0

I am trying to understand the firmware of a Grundfos CIM 500 product. The CIM 500 is a control module for grundfos pumps which uses a web interface.

From binwalk I have found that it is running eCos, but I have a very hard to to extract any information, file structure, ram file, disk images or anything of that matter.

I was hoping someone here with more experience with firmware analysis could give some help with what this firmware is, if it is compressed/encrypted, what kind of architecture the module is running, and how i could get more information from it.

I have viewed it in a hex editor and found traces of HTML, but no files or informative file headers.

The firmware is available on the Grundfos software page (https://www.grundfos.com/dk/support/software), or directly here:

https://www.grundfos.com/content/dam/local/da-dk/page-assets/support/software/documents/firmware-CIM500-V06.18.07-gdk-da.zip

1

Looking at the entropy of a file's contents is a good way to understand whether some/all of it is compressed or encrypted. Any good compression or encryption will result in entropy in the region of 95% or higher.

For this firmware, binwalk -E shows large areas with entropy in the 70-85% range (probably code), with other much lower (likely data) and only small areas with higher (the surrounding data suggests this is certificates.)

To identify the architecture, binwalk -A can sometimes help. However, in this case, it doesn't find anything it can identify.

However, looking through the data I found, at offset 0x1F4134, a list of opcodes. Googling for some of the more unusual looking ones (FLUSHDA, MULXUU, CALLR) returns a list of results all mentioning the Nios II architecture. This architecture is for Altera FPGAs.

Similarly, googling for an decent quality image of a CIM 500 shows a chip with what looks very much like an Altera FPGA's markings (albeit mostly covered with a sticker.)


Edit: I've done a further check to confirm the architecture.

Nios II encodes the ret (return) instruction as F800283A. The appears many times through the firmware file (in little-endian byte order.)

The first occurrence is at offset 0009D3B8, with offset 0009D100 being a plausible start for the code.

1
  • Thank you so much, this give a lot of further research we could perform. Feb 5 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.