0

I'm trying to extract code from Yuneec Drone Firmware and I've run into some issues. Currently when I run binwalk agains the file, I get the following issues: 

binwalk autopilot.yuneec.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
980           0x3D4           Unix path: /xA0fD/84kP/EX/tXDcRvBzP9P7bzsfTHQdqfUm4zLbytkngf/Q3vmzj2Yq5Z8PcPbz9Xr2rVS+3C9mxH6/hv+1az7AF8jjGYGJbh6B5+5lvPWRhvcYnww7WRMdYXU+/
20772         0x5124          StuffIt Deluxe Segment (data): fC+p1/WeN+x6czuMKj/2G97vs7bIlzF9t82VVYQdsBVEperQb/356B5eTU4a1S7KhOJMYkGX0UIgBnWVoOiawdyqh+jIXg4yBi3qEy0TAzdhx/RwATTujWRGgu6qUPDX
63677         0xF8BD          Unix path: /AX5BC/lwR/velbnL9Z26N8WkNPRKvRO9U6/Yeim7oVvEVZssaKxYSrcDXs1EswWwxG/q47kDI8f2QpdO82ijIuW6KrNWyrC7mFSTMGxdTkE77D/IFVwXMUhDG5DdaVd
544996        0x850E4         StuffIt Deluxe Segment (data): f1KJONum4Fp1JGYhMLa6U6dznBT9ORW23cOYJZnU7ijq+AwegqRxK9Von+ry5p35p6LZBShghnv8RjszI+TzBZ17KvvMN+Qj5may1mfVTQR96rur5jzYLQ5pDngg+qRq
701252        0xAB344         StuffIt Deluxe Segment (data): fa/4N9fZZBH9/RjZN2xQsGR2SYhibs+pJAjQYrytk/gsWWv9771tt8c/VLs703HuQSUQU7/9jHQEybWaK3sCf1olsktUNZv52TsSKZD1OlYB0hGlSeLX9QkWS+5FjMEH
1058597       0x102725        Unix path: /MHRJqXEzbl/z7hCM/vEnhS/cF6wOY+T8ywvmLCsMoaJfYdaj5k+8cU0yrKbd+HNFZv1JoQxLPGAUnEy9hj3a/0ENDO2Rs2m4bpBLjMDbE8fYIDiVvSEYFm2YT3tCw/a
1082116       0x108304        StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV
1112905       0x10FB49        StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5
1224852       0x12B094        StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU

For the look of this, it looks like the file is compressed and encrypted somehow, but I can find a match looking a hexdump of the file: 

hexdump -C autopilot.yuneec.bin | head -n 10
00000000  7b 0a 20 20 20 20 22 62  6f 61 72 64 5f 69 64 22  |{.    "board_id"|
00000010  3a 20 36 36 2c 20 0a 20  20 20 20 22 61 69 72 66  |: 66, .    "airf|
00000020  72 61 6d 65 5f 78 6d 6c  22 3a 20 22 65 4e 72 6c  |rame_xml": "eNrl|
00000030  55 38 46 4f 67 30 41 51  76 66 73 56 45 77 37 32  |U8FOg0AQvfsVEw72|
00000040  31 41 4a 74 59 30 77 4b  74 49 33 47 47 71 4f 4a  |1AJtY0wKtI3GGqOJ|
00000050  4e 74 58 30 5a 6c 59 36  68 54 58 73 44 6c 6b 57  |NtX0ZlY6hTXsDlkW|
00000060  30 2f 72 31 41 6f 56 41  74 56 52 37 39 6b 44 43  |0/r1AoVAtVR79kDC|
00000070  76 70 6e 33 5a 6e 62 6d  72 54 50 65 69 41 67 2b  |vpn3ZnbmrTPeiAg+|
00000080  55 43 57 63 70 4e 75 78  65 31 59 48 55 50 71 30  |UCWcpNuxe1YHUPq0|
00000090  34 6a 4a 77 4f 38 2b 4c  6d 2b 35 6c 5a 2b 79 64  |4jJwO8+Lm+5lZ+yd|

