Questions tagged [embedded]
Refer to devices with scarcity of resources (energy, memory, cpu power, ...). It gather any consumer electronics (radio receivers, television sets, MP3 players, video recorders, DVD players, digital cameras, camcorders, personal computers, video game consoles, telephones and mobile phones, tablets).
111
questions
1
vote
0
answers
20
views
Keycode from a serial PDA keyboard (iPAQ G750)
I have a folding PDA keyboard (model number iPAQ G750). It is using a proprietary serial protocol, I want to adapt it to Bluetooth using a micro controllers. The keyboard sends out a 2-byte keycode ...
- 11
0
votes
0
answers
19
views
Process always exit and die on router when debug using gdbserver
Im trying to debug the httpd process on the tplink router. I push the gdbserver on the router (i called it server), start it with command:
gdbserver --multi --attach 0.0.0.0:3333 <pid>
On the ...
- 67
1
vote
2
answers
187
views
Using IDA 8.3 Freeware on a Z180 .bin file
The last time I tried my hand at disassembly it was in
1986-1988... a Z80 embedded processor PROM image file...
42K of code turned into 27000+ lines of assembler code...
using a disassembly program ...
- 21
2
votes
0
answers
499
views
How to extract the firmware from the flash chip of the router?
Hi, I've been struggling with a subject since 2 weeks.
I have MSS5004W model router from RicherLink. The board is RL-S4005ef. This device has OpenWrt installed but it's not normally supported by that ...
- 21
3
votes
0
answers
680
views
Problem getting root shell on Ezviz camera
I got a CS-C6N Ezviz camera. My friend gave it to me because he doesn't use it anymore. I was able to get rtsp stream from the camera (but laggy), and I also was able to connect to UART port on the ...
- 249
2
votes
1
answer
114
views
When reverse engineering a piece of electronics that uses a "chip on board", what are some good resources for finding out what the chip is?
Example: I have an old digital organizer, a Royal DS 2260.
I want to find out what SoC it uses. Numbers marked on the PCB are just repeats of the model number or don't lead to anything, and I don't ...
3
votes
0
answers
372
views
Reverse-engineering the Sony Camset (Camera Settings) file format
Context
Newer Sony cameras have functionality that allows them to:
save the current camera settings (shooting mode, auto-focus mode, etc.) to a file
load the camera settings from a file into the ...
- 161
2
votes
1
answer
79
views
Is there any way to understand if a raw binary firmware is Cortex-M or not?
I have a list of firmwares, and I should filter just the Cortex-M type. Is there any automated way that I can distinguish them from other ARM firmwares?
I have some ideas like Interrupt vector Table (...
- 21
0
votes
1
answer
152
views
Contents of SPI NOR Flash appears scrambled
I'm working on reverse engineering a small household weather station, and I have successfully managed to extract the contents of a SPI NOR flash chip (using a modified version of this Python library ...
- 103
1
vote
1
answer
731
views
ARM - Understanding a "base address" when reversing firmware
I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
1
vote
0
answers
135
views
Reversing Brother Sewing Machine Firmware
Context: Taking my first stab at reverse engineering, I am trying to install firmware intended for a machine sold in a different region (EAS) to my machine (US). I believe Brother sells the same ...
- 11
0
votes
1
answer
258
views
Identify unknown Atmel chip
wondering if folks can help identify this chip.
It looks like
ATMLH017
2FCM CN
©2017AB4
Googling all manner of permutations on these numbers has not been helpful.
The chip appears next to an ...
- 103
1
vote
0
answers
524
views
Forcing Ghidra's decompiler to show unused stack variables
I'm reversing an ARM64 bootloader using Ghidra. The bootloader doesn't use the MMU and so works exclusively with physical addresses, which on this particular chip all fit in 32 bits (the memory map is ...
- 111
5
votes
1
answer
261
views
Would hiring a RE service be worth it?
Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
- 103
1
vote
0
answers
359
views
ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)
As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
- 66
1
vote
1
answer
133
views
What could a firmware image be, if not embedded linux?
I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
- 113
0
votes
1
answer
276
views
Detecting and reading embedded filesystems on desktop Linux
I have some data from a NAND chip, dumped using the built in nanddump utility on the embedded device.
This is the device information: https://openwrt.org/toh/bt/homehub_v5a The NAND chip is 128MiB ...
- 111
2
votes
2
answers
287
views
Chip Identification in Push Button Toy
I have a toy that simply consists of a button which plays a variety of phrases when activated. My intention is to replace the sounds with my own. However, I have been unable to identify the chip and ...
- 121
3
votes
1
answer
169
views
Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message
I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
- 33
1
vote
1
answer
270
views
Linux Embedded board - Kernel Panic problems
I need to duplicate an old embedded board based on a Yocto-based Linux.
I have bought a new board with the same part number and now I need to put the old software in the new board (the new board has ...
- 11
0
votes
0
answers
146
views
Unknown 160bit challenge-response (36V ebike battery protocol)
I'm currently trying to build a custom battery pack for an electric bike.
The bike uses 36V batteries from Panasonic (also sold under OEM brands Victoria, Kalkhoff, Rahleigh, Flyer, Kettler).
We'...
- 103
1
vote
0
answers
92
views
8 bit CRC help - Automotive
Reverse engineering some Automotive CAN data and the CRC is getting me.
8 bytes per message, with Byte 0 being the CRC.
Byte 1 & 0xF contains a counter [0x0 to 0xF]. The rest of the message is ...
