2

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP

So far I've used binwalk and gotten the following output:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
333646        0x5174E         Certificate in DER format (x509 v3), header length: 4, sequence length: 518
1927791       0x1D6A6F        Certificate in DER format (x509 v3), header length: 4, sequence length: 1424
1927795       0x1D6A73        Certificate in DER format (x509 v3), header length: 4, sequence length: 1436
5310901       0x5109B5        Unix path: /var/lib/jenkins/workspace
5310945       0x5109E1        Unix path: /rtos/h2/dji/gui/ew/app/#
5784963       0x584583        Unix path: /var/lib/jenkins/workspace
5785007       0x5845AF        Unix path: /rtos/h2/dji/gui/ew/app/#
7769572       0x768DE4        MySQL MISAM index file Version 5
7962227       0x797E73        MySQL MISAM index file Version 5
8388145       0x7FFE31        MySQL ISAM index file Version 8
9291993       0x8DC8D9        MySQL ISAM index file Version 8
11240978      0xAB8612        MySQL ISAM index file Version 1
11431188      0xAE6D14        Unix path: /var/lib/jenkins/workspace
11546615      0xB02FF7        Unix path: /var/lib/jenkins/workspace
11723142      0xB2E186        Unix path: /1/4/5/6]
11747234      0xB33FA2        SHA256 hash constants, little endian
12234577      0xBAAF51        Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#"8
18849863      0x11FA047       Unix path: /H/I/R/S/X+Y+
19246275      0x125ACC3       Unix path: /N/P/Q/U/V/X/Y/
19557133      0x12A6B0D       Unix path: /I/L/O/T\
20332025      0x1363DF9       Unix path: /A/D/E/H/I/~S
20368127      0x136CAFF       Unix path: /L/O/P/ZJ
20790576      0x13D3D30       Unix path: /Q/S/T/X/Y/
22060039      0x1509C07       Certificate in DER format (x509 v3), header length: 4, sequence length: 1042
22060800      0x1509F00       Certificate in DER format (x509 v3), header length: 4, sequence length: 1120
22061549      0x150A1ED       Certificate in DER format (x509 v3), header length: 4, sequence length: 1146
22062317      0x150A4ED       Certificate in DER format (x509 v3), header length: 4, sequence length: 1181
22062989      0x150A78D       Certificate in DER format (x509 v3), header length: 4, sequence length: 1194
22681349      0x15A1705       JPEG image data, JFIF standard 1.01
22825947      0x15C4BDB       MySQL ISAM index file Version 4
23840137      0x16BC589       SHA256 hash constants, little endian
26045398      0x18D6BD6       lzop compressed data,900,
26862957      0x199E56D       LZO compressed data
26939728      0x19B1150       ELF, 64-bit LSB no file type,
27467411      0x1A31E93       Unix path: /sysdeps/ieee754/dbl-64/mpexp.c8
27868566      0x1A93D96       Executable script, shebang: "/bin/sh"
27893779      0x1A9A013       ELF, 64-bit LSB processor-specific,
28661360      0x1B55670       Base64 standard index table
28883640      0x1B8BAB8       ELF, 64-bit LSB processor-specific,
29837774      0x1C749CE       lzop compressed data,800, LZO1X-1, os: MS-DOS
29877499      0x1C7E4FB       eCos RTOS string reference: "ecosW"
29889527      0x1C813F7       HTML document header
29916857      0x1C87EB9       xz compressed data
30065108      0x1CAC1D4       Copyright string: "copyright (C) 1996 okir@monad.swb.de)."
30807857      0x1D61731       Executable script, shebang: "/bin/sh"
31158507      0x1DB70EB       Unix path: /Min/Max/Avg/Cnt): olA/%u/3
31299086      0x1DD960E       Unix path: /home/dji/Documents/projects/camera_h2_linux_sdk/
31922164      0x1E717F4       ELF, 64-bit LSB processor-specific,
31924192      0x1E71FE0       Executable script, shebang: "/bin/sh"
31998874      0x1E8439A       Unix path: /usb/gadget/udc/a4
32010492      0x1E870FC       ELF, 64-bit LSB no file type,
32144366      0x1EA7BEE       ELF, 64-bit LSB no file type,
32266556      0x1EC593C       SHA256 hash constants, little endian
32932163      0x1F68143       Copyright string: "Copyright (C) 0"
33074794      0x1F8AE6A       Executable script, shebang: "/bin/sh"
33130836      0x1F98954       Executable script, shebang: "/bin/sh"
33515696      0x1FF68B0       Copyright string: "Copyright (C) 2009-2014 Free Software Foundation, Inc."
33516339      0x1FF6B33       Unix path: /install/share/gcc-4.9.2/f
33572727      0x2004777       ELF, 64-bit LSB processor-specific,
34161574      0x20943A6       Unix path: /H2_linux_merge/output.oem/AC101/host/usr/bin/ccachen
34181264      0x2099090       SHA256 hash constants, little endian
34321478      0x20BB446       Executable script, shebang: "/bin/sh"
35104099      0x217A563       ELF, 64-bit LSB processor-specific,
35457510      0x21D09E6       ELF, 64-bit LSB no file type,
35713684      0x220F294       ELF, 64-bit LSB no file type,
36000342      0x2255256       HTML document footer
36254694      0x22933E6       Executable script, shebang: "/bin/sh"
36356499      0x22AC193       Executable script, shebang: "/bin/sh"
36356656      0x22AC230       ELF, 64-bit LSB processor-specific,
37963842      0x2434842       Executable script, shebang: "/bin/sh"
38068731      0x244E1FB       ELF, 64-bit LSB processor-specific,
38141809      0x245FF71       Executable script, shebang: "/bin/sh"
38141949      0x245FFFD       ELF, 64-bit LSB processor-specific,
38227525      0x2474E45       ELF, 64-bit LSB processor-specific,

