I have the same problem from my previous post but this time, I don't think it's the same culprit again as I have solved the problems.

This time, I'm very sure I had extracted the firmware. On my hexdump, here is what I got: enter image description here

On binvis.io:

enter image description here

And lastly, binwalk: enter image description here

From the entropy, it shows that it's compressed rather than encrypted, right?

I tried to ignore the false positive and decided to proceed disassembling with Ghidra. But I got tons of error (I think so) because there were red and orange indicator on the side scroll bar, in the code browser, like the one you would get in Android Studio if there's an error.

On other websites, I found out that getting an output from the false positive is a crucial part to extract/disassemble.

So what seems to be the problem? Do I have to install something like matplotlib for it to work? If there's anything you want me to add, please don't hesitate to let me know. Thanks in advance.

Oh, it's a firmware from a Smart Door Lock using a nRF51802 if it matters.

  • Entropy close to 1 would indicate compression or encryption. Correct disassembly requires identifying the right target architecture of the code as well as the correct image base/entry point
    – julian
    Mar 2 '20 at 4:56
  • Any advice on where/how I should start? I'm feeling rather lost when all the guides I referred to has output on their false positive and would let them to proceed to the next step.
    – Calvin9
    Mar 2 '20 at 8:36
  • Thanks! I'll start there and see where it goes.
    – Calvin9
    Mar 3 '20 at 1:28
  • @julian hello there again. I still don't understand why I still get a lot of error bookmark after analyzing. Should I ignore it? I have not seen anyone having this problem on the net. Here's my file to see what I meant: filebin.net/059ks2hdhl9b9qkt Architecture used was the Arm v6 LE 32-bit
    – Calvin9
    Mar 10 '20 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.