Binwalk showing only the header as the full size of the binary

Question

I'm trying to decompile and analyze the firmware for a D-Link router. I downloaded the firmware from their website, but when I run binwalk on it, I get:

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------
0           0x0         Ubicom firmware header, checksum: 0xCDED3035, image size: 1441792

which is the complete size of the actual binary:

-rw-r--r-- 1 root root 1441792 Jun 10  2013 firmware.bin

So I assume that means binwalk wasn't able to find any tags to delimit the different parts of file right?

I tried taking a hexdump next and looking for asterisks. I found a few, but no real apparent tags could be found.

Is it possible the binary is encrypted or obfuscated in some way? What would be my next step here?

Answer 1

That is correct. Given the size of the firmware image, I'd guess that this is not a Linux based firmware, but probably an RTOS (IIRC, Ubicom had their own RTOS called IPOS).

Try doing an entropy analysis (binwalk -E) and running strings on the firmware image. Low/medium entropy and the presence of ASCII strings would suggest that the firmware is not encrypted or compressed.

You can also try binwalk -A to search for common opcodes (Ubicom32 opcodes are supported), and will give you an idea if there are valid executable instructions in the firmware image.