This is a bit tricky, as I didn't initially know how to proceed. However, I first tried extracting the "xz compressed data" section using dd. I then tried to use unxz to extract the data, but it says that the xz is corrupt.

Next, I opened this xz inside of Bless hex editor and saw that it has the magic values: .7zXZ.YZ. I then researched and found out that .7zXZ is the start of the xz payload and YZ marks the end of it. So, if I'm not mistaken, this is a xz payload with only 1 byte in it, which seems to be a false alarm or maybe even a form of anti-reversing in this case. Moving on...

My next thought was to extract data using dd starting at the eCos RTOS reference. I opened the data in Bless to verify the magic value. Finally, I've opened it in IDA Pro but it does not parse the data correctly. I've tried MetaPC, ARM Little Endian (for which it asks bitness and I chose 32 bit and 64 bit). The only other options I can think of here are to try the LZ compressed areas but those are also commonly false positives. Lastly, I tried to extract and open the ELFs using 010 Editor and IDA Pro. In IDA, I get "The ELF header entry size is invalid (6096, expected 64). At this point, I could use some guidance from a more experienced firmware reverser.

Do I seem to be on the right track? What other steps would you take to locate the firmware goodies? Initially, these artifacts are all new to me.

  • 2
    Have tried to extract all the files with binwalk -eM ? That would be much simpler to let binwalk try by itself than do it yourself by hand, in my humble opinion. – perror Jan 16 at 8:18
  • @perror yes I do get a number of files - mostly ELFs but they don't seem to be parse-able. I try to open the files in IDA Pro and Ghidra and get parsing errors. I plan to spend more time looking through the non-ELF files, but this is what's made it a challenge so far. It almost seems as if these are "decoy ELFs", I examined the headers in 010 Editor and they have garbage values. – the_endian Jan 16 at 16:05
  • Then, these are probably false positive. You should maybe try other things... :-) – perror Jan 16 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.