Questions tagged [embedded]

Refer to devices with scarcity of resources (energy, memory, cpu power, ...). It gather any consumer electronics (radio receivers, television sets, MP3 players, video recorders, DVD players, digital cameras, camcorders, personal computers, video game consoles, telephones and mobile phones, tablets).

Filter by
Sorted by
Tagged with
1
vote
0answers
40 views

Reversing Brother Sewing Machine Firmware

Context: Taking my first stab at reverse engineering, I am trying to install firmware intended for a machine sold in a different region (EAS) to my machine (US). I believe Brother sells the same ...
0
votes
0answers
32 views

Find array in binary dump by code [closed]

I need to locate some hard coded arrays in a bin dump of a microcontroller firmware, I'd like to do it by code(I need to create a tool to do the same thing to other files automatically). It is ...
0
votes
1answer
41 views

Identify unknown Atmel chip

wondering if folks can help identify this chip. It looks like ATMLH017 2FCM CN ©2017AB4 Googling all manner of permutations on these numbers has not been helpful. The chip appears next to an ...
1
vote
0answers
45 views

Forcing Ghidra's decompiler to show unused stack variables

I'm reversing an ARM64 bootloader using Ghidra. The bootloader doesn't use the MMU and so works exclusively with physical addresses, which on this particular chip all fit in 32 bits (the memory map is ...
5
votes
1answer
174 views

Would hiring a RE service be worth it?

Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
1
vote
0answers
89 views

ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)

As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
0
votes
0answers
54 views

Reverse engineering encrypted router backup config file

My router has a config backup function that downloads a base64-encoded file. After decoding the file, it's clear that it is encrypted: I have tried redownloading the config, both after having changed ...
1
vote
1answer
51 views

What could a firmware image be, if not embedded linux?

I decided to play around with an old baby monitor, purely to learn something about how such things (I.E. embedded devices) work. I successfully extracted the flash memory, and I was expecting this to ...
0
votes
0answers
24 views

Unknown but suspiciously aligned test pads

I am currently working on an Epson printer main board that exposes 5 aligned test pads (see image). The board also exposes a row of 4 pins that turned out to be UART. Now I am wondering if these could ...
0
votes
0answers
56 views

Understanding operation of ALU in SAF80-C509

Good day. I'm reversing an automotive ECU firmware which works on SAF80-C509 processor (Intel 51 architecture). Now, I've got this part of code: code:64C5 mov MD0, R0 ; ...
0
votes
0answers
23 views

Any ways to read out the ICs (using qca4531 or similar packages) without desoldering the chips on this board?

I'm currently evaluating different boards in order to read EEPROM and Flash accesses by attempting to read the bus lines with a logic analyzer. While for SMDs using TQFP (and other similiar packaging) ...
0
votes
1answer
60 views

Detecting and reading embedded filesystems on desktop Linux

I have some data from a NAND chip, dumped using the built in nanddump utility on the embedded device. This is the device information: https://openwrt.org/toh/bt/homehub_v5a The NAND chip is 128MiB ...
1
vote
0answers
62 views

Chip Identification in Push Button Toy

I have a toy that simply consists of a button which plays a variety of phrases when activated. My intention is to replace the sounds with my own. However, I have been unable to identify the chip and ...
0
votes
0answers
29 views

Synchronisation Symbols in USB Transfers

I'm reversing a USB protocol of a device. It's based on USB HID reads, and writes. The protocol always has an 0xAA after the header, and every occurrence of 0xAA in the payload is doubled. After some ...
0
votes
0answers
102 views

Unpack old DLink DIR-855 firmware

I'm trying to reverse engineer an old firmware of the D-Link DIR-855. The latest binary can be found here: ftp://ftp.dlink.de/dir/dir-855/driver_software/DIR-855_fw_reva_124eub01_ALL_multi_20130614....
0
votes
0answers
257 views

Extracting a firmware image via U-Boot and mounting/expanding it

I'm attempting to extract the file system from an embedded Hi3518 SoC that runs Linux (Busybox) but has a U-Boot boot loader. There is no console once the device is fully booted, so it seems that the ...
3
votes
1answer
124 views

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
1
vote
1answer
164 views

Linux Embedded board - Kernel Panic problems

I need to duplicate an old embedded board based on a Yocto-based Linux. I have bought a new board with the same part number and now I need to put the old software in the new board (the new board has ...
0
votes
0answers
64 views

Unknown 160bit challenge-response (36V ebike battery protocol)

I'm currently trying to build a custom battery pack for an electric bike. The bike uses 36V batteries from Panasonic (also sold under OEM brands Victoria, Kalkhoff, Rahleigh, Flyer, Kettler). We'...
1
vote
0answers
71 views

8 bit CRC help - Automotive

Reverse engineering some Automotive CAN data and the CRC is getting me. 8 bytes per message, with Byte 0 being the CRC. Byte 1 & 0xF contains a counter [0x0 to 0xF]. The rest of the message is ...
2
votes
3answers
170 views

Reverse Engineering RS232 protocol misterious last byte

I have an old water purifier system that consists of a PDA and a main board (I think the ic is a Renesas) that communicate by RS232, I need to know the protocol they use to communicate in order to ...
2
votes
2answers
180 views

