Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [embedded]

Refer to devices with scarcity of resources (energy, memory, cpu power, ...). It gather any consumer electronics (radio receivers, television sets, MP3 players, video recorders, DVD players, digital cameras, camcorders, personal computers, video game consoles, telephones and mobile phones, tablets).

3
votes
2answers
92 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
2
votes
1answer
98 views

Extract firmware images from COTS embedded devices

I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. Is it in general possible to ...
3
votes
0answers
37 views

How does U-Boot get from this environment to booting Linux?

I'm trying to gain a root access to my ZTE F680 router. I already have a serial connection and able to interrupt the U-Boot autoboot. The problem I'm having is understanding how given the following ...
6
votes
0answers
125 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
1
vote
2answers
69 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
0
votes
2answers
107 views

How to interpret disassembled MIPS code?

I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines: Disassembly of section .data: 00000000 <.data>: ... ... f864: 30a5ffff sd ra,-23248(...
2
votes
1answer
90 views

Binwalk does not show anything when process binary

I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything. I tried commands binwalk -Me file.bin binwalk --dd='.*' file.bin strings ...
0
votes
0answers
36 views

Read SPI Flash memory blocks

I have device with embedded eCos RTOS and SPI Flash memory. Flash Device Information: CFI Compliant: no Command Set: Generic SPI Flash Device/Bus Width: x16 Little Word Endian: ...
1
vote
1answer
79 views

Recreating a lzma archive (non-streamed)

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
2
votes
1answer
154 views

SPI Flash, how to find the System memory addresses?

How to determine the System memory addresses of SPI Flash used in device running eCos operating system? For example, show flash command returns the following info: Flash Device Information: ...
3
votes
1answer
170 views

Instruction set for code snippet?

I'm looking for the CPU/Instruction-Set of a closed embedded system. Code snippet: E6 F2 F3 15 E6 F3 0A EF E6 F8 9B 7F E6 F9 5B D5 0D 32 49 94 EA 30 60 71 What I know: E6 Fx is "LDR 16-Bit-...
1
vote
2answers
251 views

How does QPST work and how can I make an app like it?

How does Qualcomm's QPST work? Or what protocol/commands does QPST use? As I wanted to develop an app like it, I searched for AT commands. But I can't find out any AT commands that allows me access(...
2
votes
0answers
54 views

Identifying unknown chip - markings erased

There seems to be a (relatively) easy way to remove the markings on a chip via laser. When reverse engineering a device with such a chip, what would be some methods of identifying it. It seems that ...
0
votes
1answer
567 views

Adding additional language to Linux based Firmware of Volkswagen Car Radio

I'm owning a CarPlay head unit from Volkswagen called RCD330 plus. It is possible to upgrade/downgrade to any available firmwares. For example here are two firmware versions: http://rcd330plus.com/rcd/...
1
vote
1answer
333 views

Rebuilding firmware back to binary file

I used Binwalk to extract firmware files, extracted content include 2 folders and one binary file. squashfs-root _351C.extracted 351C Squashfs-root contains file system, '_351C.extracted' folder ...
2
votes
1answer
482 views

TP-Link encrypted backup file TX-VG1530

I have been trying to wrap my head round this stuff so bear with me. I have a Tp-Link TX-VG1530. From the gui you can download the config file however the file is encrypted, I include a portion of ...
6
votes
3answers
6k views

Help reversing end-of-life'd Logitech Link. How to get Flash Contents

See Update below. I got an email from Logitech that they are End of Lifing their Harmony Link product (see https://community.logitech.com/s/question/0D55A0000745EkCSAU/harmony-link-eos-or-eol). So I ...
8
votes
0answers
1k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
0
votes
0answers
118 views

JTAG pinout for Linksys E4200v2/EA4500

Can anyone specify an actual JTAG pinout for Linksys E4200v2/EA4500 router? The EA4500 and the EA4200v2 are actually identical hardware. There is unpopulated 8-pin JTAG header on PCB, 4x2 rows. s10....
3
votes
0answers
472 views

Reverse engineering unknown RS232/UART binary protocol

Background story For couple of days I'm trying to crack the protocol used the old medical device, in order to collect data for a research in an automated way. The device in question is Novametrix ...
8
votes
1answer
2k views

Reverse Engineering ZyXel C1100Z modem firmware

first time post so please bear with me. For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck. I have a Zyxel C1100Z DSL modem that I've purchased from ...
1
vote
0answers
392 views

ZyXEL P-2812HNU-F1, replacing the U-Boot on the board

I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider). To do this, I should first replace the U-Boot image ...
4
votes
1answer
261 views

Help editing & repacking (repackaging) .img wi-fi camera firmware

I've been playing around with a cheapish ($15 on sale @ Wal-Mart) WiFi camera. It has a UART port which drops me into a shell from which I can launch telnetd and login easily. However, even though the ...
0
votes
0answers
81 views

Identification of an Unknown File System in an ITRON OS

I am attempting to reverse an unknown file system found in an ITRON based operating system (circa 2003), but have not been able to figure this out. Any clues to identifying or reversing this file ...
-4
votes
1answer
213 views

What exactly is a SIM card?

Does a SIM card consist of only Flash memory or is there a microprocessor inside as well?
0
votes
1answer
155 views

Got root on IP camera, but init.d overwritten at boot. How to start telnetd at launch?

