0

I am playing around with a xiaomi firmware [mijia_4k_0.6.16.02] for a camera

Running binwalk on the file I see this output

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1246033       0x130351        Certificate in DER format (x509 v3), header length: 4, sequence length: 518
3624121       0x374CB9        Certificate in DER format (x509 v3), header length: 4, sequence length: 3
4165132       0x3F8E0C        Unix path: /usr/local/share/script/bcm_disconn_device.sh
4180704       0x3FCAE0        Unix path: /usr/local/share/script/bt_start.sh
4218888       0x406008        Unix path: /usr/local/share/script/wifi_start.sh
4233160       0x4097C8        Unix path: /usr/local/share/script/bcm_start.sh HID&
4240412       0x40B41C        Unix path: /usr/bin/AmbaRTSPServer --en_audio --en_rtcp
4435576       0x43AE78        Unix path: /usr/local/share/script/wifi_set_setting.sh
4450536       0x43E8E8        Unix path: /usr/bin/fimi_moniter
4452856       0x43F1F8        Unix path: /usr/local/share/script/wifi_start.sh fast
4529204       0x451C34        CRC32 polynomial table, little endian
4531740       0x45261C        CRC32 polynomial table, little endian
4532888       0x452A98        Copyright string: "Copyright 2004-2014 Ambarella Corp."
4992168       0x4C2CA8        Unix path: /usr/local/share/script/sd_script.sh mount /tmp/SD0 c: ambafs
4993520       0x4C31F0        Unix path: /usr/local/share/script/sync_rtc.sh
5004056       0x4C5B18        Digi International firmware, load address: 0x504D5549, entry point: 0x4C324343,
5120308       0x4E2134        Unix path: /usr/bin/remoteapi_syssvc_daemon
6196757       0x5E8E15        MySQL MISAM compressed data file Version 3
6296161       0x601261        MySQL MISAM compressed data file Version 2
6296173       0x60126D        MySQL MISAM compressed data file Version 4
7593257       0x73DD29        MySQL MISAM compressed data file Version 1
8307929       0x7EC4D9        MySQL MISAM compressed data file Version 9
9611653       0x92A985        Neighborly text, "neighbor=%dration_threshold_0=%d _1=%d _2=%d _3=%d"
21415612      0x146C6BC       JPEG image data, JFIF standard 1.01
24183116      0x171014C       device tree image (dtb)
28385400      0x1B12078       Linux kernel version 3.10.7
28406940      0x1B1749C       gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
28491684      0x1B2BFA4       LZO compressed data
28571234      0x1B3F662       Unix path: /var/run/rpcbind.sock
29085488      0x1BBCF30       Unix path: /dev/vc/0
29164016      0x1BD01F0       xz compressed data
29194736      0x1BD79F0       Unix path: /lib/firmware/updates/3.10.71
29315074      0x1BF5002       Neighborly text, "neighbor %.2x%.2x.%pM losti/c1_work/svn_fimi/trunk/ambalink_sdk_3_10/linux/net/bridge/br_stp_timer.c"
29727764      0x1C59C14       ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
29727880      0x1C59C88       ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
29728004      0x1C59D04       ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
29728120      0x1C59D78       ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
29740988      0x1C5CFBC       CRC32 polynomial table, little endian
29985772      0x1C98BEC       UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000

binwalk -e doesn't work very well and i just get a makefile and some empty folders.

I think the firmware might be encrypted; because of the two certificates in DER format at the top of the file but I am unsure about this.

checking the entropy with binwalk and again; it doesn't seem to be encrypted

DECIMAL       HEXADECIMAL     ENTROPY
--------------------------------------------------------------------------------
0             0x0             Falling entropy edge (0.736286)
4177920       0x3FC000        Falling entropy edge (0.633902)
21635072      0x14A2000       Falling entropy edge (0.818787)
23842816      0x16BD000       Falling entropy edge (0.823909)
29011968      0x1BAB000       Falling entropy edge (0.652727)
32653312      0x1F24000       Falling entropy edge (0.668729)
33280000      0x1FBD000       Falling entropy edge (0.746394)
33390592      0x1FD8000       Falling entropy edge (0.630683)
35340288      0x21B4000       Falling entropy edge (0.815448)
35487744      0x21D8000       Falling entropy edge (0.814134)
35598336      0x21F3000       Falling entropy edge (0.818659)
35725312      0x2212000       Falling entropy edge (0.811020)
35872768      0x2236000       Falling entropy edge (0.807910)
35946496      0x2248000       Falling entropy edge (0.774434)
37621760      0x23E1000       Falling entropy edge (0.679220)
42127360      0x282D000       Falling entropy edge (0.661422)
42422272      0x2875000       Falling entropy edge (0.803659)
42569728      0x2899000       Falling entropy edge (0.849527)
42680320      0x28B4000       Falling entropy edge (0.807766)
42827776      0x28D8000       Falling entropy edge (0.813596)
42938368      0x28F3000       Falling entropy edge (0.786144)
43139072      0x2924000       Falling entropy edge (0.723178)
44371968      0x2A51000       Falling entropy edge (0.800123)
44519424      0x2A75000       Falling entropy edge (0.810571)
44740608      0x2AAB000       Falling entropy edge (0.670949)
45936640      0x2BCF000       Falling entropy edge (0.669111)
49762304      0x2F75000       Falling entropy edge (0.765717)
57507840      0x36D8000       Falling entropy edge (0.748053)
57581568      0x36EA000       Falling entropy edge (0.833038)
57856000      0x372D000       Falling entropy edge (0.846944)
58224640      0x3787000       Falling entropy edge (0.839880)
58593280      0x37E1000       Rising entropy edge (0.950003)
58630144      0x37EA000       Falling entropy edge (0.845293)
59015168      0x3848000       Falling entropy edge (0.647316)
59199488      0x3875000       Falling entropy edge (0.830295)
59310080      0x3890000       Falling entropy edge (0.713949)
59568128      0x38CF000       Falling entropy edge (0.673632)
62160896      0x3B48000       Falling entropy edge (0.807818)
62951424      0x3C09000       Rising entropy edge (0.961620)
62988288      0x3C12000       Falling entropy edge (0.816265)
66797568      0x3FB4000       Falling entropy edge (0.797360)
66945024      0x3FD8000       Falling entropy edge (0.799068)
67055616      0x3FF3000       Falling entropy edge (0.695640)
69537792      0x4251000       Falling entropy edge (0.844167)
69648384      0x426C000       Falling entropy edge (0.844830)
69795840      0x4290000       Falling entropy edge (0.751251)
72941568      0x4590000       Falling entropy edge (0.838126)

enter image description here I tried using dd to pull out the jpeg data but it seems like that might be a false positive.

Looking at some of the strings in the binary; there seems to be some 3rd party AI vision software; broadcom modem, zhouyanhui@compile:[gcc 4.9.3] etc...

My question; what are some other steps that I could take to get further into this firmware?

  • Does binwalk -eM produce additional output? – multithr3at3d Feb 2 at 23:28
  • @multithr3at3d same results as -e – btoinosis Feb 3 at 11:56
  • It really depends what your objective is. Things to look at include strings -t x firmware.bin or binwalk -A firmware.bin (which in this case will identify lots of ARM code) – Ian Cook Feb 5 at 21:11
  • You can also look at each of the interesting things that binwalk found to see if they are real or false-positives. e.g. the 2 certifcates matches are in the middle of and actually disassemble perfectly as ARM code. – Ian Cook Feb 5 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.