1

I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to have a uboot image plus a squashfs filesystem or something along those lines. binwalk dashes my hopes of that:

$ binwalk motorola_1.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

Instead it's apparently full of ARM instructions:

$ binwalk -A motorola_1.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
300           0x12C           ARM instructions, function prologue
328           0x148           ARM instructions, function prologue
404           0x194           ARM instructions, function prologue
428           0x1AC           ARM instructions, function prologue
1176          0x498           ARM instructions, function prologue
1580          0x62C           ARM instructions, function prologue

Now before doing this, I connected to the monitor's UART headers and was presented with some kind of debug program, that allowed me to view the camera's current slew, tweak the display settings and so on. The strings of that program's printouts are all visible within the binary I extracted from the chip if I run strings on it, so this is obviously what was running there. I'm quite confused as to how it was running if the firmware isn't some form of linux image though.

The board has no other flash chip that I can see, though there is a (regrettably unidentifiable) IC that's obviously a processor or SOC of some sort which I suppose could have an internal flash section.

If this isn't some form of linux image, then, what could it be? Pure ARM instructions implies it's just a program, but I don't really understand how it can be executing the program without the OS booting to run it. Or is it likely that I'm simply missing something?

EDIT: The chip, if it matters, is a Winbond W25Q16.V - not exactly a large chip for storing a linux image on...or so it seems to me anyway. But what do I know?

4

There are plenty of non-Linux solutions for embedded systems, ranging from an RTOS such as eCos, FreeRTOS, ThreadX, Nucleus and many others to a completely monolithic, custom made firmware without any specific OS environment. About the only way to find out for sure is to start disassembling and figure out how it works.

My old presentation may be of some use for background info:

https://github.com/skochinsky/papers/blob/master/2010-07%20%5BRecon%5D%20Intro%20to%20Embedded%20Reverse%20Engineering%20for%20PC%20reversers.pdf

1
  • Thanks - this is extremely detailed and very helpful to my total-newbie self. I think I may park this device for now though, as although I've some limited experience at disassembling code through ghidra I don't really know enough to tackle this one yet I think. – Dan Scally Apr 20 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.