylim(0, 0.10)
    ax.set_title(filename)


def plot_cdf(data, filename):
    ax = sns.distplot(np.array(list(data)), 
                      bins=256, 
                      kde=False,
                      hist_kws={'histtype':'step', 'cumulative': True, 'linewidth':1, 'alpha':1}, 
                      kde_kws={'cumulative': True},
                      norm_hist=True, 
                      color='red');

    ax.set(xlabel='Byte Value (base 10)', 
           ylabel='Probability', 
           title='CDF of Byte Values')
            # control x axis range
    ax.set_xlim(-10, 260)
    #ax.set_ylim(0, 0.10)

def create_plots(file):

    with open(file, 'rb') as f:
        data = f.read()

    # control layout
    grid = plt.GridSpec(1, 3, wspace=0.3, hspace=0.1)

    # first plot
    plt.subplot(grid[0, :2])
    plot_relative_frequency_distribution(data, f.name)

    # second plot
    plt.subplot(grid[0, 2:])
    plot_cdf(data, f.name)

    plt.show()

def main():
    create_plots('s1131_402ES.img')

Answer 2

Seems to be an encrypted file, probably made with bootloader of device (the camera), would need to get access to bootloader for trying reverse it and get the software algorithm.

The firmware package has some known headers, like the total lenght of the file in Little Endian (0x03B0xxxx) needed for deflate process.

So probably the Panasonic Brand would apply software protection for their firmwares, would be easy to get all code (boot + firm + data) from nor or nand flash from device by desoldering and reading bga IC but I doubt they would use cryptoprocessor..

Regards.