looking further into the file, I see that there are several files and I'm able to extract them. But from the HEXDUMP I can see there is a structure of files with in the hexdump. Here is some evidence from a longer hexdump of the file: 

hexdump -C autopilot.yuneec.bin | head -n 70
00000000  7b 0a 20 20 20 20 22 62  6f 61 72 64 5f 69 64 22  |{.    "board_id"|
00000010  3a 20 36 36 2c 20 0a 20  20 20 20 22 61 69 72 66  |: 66, .    "airf|
00000020  72 61 6d 65 5f 78 6d 6c  22 3a 20 22 65 4e 72 6c  |rame_xml": "eNrl|
00000030  55 38 46 4f 67 30 41 51  76 66 73 56 45 77 37 32  |U8FOg0AQvfsVEw72|
00000040  31 41 4a 74 59 30 77 4b  74 49 33 47 47 71 4f 4a  |1AJtY0wKtI3GGqOJ|
00000050  4e 74 58 30 5a 6c 59 36  68 54 58 73 44 6c 6b 57  |NtX0ZlY6hTXsDlkW|
00000060  30 2f 72 31 41 6f 56 41  74 56 52 37 39 6b 44 43  |0/r1AoVAtVR79kDC|
00000070  76 70 6e 33 5a 6e 62 6d  72 54 50 65 69 41 67 2b  |vpn3ZnbmrTPeiAg+|
00000080  55 43 57 63 70 4e 75 78  65 31 59 48 55 50 71 30  |UCWcpNuxe1YHUPq0|
00000090  34 6a 4a 77 4f 38 2b 4c  6d 2b 35 6c 5a 2b 79 64  |4jJwO8+Lm+5lZ+yd|
000000a0  4f 59 79 72 74 57 49 43  45 2b 38 4d 77 43 6e 7a  |OYyrtWICE+8MwCnz|
000000b0  50 64 73 78 71 39 38 63  72 70 4a 65 53 2f 42 56  |Pdsxq98crpJeS/BV|
000000c0  73 48 64 53 65 56 5a 4c  35 44 43 4a 79 7a 5a 53  |sHdSeVZL5DCJyzZS|
000000d0  45 64 6b 6a 42 59 72 53  47 4c 68 67 41 62 72 47  |EdkjBYrSGLhgAbrG|
000000e0  4c 57 37 59 6e 44 53 70  70 51 45 79 69 2b 34 51  |LW7YnDSppQEyi+4Q|
000000f0  6c 53 4f 77 4d 58 4a 69  67 77 70 38 35 52 6f 58  |lSOwMXJigwp85RoX|
00000100  56 74 38 32 51 44 41 75  64 66 61 68 63 6f 30 48  |Vt82QDAudfahco0H|
00000110  70 6e 58 49 57 51 49 7a  52 57 39 77 48 75 6d 52  |pnXIWQIzRW9wHumR|
00000120  4b 4a 48 4a 4e 70 57 49  76 73 49 45 6d 66 4c 44  |KJHJNpWIvsIEmfLD|
00000130  6e 6b 2f 69 50 4e 43 6a  71 74 51 4d 4d 7a 37 33  |nk/iPNCjqtQMMz73|
00000140  6f 56 45 53 41 69 53 42  57 6d 33 4c 32 6c 6c 31  |oVESAiSBWm3L2ll1|
00000150  50 32 4a 4a 34 6c 31 52  72 46 45 35 35 75 35 55  |P2JJ4l1RrFE55u5U|
00000160  78 65 6f 32 76 4a 4f 37  63 4d 77 47 75 78 4c 55  |xeo2vJO7cMwGuxLU|
00000170  32 78 69 39 52 6a 2b 4f  57 53 42 56 6d 46 49 64  |2xi9Rj+OWSBVmFId|
00000180  70 37 70 73 66 2f 71 38  74 41 31 76 6a 62 6a 71  |p7psf/q8tA1vjbjq|