2
votes
3
answers
215
views
Reverse Engineering RS232 protocol misterious last byte
I have an old water purifier system that consists of a PDA and a main board (I think the ic is a Renesas) that communicate by RS232, I need to know the protocol they use to communicate in order to ...
- 31
2
votes
2
answers
272
views
Reverse engineering MCU with "poor" datasheet
I'm reverse engineering a chinese MCU.
The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck.
This is what i've done:
I got ...
- 21
1
vote
2
answers
888
views
Can a secondary UART be used to access the MCU?
I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it.
The board is also lacking information like serial pins and the ...
- 11
1
vote
1
answer
600
views
Protected shell in embedded linux
When I run telnetd -l /bin/sh on an embedded Linux device and use Putty to telnet to it, the provided shell is /bin/psh (protected shell).
On this device, /bin/sh is a symbolic link to /bin/busybox.
...
- 21
1
vote
0
answers
123
views
Debug only one thread with ida-gdb server
If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida.
The problem is if this process has 1 thread that can't stop over than x ...
- 21
2
votes
1
answer
347
views
reverse engineering hi3516ev200
I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a ...
- 121
2
votes
0
answers
161
views
Voltage Glitching to Read Internal EEPROM
I am trying to read the cryptographic key from my car key fob for exploration, basically seeing if I can clone it.
I popped open the case and I see it's using a Microchip HCS361. The HCS361 stores it'...
- 368
1
vote
1
answer
619
views
Reversing a key-gen firmware for RISC-V
I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to
calculate and print a "machine key"...
- 121
0
votes
1
answer
353
views
MIPS Router Firmware
I'm pretty new to the whole reverse-engineering thing, but have some background knowledge in x86 asm and comp sci, as well as computer security.
Project-based learning has always worked well for me,...
- 3
1
vote
2
answers
2k
views
ECU tune and reverse engineering
I'm new to the ECU (or chip) tune concept, and I try to understand what is going on there.
I understand the concept and the goal, but I'm having difficulties to understand what is actually going on ...
- 1,848
0
votes
1
answer
363
views
Building micro controller memory image in IDA
I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format.
Some relevant information from the datasheet:
...
- 1,848
1
vote
1
answer
281
views
vector table address in mpcXXXX microcontrollers
I'm disassembling some mpcXXXX microcontroller firmware, and I'm trying to find the vector table and the reset interrupt.
For example, I know that in ARM, in some of the microcontrollers, the vector ...
- 1,848
4
votes
1
answer
983
views
How to identify memory access locations
I'm working on disassembling a flash dump from a TriCore TC1766 which came from a car (an MT86 ECU). My goal is to identify tables and scalars in the data area, and determine what they are used for. I ...
- 143
2
votes
2
answers
1k
views
Unable to extract IP camera firmware
I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
- 21
5
votes
2
answers
2k
views
Help needed to extract u-boot kernel & rootfs - nxp lpc 3143 processor
I have a board where in principle aim at emulating a DVD-ROM loading iso file from a drive.
This board is running a ARM CPU with 32MB of ram and has no vga output.
The firmware update comes with 2 ...
- 51
1
vote
0
answers
277
views
Can anyone make much sense of this binary for an embedded system? [closed]
I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it.
...
3
votes
3
answers
628
views
Jump in the middle of an instruction Coldfire firmware
I'm working on an embedded system Coldfire ROM. Currently, I'm trying to reverse engineering it to gain some more in-depth knowledge about its structure.
ROM code quality seems pretty low, and I see ...
- 335
3
votes
1
answer
394
views
Setting register names in Radare2
I am reverse-engineering an 8051 architecture program of a specific chip.
The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is ...
- 131
4
votes
2
answers
484
views
Z80 Absolute Jump to offset in middle of instruction
I'm working on reverse engineering an embedded system which uses a Z80 processor. I'm using IDA as the disassembler. I ran upon an absolute jump (JP) that seems to jump to the middle of another ...
- 126
0
votes
1
answer
837
views
Checksum error when flashing modded firmware on embedded device
I'm trying to patch strings in my firmware with a hex editor but I keep getting a checksum error when I go to re-flash the modded firmware onto my device. The device is a Roland gr-55 guitar ...
- 103
8
votes
3
answers
925
views
Extracted router file execution
I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
- 81
3
votes
1
answer
2k
views
Extract firmware images from COTS embedded devices
I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points.
Is it in general possible to ...
- 2,475
3
votes
1
answer
759
views
How does U-Boot get from this environment to booting Linux?
I'm trying to gain a root access to my ZTE F680 router. I already have a serial connection and able to interrupt the U-Boot autoboot. The problem I'm having is understanding how given the following ...
- 131
8
votes
0
answers
670
views
How do I reverse this firmware? 8-bit handheld console
I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
- 81
4
votes
2
answers
609
views
Can't trace MIPS embedded device remotely
I'm trying to debug a remote device using gdbserver and IDA Pro.
I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
- 41
0
votes
2
answers
1k
views
How to interpret disassembled MIPS code?
I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines:
Disassembly of section .data:
00000000 <.data>:
... ...
f864: 30a5ffff sd ra,-23248(...
- 215
3
votes
1
answer
4k
views
Binwalk does not show anything when process binary
I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything.
I tried commands
binwalk -Me file.bin
binwalk --dd='.*' file.bin
strings ...
- 215
1
vote
2
answers
1k
views
Recreating a lzma archive (non-streamed)
I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
- 11