4

I'm working with a Digi Connect ME serial to Ethernet bridge, which runs a "Plug and Play" firmware by default.

The specific product page is here. The part number is DC-ME-01T-S. It appears to be an ARM based board - a NS7520 specifically. This is not the product with NET+OS or a JTAG port.

The support page is here - contains firmware, documentation, drivers.

Digi provide .bin files, but no source code.

I am trying to unpack the .bin files but I am not having much luck. binwalk doesn't pick up anything, mkimage from u-boot doesn't find the magic number (some other Digi products use U-boot), file just indicates it is data.

There seem to be two firmwares - the large EOS file and a smaller POST file. I suspect the POST one might be a bootloader - it doesn't look compressed.

Here is a link to the most recent EOS firmware: http://ftp1.digi.com/support/firmware/82001120_M.bin

And the post firmware: http://ftp1.digi.com/support/firmware/82000867_H.bin

Entropy analysis of the EOS firmware shows high entropy throughout the file.

The NET+OS version of the Digi Connect ME runs Digi's NET+OS network operating system which is based on ThreadX's RTOS. I am not sure if the Plug and Play firmware is just a specific variant of this.

The Digi Connect Me is used in a lot of embedded devices to provide network connectivity and a lot of them are open to the Internet, hence the interest.

It's not like anything I have seen before.

My first goal is to run strings against the firmware as I suspect it has undocumented functionality when running in modem emulation mode.

Any hints?

Improve this question
5
  • 1
    Can you link us the exact product you're using? There's quite some datasheets floating around for digi products. Maybe there's some hint for code protection in there. The high entropy of the binary file suggest to me it's compressed or encrypted/scrambled some how (starting from ~0x8F0). Therefore I'd like to understand if there's a chip build in feature for something like this.
    – ixje
    May 14, 2014 at 10:48
  • Yes - bulking out question now.
    – Cybergibbons
    May 14, 2014 at 10:55
  • 1
    From the POST file I assume the EOS can be updated through TFTP. The "Put TFTP'd OS file into flash" together with some other hints suggest a console with programming abilities. I'd start by analyzing the POST file and focus around the logic related to this function to see if it does anything special before programming the data to flash (quick fyi; flash is at 0x02000000). Quick scanning the datasheet I did not find any references to hardware blocks that do any on the fly (de)obfuscation, so software based it most likely.
    – ixje
    May 14, 2014 at 11:40
  • any progress or stuck somewhere?
    – ixje
    May 15, 2014 at 17:32
  • Not had a chance to look yet - hope to have a look this weekend. The POST firmware does seem to make some sense, but I can't see an obvious decompression routine.
    – Cybergibbons
    May 15, 2014 at 20:13

1 Answer 1

Reset to default
3

The POST firmware is raw ARM big-endian code. Load address is 0x02020000. There doesn't seem to be any embedded sub-files or filesystems.

The EOS firmware has a few ARM instructions at the beginning, and then some compressed or encrypted data. You'll probably need to analyze the POST firmware to figure out how to decompress it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.