1

After getting rejected from a promising interview process with Company A, the interviewer reached out to me and provided me with Reverse Engineering challenges Company A provides publicly to work on.

What I've done: (disclaimer: I'm still a Novice)

  • extracted the .img as firmware.img
  • file firmware.img
    output: Linux kernel ARM64 boot executable Image, little-endian, 4K pages
  • strings firmware.img
    summary: gibberish until what looks to be stuff for a tcp/udp server
  • xxd firmware.img
    summary: all bytes are 'ff' from 00036650 - 000aade0

Tools that did not work (incompatible file?):

  • binwalk
  • objdump
  • readelf

Other things that failed:

  • mount

This is the part I'm currently at, is I'm unable to mount the firmware.img, but the errors keep saying "corrupted" as I try different ways to mount the file.

What recommendations or different approaches should I consider?

1
  • I'm guessing due to not knowing anything about the binary you were given...but, perhaps it's worth trusting the output of file? To start, you can probably plug the output of file into a search engine to find documentation. Jan 5 at 0:21

1 Answer 1

1

This img file is identified by file as a Linux kernel boot image.

This type of file is (sort of) a self extracting archive, not a filesystem .img that is mountable.

There is a standard Linux tool to extract this file:

https://github.com/torvalds/linux/blob/master/scripts/extract-vmlinux

Extracted file can then be analyzed using the tools you mentioned to get more meaningful results.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.