0

I'm trying to decompile and analyze the firmware for a D-Link router. I downloaded the firmware from their website, but when I run binwalk on it, I get:

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------
0           0x0         Ubicom firmware header, checksum: 0xCDED3035, image size: 1441792

which is the complete size of the actual binary:

-rw-r--r-- 1 root root 1441792 Jun 10  2013 firmware.bin

So I assume that means binwalk wasn't able to find any tags to delimit the different parts of file right?

I tried taking a hexdump next and looking for asterisks. I found a few, but no real apparent tags could be found.

Is it possible the binary is encrypted or obfuscated in some way? What would be my next step here?

3

That is correct. Given the size of the firmware image, I'd guess that this is not a Linux based firmware, but probably an RTOS (IIRC, Ubicom had their own RTOS called IPOS).

Try doing an entropy analysis (binwalk -E) and running strings on the firmware image. Low/medium entropy and the presence of ASCII strings would suggest that the firmware is not encrypted or compressed.

You can also try binwalk -A to search for common opcodes (Ubicom32 opcodes are supported), and will give you an idea if there are valid executable instructions in the firmware image.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.