I've got a root shell via UART serial connection to an IP Camera that I've been playing with. Similar device is seen here: https://www.exploitee.rs/index.php/Belkin_NetCam_HD%2B It's got busybox with ...
1
vote
0answers
520 views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
4
votes
3answers
2k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
0
votes
2answers
1k views

How to extract content of NVRAM file?

How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash. NVRAM has been copied as mtdblock partition. An embedded device that run Linux v2.6.18_pro500. Linux version 2.6.18_pro500 ...
4
votes
1answer
674 views

C-sky CPU reverse engenering

I am trying to RE a firmware for a TV STB, its based on a GX3201 chip which is based on C-sky CPU (CK610M I think). I am stuck in the following points : I am not able to properly identify the CPU ...
1
vote
1answer
756 views

Emulating Non-Linux Firmware Image of Embedded Devices

I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware ...
0
votes
0answers
198 views

Reverse engineering .ota file from IoT device

I have an IoT device whose firmware I try to analyze. Unfortunately, so far, I haven't found a starting point. file talks about dBase IV DBT but I think this is a false positive. $ file firmware-...
2
votes
0answers
411 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
-1
votes
1answer
186 views

How to read RAM of embedded system? [closed]

I have working device, that operates with RAM (random access memory). I want to grab RAM dump. I think it must be a hardware option. Is there a way to do this? Maybe anybody have some expirience?
1
vote
1answer
1k views

How to find Bootloader Load Address?

I've followed the tutorial found at: http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/ I've loaded the uboot image into IDA, but I'm not sure how to determine the load ...
1
vote
1answer
616 views

How to reverse engineer hex data on EEprom? [closed]

I am learning how to reverse engineer the EEprom data in Automotive ECUs. For such purposes as to disable the immobilisers, find millage data and workout encoded VIN numbers among other things. I ...
1
vote
1answer
823 views

Help mounting jffs2 dumped from NAND flash.

Ok so have been trying to look some settings from a jffs2 partition I extracted from a nand dump I had done previously Here ----> https://forum.openwrt.org/viewtopic.php?id=67564 Steps I have ...
3
votes
2answers
1k views

Technicolor TG799vac Modem/Router Dumping The Nand Flash

Ok, so I have been trying to dump the contents of a Technicolor TG799vac. So far I have removed the flash chip and read out the chip using the DumpFlash.py utility and used binwalk to locate the ...
1
vote
2answers
427 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
0
votes
3answers
1k views

Limited BusyBox shell

I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell. BusyBox v1.19.2 (built-in shell (ash) Enter 'help' for a list of built-in ...
0
votes
0answers
194 views

Empty folders & broken file links inside mounted jffs2 image

I'm trying to explore my hg630 router file system so I dump it with ftpput -s -v -u admin -p password -l /dev/mtdblock0 -r ftpdir/mtdblock0 192.168.1.2 check image with binwalk root@kali:~/Desktop/...
1
vote
2answers
466 views

Dlink DIR 600M firmware decompile issues

How to decompile the CGI & ROM files from the firmware bin? I am able to extract the HTML files using binwalk but the router OS and CGI files are missing. NOTE: Its not the same as DIR 600 ...
1
vote
1answer
612 views

Trying to get shell on embedded device. Analyzed firmware update, listened to Android app, no dice. Suggestions?

I have an ActiveON LX action camera i.e. a GoPro ersatz. It comes with an Android app to control it, and it does so by running its own WiFi AP for the phone to connect. Once the phone connects, it ...
5
votes
2answers
302 views

Thought I found serial port - broke embedded device instead! Help?

Well another weekend has gone by and my tinkering has caused another device to (potentially) bite the dust. I've been playing around with a couple of Slingboxes, an M1 and a 500. Today was the M1. I ...
4
votes
1answer
99 views

Help deciphering binary that creates 3 passwords

I found a binary on a device I've been working on, it's called genrandpass and the only user input is a public key (which is a .bin file) that's stored locally on the device. It also gathers some ...
2
votes
1answer
129 views

Help locating Serial Port on embedded device

I've been slowly working on getting into the workings of a set-top box. I hit a snag when the firmware that it downloads is encrypted. I managed to find some pictures of the circuit board (but haven't ...
1
vote
2answers
542 views

run netcat on qnx (armle)

I am researching an embedded device which runs QNX. I can login via telnet as a user but don't have the root password (in parallel I am running oclHashCat with the hash from the shadow file but it ...
3
votes
2answers
3k views

how to bypass CRC checksum in firmware header

I have this Ubiquiti firmware and I successfully extract the firmware and rebuild it, I modify Squashfs filesystem and rebuild it using build-firmware.sh script from firmware-mod-kit, but the problem ...
4
votes
1answer
2k views

Question about Keeloq - A car remote control standard

I have a question about Keeloq security. I have an original car remote controller (BFT Mitto 2) and I know this chip uses HCS301 with Keeloq implementation. I would like to clone this remote for my ...
2
votes
0answers
214 views

Puzzling 16bit checksum/CRC reverse engineering problem

We're having a hard time figuring out how the checksum/CRC is calculated for this serial communication protocol we're required to reverse engineer. This is a communication protocol used back in the ...