Grundfos Firmware

Question

I am trying to understand the firmware of a Grundfos CIM 500 product. The CIM 500 is a control module for grundfos pumps which uses a web interface.

From binwalk I have found that it is running eCos, but I have a very hard to to extract any information, file structure, ram file, disk images or anything of that matter.

I was hoping someone here with more experience with firmware analysis could give some help with what this firmware is, if it is compressed/encrypted, what kind of architecture the module is running, and how i could get more information from it.

I have viewed it in a hex editor and found traces of HTML, but no files or informative file headers.

The firmware is available on the Grundfos software page (https://www.grundfos.com/dk/support/software), or directly here:

https://www.grundfos.com/content/dam/local/da-dk/page-assets/support/software/documents/firmware-CIM500-V06.18.07-gdk-da.zip

Answer 1

Looking at the entropy of a file's contents is a good way to understand whether some/all of it is compressed or encrypted. Any good compression or encryption will result in entropy in the region of 95% or higher.

For this firmware, binwalk -E shows large areas with entropy in the 70-85% range (probably code), with other much lower (likely data) and only small areas with higher (the surrounding data suggests this is certificates.)

To identify the architecture, binwalk -A can sometimes help. However, in this case, it doesn't find anything it can identify.

However, looking through the data I found, at offset 0x1F4134, a list of opcodes. Googling for some of the more unusual looking ones (FLUSHDA, MULXUU, CALLR) returns a list of results all mentioning the Nios II architecture. This architecture is for Altera FPGAs.

Similarly, googling for an decent quality image of a CIM 500 shows a chip with what looks very much like an Altera FPGA's markings (albeit mostly covered with a sticker.)

---

Edit: I've done a further check to confirm the architecture.

Nios II encodes the ret (return) instruction as F800283A. The appears many times through the firmware file (in little-endian byte order.)

The first occurrence is at offset 0009D3B8, with offset 0009D100 being a plausible start for the code.