We're having issues with the WiFi connectivity on the printers that we're using on a current project. The printer connects fine, but the ports that should be opened are not opened. They work fine on the wired network. Their support has tried to help, but so far hasn't been able to provide a solution. I suspect that the printers run an embedded linux, and I wouldn't mind having a look at the configuration files to see if there's anything in there that's obviously broken. I've downloaded the firmware from https://printers.averydennison.com/en/home/resources/service-and-support/utilities-and-firmware/9419-printer.html , but binwalk doesn't seem to find anything useful. I don't see any magic bytes or anything that would hint as to the structure of the file, and while there are recognisable strings (including the beginnings of some of the web pages from the config interface), they seem to get truncated in odd places, and with FF inserted at seemingly random intervals between characters.

My thought was that it may be a disk image that could be mounted, but I would have thought that binwalk would have identified that.

While I'd appreciate the answer to how to examine this firmware, I'd also like to fill in some of the gaps that I'm missing in my process, so any hints on what I should be looking for would be greatly appreciated.

  • Have you checked for opcodes yet? – Coldblackice Oct 6 '19 at 10:18
  • @Coldblackice How would I go about that? I would have thought that binwalk would identify any executable signatures, and the underlying architecture could be anything. – Andy Palmer Oct 7 '19 at 23:35
  • It's an option flag/parameter in binwalk, "--opcodes" || "-A". If binwalk finds any, you then at least have a lead by determining possible instruction set(s) the firmware is built upon, which can then be dumped into IDA for further analysis. – Coldblackice Oct 7 '19 at 23:46
  • @Coldblackice thanks. I think I had tried that in the past. I've just run it again and I get three hits for ARM function prologues. I suspect those may be false positives though. I think that the file is obfuscated, but not very well (there are large blocks of cleartext). I just don't know enough about RE to be able to identify the obfuscation method. – Andy Palmer Oct 9 '19 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.