0

I'm once again stuck on a binary image, which seems like it might be compressed, but I can't find any way to detect the compression used, let alone decompress it.

The binary in question is from a "Frontier Silicon FS2026 Internet Radio Module" using their "CHORUS 3" SoC. Their chip is supposedly using an Meta122 RISC CPU/DSP.

The image itself can be found here: link

The section in question can be found at offset 0x592C

It appears that the decompression algorithm might be in the section starting at 0x400 because it mentions terms along the lines of "CompSize", "DecompSize", "CompBuffer"..., and the CompSize has a uint32_t value before it, that is the exact size of the section starting at 0x592c

If you need any more information, I won't hesitate to clarify.

Best regards

Improve this question
2
  • At 0x592c it's just hex FF as far as the eye can see...
    – solumnant
    Mar 5 '20 at 18:32
  • 2
    Entropy analysis is a fantastic way to determine whether or not a file is packed in general, with the only exceptions being methods of encryption or files designed to fool entropy analysis. forensickb.com/2013/03/file-entropy-explained.html
    – solumnant
    Mar 5 '20 at 18:32
1

the file has many zlib chunks one 7z chunk several pngs etc

PNG 

:\>grep -obUaP "\x89PNG|IEND" foo.img
1737436:%PNG 1738231:IEND
1740163:%PNG 1744626:IEND
1791365:%PNG 1806922:IEND
1807844:%PNG 1811066:IEND
1813932:%PNG 1829489:IEND
1830411:%PNG 1833633:IEND

7z

:\>grep -obUaP "7z\xbc\xaf\x27\x1c" foo.img
1833641:7z¼_'∟

zlib (there may be false positives here but i arbitrarily python zlib.decompressed one chunk and it decompressed without error

:\>grep -obUaP "\x78\xda" foo.img |wc -l
23

:\>grep -obUaP "\x78\x9c" foo.img |wc -l
16

ripped this chunk and zlib decompressed it 

:\>xxd -s 0x1b2183 -l 16 -g 1 foo.img
001b2183: 78 da bd 58 dd 6f a3 38 10 7f ee 49 f7 3f cc f2  x..X.o.8...I.?..

:\>xxd -s 0x1b25dc -l 16 -g 1 foo.img
001b25dc: 78 da ed 3d 6b 73 1c b5 b2 9f 97 2a fe 83 58 72  x..=ks.....*..Xr



:\>xxd -l 16 onechunk.bin
00000000: 78da bd58 dd6f a338 107f ee49 f73f ccf2  x..X.o.8...I.?..

:\>wc -c onechunk.bin
1113 onechunk.bin

:\>cat deczli.py
import zlib
print(zlib.decompress(open("onechunk.bin","rb").read()))
:\>deczli.py

result 

b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">\r\n<html>\r\n\t<head>\r\n\t\t<meta http-equiv="cache-control" content="no-cache">\r\n\t\t<meta http-equiv="pragma" content="no-cache">\r\n\t</head>\r\n\r\n\t<body>\r\n<!-----\t\t<h3 id="spotify">Spotify Information</h3>\r\n\t\t<div class="new_line">\r\n\t\t\t<div id="status_username" class="line_title">Spotify username:</div>\r\n\t\t\t<div class="line_value netRemote_spotify_username">    
XXXXXXXXXXXXXXXXXXXXXXXX    
<div class="line_value netRemote_sys_net_ipConfig_dnsPrimary"></div>\r\n\t\t</div>\r\n\t\t<div class="new_line">\r\n\t\t\t<div id="status_dns_address_secondary" class="line_title">Secondary DNS Address:</div>\r\n\t\t\t<div class="line_value netRemote_sys_net_ipConfig_dnsSecondary"></div>\r\n\t\t</div>\r\n\t\t<div class="page_button">\r\n\t\t\t<input id="status_refresh" type="submit" value="Refresh" />\r\n\t\t</div>\r\n\t</body>\r\n</html>\r\n'
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.