I am trying to do some reverse engineering to a Devolo dlan wifi 500 device (MIPS architecture). My objective is to put there some firmware modified by me.
This is where I got so far:
- Downloaded a firmware update from http://update.devolo.com/linux2/apt/pool/main/d/devolo-firmware-dlan500-wifi/
- Extracted firmware image from debian package
- Analyzed image with binwalk
- Extracted contents with firmware mod kit (present on google code).
- Modded image
- Rebuilded with fmk
- Used web interface of device to upload new firmware
It failed on step 7. I get a message saying something like "this file does not contain valid data". So, some sort of verification is performed by the device before installing updates.
So I kept investigating. The devolo image contains a devolo header/footer, a uboot and a uimage. The header/footer must contain some sort of checksum. I tried picking the valid (unmodified) update and changed one bit on the padding, uploaded it to the device and got the same error message.
If I knew where the checksum is or how is obtained, I could change it after rebuilding the image. However I found no documentation about the devolo formats. To try to find the sum I compared the hexadecimal of two devolo images: wifi and wireless(the wireless image is on the same site from where I downloaded the wifi image; could not post this link and the fmk link because I have less than 10 reputation :( ). The headers/footers are very similar in most fields, though I found no 32byte field to be a sum. Perhaps someone more experienced on reverse engineering could help me.
I could try to brute force the sum. Since it is a sum, I could create a collision by adding bits to the padding areas. For this I have two ideas:
- Send through the network every combination possible;
- Use the downloaded image's libraries to test the sum locally;
Option 1 would probably take a few years...
For option 2, I tried using a qemu virtual machine and compile there, and cross compiling, with no results, due to the devolo libs using an old libc version (https://stackoverflow.com/questions/29153924/how-to-solve-c-conflicts-between-system-and-library-dependencies).
My last idea is to somehow emulate the downloaded firmware in my amd64 machine, to compile some code there that would use the devolo libs, thus circumventing the dependency problems.
So, I would thank any tips/mistakes on my previous steps, and any pointers on how to run the downloaded image on my pc.