00000190  36 6a 41 62 61 68 41 43  72 57 46 2b 42 58 6b 41  |6jAbahACrWF+BXkA|
000001a0  2f 4a 42 4a 69 5a 46 6a  37 6a 69 74 45 76 30 32  |/JBJiZFj7jitEv02|
000001b0  69 66 36 66 4a 51 5a 74  45 6f 50 44 45 72 56 50  |if6fJQZtEoPDErVP|
000001c0  43 6d 65 59 2b 39 59 34  34 70 61 6e 6c 4b 33 32  |CmeY+9Y44panlK32|
000001d0  33 5a 49 6a 78 39 77 79  74 4b 78 76 62 72 6b 6e  |3ZIjx9wytKxvbrkn|
000001e0  68 66 49 54 48 70 43 6a  4b 74 59 55 46 63 41 6b  |hfITHpCjKtYUFcAk|
000001f0  33 67 78 37 6e 41 37 5a  6f 36 36 78 42 4a 2f 6b  |3gx7nA7Zo66xBJ/k|
00000200  6d 67 63 6e 6d 2b 50 33  6f 75 31 75 61 46 7a 78  |mgcnm+P3ou1uaFzx|
00000210  48 37 6a 68 78 77 4a 74  79 39 70 66 34 42 32 46  |H7jhxwJty9pf4B2F|
00000220  45 71 34 4a 69 7a 6d 2b  5a 34 64 4a 39 6c 78 45  |Eq4Jizm+Z4dJ9lxE|
00000230  48 47 48 62 38 31 35 4d  48 37 73 76 77 35 4e 57  |HGHb815MH7svw5NW|
00000240  64 32 7a 77 76 37 6d 33  52 6a 4b 39 4c 33 61 46  |d2zwv7m3RjK9L3aF|
00000250  33 75 59 3d 22 2c 20 0a  20 20 20 20 22 61 69 72  |3uY=", .    "air|
00000260  66 72 61 6d 65 5f 78 6d  6c 5f 73 69 7a 65 22 3a  |frame_xml_size":|
00000270  20 31 34 35 33 2c 20 0a  20 20 20 20 22 6d 61 67  | 1453, .    "mag|
00000280  69 63 22 3a 20 22 46 49  58 4d 45 20 28 77 61 73  |ic": "FIXME (was|
00000290  3a 20 50 58 34 46 57 76  31 29 22 2c 20 0a 20 20  |: PX4FWv1)", .  |
000002a0  20 20 22 64 65 73 63 72  69 70 74 69 6f 6e 22 3a  |  "description":|
000002b0  20 22 46 69 72 6d 77 61  72 65 20 66 6f 72 20 74  | "Firmware for t|
000002c0  68 65 20 54 41 50 76 32  20 62 6f 61 72 64 22 2c  |he TAPv2 board",|
000002d0  20 0a 20 20 20 20 22 69  6d 61 67 65 22 3a 20 22  | .    "image": "|
000002e0  22 2c 20 0a 20 20 20 20  22 70 61 72 61 6d 65 74  |", .    "paramet|
000002f0  65 72 5f 78 6d 6c 5f 73  69 7a 65 22 3a 20 33 37  |er_xml_size": 37|
00000300  34 33 38 33 2c 20 0a 20  20 20 20 22 70 61 72 61  |4383, .    "para|
00000310  6d 65 74 65 72 5f 78 6d  6c 22 3a 20 22 65 4e 72  |meter_xml": "eNr|
00000320  73 76 65 31 32 32 74 6a  57 4c 76 67 2f 56 36 47  |sve122tjWLvg/V6G|
00000330  52 48 75 38 75 75 39 72  47 67 49 33 6a 56 46 56  |RHu8uu9rGgI3jVFV|
00000340  79 42 67 46 73 63 77 6f  62 4e 68 43 6e 55 6a 38  |yBgFscwobNhCnUj8|
00000350  4f 51 77 61 42 74 51 4d  53 72 79 54 73 75 4d 62  |OQwaBtQMSryTsuMb|

