1

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to

  1. calculate and print a "machine key" to the serial port,
  2. close JTAG port forever, and
  3. write one-off AES key.

The machine key is required when downloading other demo firmware, reversing which is NOT the primary target of this post. For more context, see this thread. The point of the reversing is to figure out how to get the machine key without disabling JTAG permanently.

A quick analysis by binwalk yields nothing interesting.

$ binwalk -e key_gen_v1.2.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

Entropy analysis suggests that the firmware uses no obfuscation

enter image description here

Here is the output of strings

sP00sP 0sP@0sP@4
&#41'#0A'#<Q%#8a%#4q%#0
$#8A##4Q##0a##8
"#0!##<1!#8A!#<
$#8A##4Q##0a##8
                0000000000000000
0123456789abcdef
0123456789ABCDEF
                0000000000000000
                0000000000000000C
                0000000000000000
         (((((
V (%lu) %s: misaligned load recovered at %08lx. len:%02d,addr:%08lx,reg:%02d,data:%016lx,signed:%1d,float:%1d
V (%lu) %s: misaligned store recovered at %08lx. len:%02d,addr:%08lx,reg:%02d,data:%016lx,float:%1d
[0;31mE (%lu) %s: Out of memory
[0;33mW (%lu) %s: sys_exit called by core %ld with 0x%lx
[0;31mE (%lu) %s: Unsupported syscall %ld: a0=%lx, a1=%lx, a2=%lx!
?Error:  No workable settings found.
Error:  No appropriate ratio found.

In Reversing the WRT120N’s Firmware Obfuscation, the breakthrough was made by observing the output on the serial port. However, this particular firmware doesn't output much useful information to the serial port. In addition, I have yet find a decent disassembler for RISC-V (like IDA for ARM).

What can I do next?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.