0

I am working on a firmware bin file that has been extracted from an EXE file. The Firmware was inserted as an encrypted PKZip resource in the EXE.

I was able to fish the EXE password at runtime and extract the unencrypted BIN file.

Here is one small excerpt of code that is labelled as though it should extract to become a bitmap file. you can see the Zlib header 78 9C.

78 9C ED 96 BD 12 82 30 0C C7 FF 50 10 19 BC 63 C4 F3 E3 58 DC 1D 1D 19 19 19 1D 79 94 FA A4 3E 0A 36 89 14 AC A2 1E 75 70 20 77 6D D3 90 FC 92 0C 6D B9 64 7B 1C 20 52 9B B1 C3 B5 1D 9F 03 4D 33 8D 15 47 2C 8C DE B6 81 06 72 B3 5B 22 62 AB EB 15 6A F2 02 4A A3 57 08 41 DA D0 96 7F 88 AB 8C 7E E2 B8 E2 C1 56 7C 91 AF E0 38 D7 E6 C6 C5 BC 8F B9 9B C8 76 E3 4B A9 B8 37 5F 4A C3 5E 3E 94 F8 25 A5 FF AE 6C C7 9D 4C E7 48 CF FE 9C C6 DA FE 91 A3 2C A7 93 74 22 29 79 22 0D CF 0A AD 53 6B 1C 23 CB 69 22 CF 5F 93 DD C8 99 3C 93 67 F2 4C B6 C2 E4 8D F8 6B 7A 27 52 2D 79 32 33 8E E8 6F BD 1A DD ED 27 EB 19 0A 44 4B 34 E9 62 7B E7 A7 06 7E 25 B3 C3 7B 26 7A E3 72 AC A5 2E AE 41 AA DA 72 81 F2 97 73 03 7C

I've tried to inflate the stream but it doesn't become a usable bitmap.

Original EXE that contains the firmware as well as the extracted BIN file for anyone that wants to take a look and help out.

https://mega.nz/folder/iyJwUBhJ#KkHzxtx-45gD6U9sSBR9Kw

Edit June 21 Alright, so the streams are being decompressed correctly with the zlib library as the file header at 2FB8D0 decompressed to a test.dat text file. (Containing the Declaration of Independence)

The assumed bitmaps and audio files are either encrypted, some raw data file type or the headers are saved elsewhere in the bin file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.