2

When trying to determine the filesystem of a firmware image using binwalk, I encountered a strange combination. The binwalk is returning a lot of Unix paths, but some of them contain a typical windows-style registry.

3157752       0x302EF8        Unix path: /dev/ffd/DNL
3159348       0x303534        Unix path: /dev/fgs/download
3166204       0x304FFC        Unix path: /dev/rp_if/download
3198300       0x30CD5C        Unix path: /dev/registry/LOCAL_MACHINE/SOFTWARE/BLAUPUNKT/PROCESS
3201380       0x30D964        Unix path: /dev/registry/LOCAL_MACHINE/SOFTWARE/BLAUPUNKT/PROCESS/%s

Did you see anything like this before? What could the filesystem/operating system be?

Improve this question
2
  • Unix goes by "everything is a file". Technically this is also true for Windows at the NT native API level - much more so than it lets on - but this means first and foremost that a path can be accessed uniformly through a common root. This is true on Windows (\ -> \REGISTRY and \GLOBAL??\C:) as well as Unix. My guess is that a driver exists that populates whatever is in there and you can use standard read/write to interact with that data. /proc and /sys are not much different in that respect. But I didn't see that exact system, no.
    – 0xC0000022L ♦
    Commented Nov 17, 2023 at 21:24
  • As a side-note, I believe binwalk points out a mere path in this case, not an actual file. I reckon the "file" will only become visible on a running kernel that provides the /dev/registry device.
    – 0xC0000022L ♦
    Commented Nov 17, 2023 at 21:25

1 Answer 1

Reset to default
1

This may be related to automotive. I had seen something like this in this repository, strings including /dev/registry/LOCAL_MACHINE/SOFTWARE/BLAUPUNKT are mentioned directly here. Using word "registry" here looks like a coincidence.
Explanation on libOSAL, OS abstraction layer

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.