0

I'm trying to explore the firmware (Huawei LiteOS) of a Hi3518-based IP camera. From my explorations, it seems to be an uncompressed & unencrypted filesystem image but I can't seem to access the contents. I have no serial access to the device at all.

Running file on the firmware file returns

u-boot legacy uImage, 7518-hi3518-liteoslzm, Linux/ARM, Filesystem Image (any type) (Not compressed), 4002560 bytes, Sat Apr 20 04:36:35 2019, Load Address: 0x00000000, Entry Point: 0x00000000, Header CRC: 0x17BDF51E, Data CRC: 0x5C5FF340

binwalk only returns the following

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x17BDF51E, created: 2019-04-20 04:36:35, image size: 4002560 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x5C5FF340, OS: Linux, CPU: ARM, image type: Filesystem Image, compression type: none, image name: "7518-hi3518-liteoslzm"

Extracting everything after the header results in a binary file that I haven't been able to dump with JFFS2 (Wrong bit mask), SquashFS (No SquashFS superblock). Lzma says file format not recognized.

Opcodes show:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
2657993       0x288EC9        Ubicom32 instructions, function epilogue

Thanks for your help!

Hexdump added - Apr 16, 2020 (Full at: https://drive.google.com/file/d/1LXHaFbhyl5_Jba1Gsoa0JzuYE-SRy12o/view?usp=sharing )

First 12 lines:

0000040 12f0 003d 52c8 0065 0000 0000 0000 0000
0000050 c030 54fb 8c5e 5871 0405 3f10 4674 2100
0000060 6748 1004 00ca 00ce 00d2 450e 0040 0561
0000070 401a ff88 efef efef efef efef efef efef
0000080 efef 6b6f 26b4 0099 8b84 0f49 9440 f4a6
0000090 0400 4b04 ff4f bf2f bfbf bfbf bfbf bfbf
00000a0 bfbf bfbf bfbf afcd c055 7a71 8174 8401
00000b0 1889 4018 5470 003c e784 03c4 a040 adc0
00000c0 0401 1aeb 4018 3880 0189 2644 1819 e040
00000d0 9954 4401 d88d 4001 41e8 5a3c c490 2200
00000e0 0cc4 e00c 2221 d400 0200 a5a1 2003 c874
00000f0 00cc 92f2 0c0d 6820 d843 2200 ede4 2000

Entropy and Binvis enter image description here

enter image description here

  • could you add a hexdump of the first bytes after the header (offset 0x40)? – Igor Skochinsky Apr 15 at 18:54
  • Updated original post with hexdump – ehlzzy Apr 16 at 5:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.