2

I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found nothing of value.

Binwalk returned absolutely nothing

xxd at least gave me back the firmware version

xxd -a s1131_402ES.img | head 00000000: 342e 3032 4530 0000 302e 3030 0000 0000 4.02E0..0.00.... 00000010: 1314 0000 1314 0000 0004 0000 8000 b003 ................ 00000020: 1f06 0000 0000 0000 0000 0000 0000 0000 ................ 00000030: 0000 0000 0000 0000 0000 0000 0000 8000 ................ 00000040: 0000 0000 0000 0000 0000 8000 0000 2003 .............. . 00000050: 0000 0000 0000 0000 0000 a003 9601 0000 ................ 00000060: 0100 0000 0000 0000 0100 0000 0000 0000 ................ 00000070: 0000 0000 0000 0000 0000 0000 0000 797d ..............y} 00000080: 5e12 3e81 1370 6400 a6fa c4e5 058b 3136 ^.>..pd.......16 00000090: 5630 f8f0 2878 5f56 7788 279b a597 114c V0..(x_Vw.'....L

A complete hex dump revealed no recognizable string

FDisk said there was no recognizable file system

7zip thinks it's corrupt

I'm thinking that it has to be some type of binary image but since no tools, I've tried have given any indication that any recognizable partitions or files existed, maybe it's obfuscated or has some type of encryption.

1
  • What you have may be some sort of updater archive rather than the firmware in usable form. One check would be that if the zip isn't much smaller than the contained image that indicates a high level of entropy compared to executable code meaning the image is probably compressed and/or encrypted. Your best bet may to be physically open the product to see what sort of processor it uses, and see if there is a flash chip perhaps containing the executable version of the firmware in a more direct form. But runtime decompression or decryption by a boot ROM or even hardware is possible.... Apr 18, 2019 at 14:54

2 Answers 2

7

When performing firmware analysis, examination of an entropy plot should always be the first step, since this is the fastest way of determining whether the file is compressed or encrypted.

In this case, an entropy plot and the byte frequency distribution of the file indicate that it is encrypted. Hence, no signatures and nonsense strings.

Specifically:

  • entropy level is very close to the maximum throughout the file.
  • the distribution of byte values is close to uniform, indicating that the file is more likely to be encrypted than compressed.

Entropy plot produced via binwalk -E s1131_402ES.img:

entropy plot

Byte frequency distribution:

distributions

The code used to produce these plots as well as some discussion of the reasoning behind this choice of visualization can be found in this gist, and is included as a script here:

import numpy as np
import matplotlib.pyplot as plt
plt.rcParams['figure.figsize'] = [15, 5]
import seaborn as sns; sns.set()

def plot_relative_frequency_distribution(data, filename):

    # unvariate
    ax = sns.distplot(np.array(list(data)), 
                      bins=256, 
                      kde=False,
                      hist_kws={'alpha':0.8},
                      norm_hist=True, 
                      color='blue');
    ax.set(xlabel='Byte Value (base 10)', 
            ylabel='Relative Frequency', 
            title='Relative Frequency Histogram of Byte Values')
    # control x axis range
    ax.set_xlim(-10, 260)
    #ax.set_ylim(0, 0.10)
    ax.set_title(filename)


def plot_cdf(data, filename):
    ax = sns.distplot(np.array(list(data)), 
                      bins=256, 
                      kde=False,
                      hist_kws={'histtype':'step', 'cumulative': True, 'linewidth':1, 'alpha':1}, 
                      kde_kws={'cumulative': True},
                      norm_hist=True, 
                      color='red');

    ax.set(xlabel='Byte Value (base 10)', 
           ylabel='Probability', 
           title='CDF of Byte Values')
            # control x axis range
    ax.set_xlim(-10, 260)
    #ax.set_ylim(0, 0.10)

def create_plots(file):

    with open(file, 'rb') as f:
        data = f.read()

    # control layout
    grid = plt.GridSpec(1, 3, wspace=0.3, hspace=0.1)

    # first plot
    plt.subplot(grid[0, :2])
    plot_relative_frequency_distribution(data, f.name)

    # second plot
    plt.subplot(grid[0, 2:])
    plot_cdf(data, f.name)

    plt.show()

def main():
    create_plots('s1131_402ES.img')
2
  • could you add the tools/commands you used to produce these graphs? (also in other answers)
    – Igor Skochinsky
    Apr 20, 2019 at 12:58
  • @IgorSkochinsky yes, I will add the details later. It is binwalk for the entropy analysis and a bit of python code for the byte distribution graphs
    – julian
    Apr 20, 2019 at 13:50
0

Seems to be an encrypted file, probably made with bootloader of device (the camera), would need to get access to bootloader for trying reverse it and get the software algorithm.

The firmware package has some known headers, like the total lenght of the file in Little Endian (0x03B0xxxx) needed for deflate process.

So probably the Panasonic Brand would apply software protection for their firmwares, would be easy to get all code (boot + firm + data) from nor or nand flash from device by desoldering and reading bga IC but I doubt they would use cryptoprocessor..

Regards.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.