Reverse engineering Devolo firmware

Question

I am trying to do some reverse engineering to a Devolo dlan wifi 500 device (MIPS architecture). My objective is to put there some firmware modified by me.

This is where I got so far:

1. Downloaded a firmware update from http://update.devolo.com/linux2/apt/pool/main/d/devolo-firmware-dlan500-wifi/
2. Extracted firmware image from debian package
3. Analyzed image with binwalk
4. Extracted contents with firmware mod kit (present on google code).
5. Modded image
6. Rebuilded with fmk
7. Used web interface of device to upload new firmware

It failed on step 7. I get a message saying something like "this file does not contain valid data". So, some sort of verification is performed by the device before installing updates.

So I kept investigating. The devolo image contains a devolo header/footer, a uboot and a uimage. The header/footer must contain some sort of checksum. I tried picking the valid (unmodified) update and changed one bit on the padding, uploaded it to the device and got the same error message.

If I knew where the checksum is or how is obtained, I could change it after rebuilding the image. However I found no documentation about the devolo formats. To try to find the sum I compared the hexadecimal of two devolo images: wifi and wireless(the wireless image is on the same site from where I downloaded the wifi image; could not post this link and the fmk link because I have less than 10 reputation :( ). The headers/footers are very similar in most fields, though I found no 32byte field to be a sum. Perhaps someone more experienced on reverse engineering could help me.

I could try to brute force the sum. Since it is a sum, I could create a collision by adding bits to the padding areas. For this I have two ideas:

1. Send through the network every combination possible;
2. Use the downloaded image's libraries to test the sum locally;

Option 1 would probably take a few years...

For option 2, I tried using a qemu virtual machine and compile there, and cross compiling, with no results, due to the devolo libs using an old libc version (https://stackoverflow.com/questions/29153924/how-to-solve-c-conflicts-between-system-and-library-dependencies).

My last idea is to somehow emulate the downloaded firmware in my amd64 machine, to compile some code there that would use the devolo libs, thus circumventing the dependency problems.

So, I would thank any tips/mistakes on my previous steps, and any pointers on how to run the downloaded image on my pc.

Answer 1

Each section in the firmware file has a crc32 over its contents.

See this.

It should make option 1 more viable.

More details: Inside the squashfs image there's whole heap of busybox based tools and a handful of standalone programs. There's one (/usr/sbin/chunk) that looked likely to have logic concerning the traversal of the firmware files. It contains a number of the 32bit values that matched the values in the firmware file that look like magic/fourcc values. strings(1) output was also pretty encouraging.