So there is evidence that the files are there, but I'm not able to extract them. I do get and extraction of the files by running the -e in contention with other options (can't recall now ) and there files are of the Stuffit Deluxe Segment already encountered on the original file. Here is the output of those: 

binwalk *.*

Scan Time:     2019-10-20 22:13:13
Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/108304.sit
MD5 Checksum:  c743a9f92c5f2ed0c63ad834f1f1a2ff
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV
1048          0x418           Unix path: /9IZpCOp8aA0pWxFoU/qICmgQCD06roNe/QhyUI/zphjCQriq9Y9bYLMDe2nGhIjeU0uqE82VdjGUDsPJmXXG3q3RnYaKEzSbh+heZA/o2KgUr2ilWoy5aEbcYkbSgZr
30789         0x7845          StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5
142736        0x22D90         StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU


Scan Time:     2019-10-20 22:13:14
Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/10FB49.sit
MD5 Checksum:  383e25c46cbe08f1f44f5ba4a7a2b23e
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5
1938          0x792           Unix path: /C3Yf6WlMao/H8X/P94eFW/P2jZ+WxAy6iX4GODwwvK7l3FAf7UkAmVVL157I13iX9BxN797C9LdV8yr+Tqih5ucCRW4pmxBiDv4LM5oCmFl3Lsy6hcvYkGBNq4OsALe
111947        0x1B54B         StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU


Scan Time:     2019-10-20 22:13:14
Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/12B094.sit
MD5 Checksum:  0cedc23fb97a6be737f8b19fe4fa83e8
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU
7816          0x1E88          Unix path: /xmNYmKIgj983/C6LNZBDZZ1PBYuFljKA/udUZWq/xcRk/b2qkMdFFFun24p1yfXj8HH6o+7BTY+yiuqS2wmFGQcyGnUNDejvqTCNY4RWSxwzgHMnxypHYN6dHtRo+Qy


Scan Time:     2019-10-20 22:13:14
Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/5124.sit
MD5 Checksum:  bdc1b18e4bcb42bc731245fcfa27b761
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             StuffIt Deluxe Segment (data): fC+p1/WeN+x6czuMKj/2G97vs7bIlzF9t82VVYQdsBVEperQb/356B5eTU4a1S7KhOJMYkGX0UIgBnWVoOiawdyqh+jIXg4yBi3qEy0TAzdhx/RwATTujWRGgu6qUPDX
5713          0x1651          Unix path: /AaIPd2yffa51zhvtrCbPfME/OwaB1UKFGtwC1VfCX/Bnz9PIOoW/Vlt/OuyUxJb2m8IdFNi0ltwJlJjD6brZvSnSVKCGztof2phz4ECcojhBc7SFMc0IBaTq4+VCrJF
42905         0xA799          Unix path: /AX5BC/lwR/velbnL9Z26N8WkNPRKvRO9U6/Yeim7oVvEVZssaKxYSrcDXs1EswWwxG/q47kDI8f2QpdO82ijIuW6KrNWyrC7mFSTMGxdTkE77D/IFVwXMUhDG5DdaVd
524224        0x7FFC0         StuffIt Deluxe Segment (data): f1KJONum4Fp1JGYhMLa6U6dznBT9ORW23cOYJZnU7ijq+AwegqRxK9Von+ry5p35p6LZBShghnv8RjszI+TzBZ17KvvMN+Qj5may1mfVTQR96rur5jzYLQ5pDngg+qRq
680480        0xA6220         StuffIt Deluxe Segment (data): fa/4N9fZZBH9/RjZN2xQsGR2SYhibs+pJAjQYrytk/gsWWv9771tt8c/VLs703HuQSUQU7/9jHQEybWaK3sCf1olsktUNZv52TsSKZD1OlYB0hGlSeLX9QkWS+5FjMEH
1052302       0x100E8E        Unix path: /diG/xwJS/rWqa4AL8ELFEfEhzsibv8h/qT9TXPHnMRgrYbXYbOHkUA5JUwilEpCy5tsSS4LU69URyqwMw4CrUlCgzLh4dpOvHnJDIBRHWPXCweEw8dZAeu99U7KlmjK
1061344       0x1031E0        StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV
1092133       0x10AA25        StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5
1204080       0x125F70        StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU


