As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. However, I'm determined to see this through, by god.

Here's what I've got so far:

  • The brain of the device is a NuMicro NUC126 (Cortex-M0) microcontroller. (datasheet)

  • The device also houses a BY25Q64ASSIG SPI NOR Flash (irrelevant?) (datasheet)

  • The firmware download is a single .bin file (available if requested).

  • The firmware is loaded to the device over USB via the (custom?) device-in-question vendor's ISP tool. (official non-vendor tool). Even the source is available for the ISP tool.

  • Output of binwalk -B: 97640 0x17D68 CRC32 polynomial table, little endian. Nothing else.

  • binwalk -E indicates no compression/encryption:


    as does binvis.io:

    enter image description here

  • strings indeed finds strings visible when using the device

  • dfu-util -l and dfu-util -d <VID:PID> doesn't appear to be able to find the device, which tells me that it does not utilize DFU. Even more likely, I'm just using it wrong. Perhaps the ISP tool puts it into DFU mode before flashing? I was hoping to perhaps extract the firmware this way.

  • Applied segment maps in IDA, aligned vectors, analyzed at reset vector, ???, no profit (yet).

My intentions:

The device comes with 3 "themes". I either want to replace/edit, or add more. The problem is, while I (think I) have disassembled the firmware correctly, as noted above, I don't know where to go from there.


  1. Since I feel like I'm (somewhat) close to a solution, is there something I'm missing? Reading assembly, sure. But I mean, are the themes simply bitmap style images? Are they vector? How would I know? After scanning the file using a resource extractor, it didn't find any embedded images. Though I'm curious as to whether disassembling the downloaded firmware would yield the same results as if I were to actually pull the firmware from the chip and disassembling it that way.
  2. Is JTAG/UART absolutely necessary? The reason I ask is because practically all guides I've found utilize something similar. I've looked into OpenOCD, Segger, etc. and I'm really trying to avoid purchasing extra stuff, but will if necessary.

Thank you all for the help! If you require more information, please ask!



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.