Reverse engineering MCU with "poor" datasheet

I'm reverse engineering a chinese MCU. The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck. This is what i've done: I got ...
1
vote
2answers
357 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
1
vote
1answer
274 views

Protected shell in embedded linux

When I run telnetd -l /bin/sh on an embedded Linux device and use Putty to telnet to it, the provided shell is /bin/psh (protected shell). On this device, /bin/sh is a symbolic link to /bin/busybox. ...
1
vote
0answers
37 views

Debug only one thread with ida-gdb server

If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida. The problem is if this process has 1 thread that can't stop over than x ...
2
votes
1answer
215 views

reverse engineering hi3516ev200

I am new to reverse engineering and will describe my situation thus far. In short, I am looking for some tips on what to do next to gain access to a piece of hardware I am playing with. I bought a ...
2
votes
0answers
75 views

Voltage Glitching to Read Internal EEPROM

I am trying to read the cryptographic key from my car key fob for exploration, basically seeing if I can clone it. I popped open the case and I see it's using a Microchip HCS361. The HCS361 stores it'...
1
vote
1answer
386 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
0
votes
1answer
159 views

MIPS Router Firmware

I'm pretty new to the whole reverse-engineering thing, but have some background knowledge in x86 asm and comp sci, as well as computer security. Project-based learning has always worked well for me,...
1
vote
2answers
1k views

ECU tune and reverse engineering

I'm new to the ECU (or chip) tune concept, and I try to understand what is going on there. I understand the concept and the goal, but I'm having difficulties to understand what is actually going on ...
0
votes
1answer
142 views

Building micro controller memory image in IDA

I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format. Some relevant information from the datasheet: ...
1
vote
1answer
177 views

vector table address in mpcXXXX microcontrollers

I'm disassembling some mpcXXXX microcontroller firmware, and I'm trying to find the vector table and the reset interrupt. For example, I know that in ARM, in some of the microcontrollers, the vector ...
4
votes
1answer
635 views

How to identify memory access locations

I'm working on disassembling a flash dump from a TriCore TC1766 which came from a car (an MT86 ECU). My goal is to identify tables and scalars in the data area, and determine what they are used for. I ...
2
votes
2answers
779 views

Unable to extract IP camera firmware

I am trying to extract the firmware for a Panasonic WV-S2131L ip camera. It comes as a .zip file that contains a .img file. I have tried many methods to try to analyze this file and I have found ...
2
votes
1answer
780 views

Help needed to extract u-boot kernel & rootfs - nxp lpc 3143 processor

I have a board where in principle aim at emulating a DVD-ROM loading iso file from a drive. This board is running a ARM CPU with 32MB of ram and has no vga output. The firmware update comes with 2 ...
1
vote
0answers
191 views

Can anyone make much sense of this binary for an embedded system? [closed]

I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it. ...
3
votes
3answers
450 views

Jump in the middle of an instruction Coldfire firmware

I'm working on an embedded system Coldfire ROM. Currently, I'm trying to reverse engineering it to gain some more in-depth knowledge about its structure. ROM code quality seems pretty low, and I see ...
2
votes
1answer
270 views

Setting register names in Radare2

I am reverse-engineering an 8051 architecture program of a specific chip. The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is ...
4
votes
1answer
312 views

Z80 Absolute Jump to offset in middle of instruction

I'm working on reverse engineering an embedded system which uses a Z80 processor. I'm using IDA as the disassembler. I ran upon an absolute jump (JP) that seems to jump to the middle of another ...
0
votes
1answer
651 views

Checksum error when flashing modded firmware on embedded device

I'm trying to patch strings in my firmware with a hex editor but I keep getting a checksum error when I go to re-flash the modded firmware onto my device. The device is a Roland gr-55 guitar ...
6
votes
2answers
565 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
3
votes
1answer
1k views

Extract firmware images from COTS embedded devices

I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. Is it in general possible to ...
3
votes
1answer
516 views

How does U-Boot get from this environment to booting Linux?

I'm trying to gain a root access to my ZTE F680 router. I already have a serial connection and able to interrupt the U-Boot autoboot. The problem I'm having is understanding how given the following ...
7
votes
0answers
443 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
2
votes
2answers
432 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
0
votes
2answers
970 views

How to interpret disassembled MIPS code?

I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines: Disassembly of section .data: 00000000 <.data>: ... ... f864: 30a5ffff sd ra,-23248(...
3
votes
1answer
3k views

Binwalk does not show anything when process binary

I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything. I tried commands binwalk -Me file.bin binwalk --dd='.*' file.bin strings ...
1
vote
2answers
696 views

Recreating a lzma archive (non-streamed)

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
2
votes
1answer
547 views

SPI Flash, how to find the System memory addresses?

How to determine the System memory addresses of SPI Flash used in device running eCos operating system? For example, show flash command returns the following info: Flash Device Information: ...
3
votes
1answer
260 views

Instruction set for code snippet?

I'm looking for the CPU/Instruction-Set of a closed embedded system. Code snippet: E6 F2 F3 15 E6 F3 0A EF E6 F8 9B 7F E6 F9 5B D5 0D 32 49 94 EA 30 60 71 What I know: E6 Fx is "LDR 16-Bit-...