Questions tagged [embedded]

Refer to devices with scarcity of resources (energy, memory, cpu power, ...). It gather any consumer electronics (radio receivers, television sets, MP3 players, video recorders, DVD players, digital cameras, camcorders, personal computers, video game consoles, telephones and mobile phones, tablets).

25 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
7
votes
0answers
358 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
6
votes
2answers
484 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
4
votes
2answers
648 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
3
votes
0answers
1k views

Reverse engineering unknown RS232/UART binary protocol

Background story For couple of days I'm trying to crack the protocol used the old medical device, in order to collect data for a research in an automated way. The device in question is Novametrix ...
2
votes
0answers
60 views

Voltage Glitching to Read Internal EEPROM

I am trying to read the cryptographic key from my car key fob for exploration, basically seeing if I can clone it. I popped open the case and I see it's using a Microchip HCS361. The HCS361 stores it'...
2
votes
2answers
358 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
2
votes
0answers
75 views

Identifying unknown chip - markings erased

There seems to be a (relatively) easy way to remove the markings on a chip via laser. When reverse engineering a device with such a chip, what would be some methods of identifying it. It seems that ...
2
votes
0answers
623 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
2
votes
0answers
272 views

Puzzling 16bit checksum/CRC reverse engineering problem

We're having a hard time figuring out how the checksum/CRC is calculated for this serial communication protocol we're required to reverse engineer. This is a communication protocol used back in the ...
1
vote
0answers
68 views

8 bit CRC help - Automotive

Reverse engineering some Automotive CAN data and the CRC is getting me. 8 bytes per message, with Byte 0 being the CRC. Byte 1 & 0xF contains a counter [0x0 to 0xF]. The rest of the message is ...
1
vote
1answer
180 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
1
vote
0answers
18 views

Debug only one thread with ida-gdb server

If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida. The problem is if this process has 1 thread that can't stop over than x ...
1
vote
0answers
677 views

ZyXEL P-2812HNU-F1, replacing the U-Boot on the board

I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider). To do this, I should first replace the U-Boot image ...
1
vote
0answers
829 views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
0
votes
0answers
28 views

Synchronisation Symbols in USB Transfers

I'm reversing a USB protocol of a device. It's based on USB HID reads, and writes. The protocol always has an 0xAA after the header, and every occurrence of 0xAA in the payload is doubled. After some ...
0
votes
0answers
24 views

Unpack old DLink DIR-855 firmware

I'm trying to reverse engineer an old firmware of the D-Link DIR-855. The latest binary can be found here: ftp://ftp.dlink.de/dir/dir-855/driver_software/DIR-855_fw_reva_124eub01_ALL_multi_20130614....
0
votes
0answers
32 views

Extracting a firmware image via U-Boot and mounting/expanding it

I'm attempting to extract the file system from an embedded Hi3518 SoC that runs Linux (Busybox) but has a U-Boot boot loader. There is no console once the device is fully booted, so it seems that the ...
0
votes
0answers
62 views

Reverse Engineering an 8 bit CRC

I am doing reverse engineering on some IR packets, I'm trying to figure out a CRC for some data but with no success, i tried the checksums (sum, xor...), CRC calculator crccalc.com, Reveng but with no ...
0
votes
0answers
19 views

Getting dumped non linux based embedded firmware

For my research work, I am needed to get bunch of embedded firmware which is micro controller based and does not depend upon an OS like Linux and thus being solely bare metal. (Yeah! if it's not, I ...
0
votes
0answers
27 views

Unknown 160bit challenge-response (36V ebike battery protocol)

I'm currently trying to build a custom battery pack for an electric bike. The bike uses 36V batteries from Panasonic (also sold under OEM brands Victoria, Kalkhoff, Rahleigh, Flyer, Kettler). We'...
0
votes
1answer
111 views

Reverse engineering MCU with “poor” datasheet

I'm reverse engineering a chinese MCU. The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck. This is what i've done: I got ...
0
votes
0answers
37 views

Does IDA Support Segment Shadows/Aliases

Is it possible in IDA to map a single segment (block of code/data) to multiple addresses in a single address space (a much more limited solution to the problem would be to specify how many address ...
0
votes
1answer
144 views

Protected shell in embedded linux

When I run telnetd -l /bin/sh on an embedded Linux device and use Putty to telnet to it, the provided shell is /bin/psh (protected shell). On this device, /bin/sh is a symbolic link to /bin/busybox. ...
0
votes
0answers
914 views

Extracting Firmware problem with Binwalk

I'm in the process of trying to reverse engineer a firmware from unknown vendor. Here's what I got so far I have the firmware image (.mg file). AFAIK it's no common image, I couldn't find any ...