I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one.

There are three versions available on their webseite: 2012, 2013, and 2014 variants. The first thing one notices: The 2012 and 2013 versions are about 4 MB, while the 2014 is 2 MB. So we have to assume, that the 2014 one is compressed (or compressed with something better).

binwalk does not show anything useful, really. All the firmware blobs are incompressible, so they're likely obfuscated/encrypted.

Comparing the (hopefully alike) 2012 and 2013 ones with xdelta3 shows, that only a very few 4byte thingies are identical in the two blobs (they're at different positions though). And they don't seem to be of any use.

Is there any information available on the obfuscation employed?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.