Scan Time:     2019-10-20 22:13:14
Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/850E4.sit
MD5 Checksum:  4470f1b474f55b2c49e0dd40533ec13b
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             StuffIt Deluxe Segment (data): f1KJONum4Fp1JGYhMLa6U6dznBT9ORW23cOYJZnU7ijq+AwegqRxK9Von+ry5p35p6LZBShghnv8RjszI+TzBZ17KvvMN+Qj5may1mfVTQR96rur5jzYLQ5pDngg+qRq
1429          0x595           Unix path: /YfDEvlo895/XIm8sDYIw8ZWQv/D1TF/uECwt/3mOgdKx/fVzbq3mNxVsLU4qRb3HAEbQa7NVLjv3yVdNmT0qaDnxw2V0FaK/CkbfZGTXogLx64h8UqCpqOd9zxnyJ+G
156256        0x26260         StuffIt Deluxe Segment (data): fa/4N9fZZBH9/RjZN2xQsGR2SYhibs+pJAjQYrytk/gsWWv9771tt8c/VLs703HuQSUQU7/9jHQEybWaK3sCf1olsktUNZv52TsSKZD1OlYB0hGlSeLX9QkWS+5FjMEH
537120        0x83220         StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV
567909        0x8AA65         StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5
679856        0xA5FB0         StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU


Scan Time:     2019-10-20 22:13:14
Target File:   /Users/user/Downloads/yuneec/_autopilot.yuneec.bin.extracted/AB344.sit
MD5 Checksum:  8047755915c77c23f72cefe7a31a77bf
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             StuffIt Deluxe Segment (data): fa/4N9fZZBH9/RjZN2xQsGR2SYhibs+pJAjQYrytk/gsWWv9771tt8c/VLs703HuQSUQU7/9jHQEybWaK3sCf1olsktUNZv52TsSKZD1OlYB0hGlSeLX9QkWS+5FjMEH
2763          0xACB           Unix path: /BiAgZQCJRb8x/JUIyQOuzHXLWBM/xk/6UNRj2qPbl3wmnJD8duNt3neZ1iPLIptCVW4lcj7/fAKkQQOPeRrMpnscX4yRK4jhBhfO7hbNAgQDS9lokF5ExXUoV2Jo5Bs
380864        0x5CFC0         StuffIt Deluxe Segment (data): fZcxfqH1QZ33Q+quNuNMPYZg9qJ/3M3SOGhOldNjDJcoyRvRqtBiAslAjG7AYP86RgvYpN5kXMeIVFxPE3akTeGUi/GFI1gHoc4PpMaEpOPYkj1ZbQQic2MqHRyiFGtV
411653        0x64805         StuffIt Deluxe Segment (data): fDRqiWlK6s45pRAmUYiAov0FWabq1Cvi5KUKBzSs8++MSIkrCv9/El3vtXoVbwZU0TYYqruo7MTnxgWmtyXDx/M6ybK8LWJjNbZgLXnfOwM6KcCLusn2kfHBh5aAUuQ5
523600        0x7FD50         StuffIt Deluxe Segment (data): fKVRaEDl88MUJZtOWVcMKNwBddGnczIsiNCoTZtmUYQBJXOExRD2NNAcFxqu1HoKASp5DzFqFNXWP37DJOMrejjQezP7jh7YeYuWOOuiqd/tthn6Gtb2SrxwLuUeCwnU

The issue is, that as I look at these files, it looks like they don't match the hexdump, so they might be misalign. Also you can see the repetitive in the files extracted.

Can someone point me in the right direction, I'm not having much luck extracting these files.

Improve this question
1
  • What do you know about the hardware platform? What type of processor? What is the basis for believing that there actual are "files" in the usual large system sense of the word?
    – Chris Stratton
    Oct 21, 2019 at 6:24

1 Answer 1

Reset to default
1

A few things:

  1. Please include an entropy plot of the file using the -E flag; this will show if any portion of the file is indeed compressed or encrypted.
  2. Please include a link to either the firmware download site or a direct download link, as well as a link to the UAV product page.
  3. The presence of plaintext strings such as "description" and "image" in the hex dumps shows that there are portions of the file that are not compressed/encrypted.
  4. The signature matches for "StuffIt Deluxe" segments are most likely false positives, since Stuffit Deluxe, which is compression software originally developed for use on Macintosh systems, is not used in the industry for compressing firmware.
  5. The Unix path detection results are most likely false positives

Since at time of writing no specifics about the product and hardware platform are given, I went ahead and took a look at the Typhoon H firmware. Here were some of the results:

$ binwalk cgo3+gb_3.2.34_LC2_A_firmware_30234.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
664           0x298           device tree image (dtb)
3199468       0x30D1EC        Linux kernel version "3.10.73 (yaoyunzhi@SERVER05) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & "
3207468       0x30F12C        gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
3291560       0x3239A8        LZO compressed data
3708100       0x3894C4        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/init/main.c
3708444       0x38961C        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/init/main.c
3711140       0x38A0A4        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/init/initramfs.c
3712026       0x38A41A        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/arch/arm/vfp/vfpmodule.c
3712504       0x38A5F8        Unix path: /home/yaoyunzhi/work/cgo3_5/ambarella/kernel/linux-3.10/arch/arm/vfp/vfpmodule.c

(Truncated)

The most important information is found at offset 0x30D1EC:

Linux kernel version "3.10.73 (yaoyunzhi@SERVER05) (gcc version 4.9.1 20140625 (prerelease) (crosstool-NG - Ambarella Linaro Multilib GCC [CortexA9 & "

It looks like embedded linux running on a ARM Cortex-A9 CPU.

You did not state your goal, but it appears that the file you are looking at does not contain the UAV firmware.

Searching for "airframe_xml" led me here: https://wiki.paparazziuav.org/wiki/Airframe_Configuration

Improve this answer
7
  • Hello @julian, thank you for the time to answer and your valuable input. Here is the link to the file in question. [link]webdownload-global.s3-us-west-2.amazonaws.com/Typhoon_Q500/… which is where I'm having the issues.
    – jemo
    Oct 22, 2019 at 15:44
  • Here is the entropy of the file: DECIMAL HEXADECIMAL ENTROPY -------------------------------------------------------------------------------- 0 0x0 Rising entropy edge (0.957803) 192512 0x2F000 Falling entropy edge (0.804297) 194560 0x2F800 Rising entropy edge (0.956437)
    – jemo
    Oct 22, 2019 at 15:45
  • BTW, the original file does not seem to be available any longer.
    – jemo
    Oct 22, 2019 at 15:47
  • @jemo I cannot download from that link (access denied). Please include an entropy plot - a visualization of the file entropy - in the body of your question (use the edit button). You can use binwalk or binvis.io
    – julian ♦
    Oct 23, 2019 at 11:45
  • @jemo please also add the rest of the requested information.
    – julian ♦
    Oct 23, 2019 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.