Questions tagged [embedded]

Refer to devices with scarcity of resources (energy, memory, cpu power, ...). It gather any consumer electronics (radio receivers, television sets, MP3 players, video recorders, DVD players, digital cameras, camcorders, personal computers, video game consoles, telephones and mobile phones, tablets).

25 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
7
votes
0answers
311 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
6
votes
2answers
443 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
4
votes
2answers
636 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
3
votes
0answers
312 views

How does U-Boot get from this environment to booting Linux?

I'm trying to gain a root access to my ZTE F680 router. I already have a serial connection and able to interrupt the U-Boot autoboot. The problem I'm having is understanding how given the following ...
3
votes
0answers
1k views

Reverse engineering unknown RS232/UART binary protocol

Background story For couple of days I'm trying to crack the protocol used the old medical device, in order to collect data for a research in an automated way. The device in question is Novametrix ...
2
votes
0answers
47 views

Voltage Glitching to Read Internal EEPROM

I am trying to read the cryptographic key from my car key fob for exploration, basically seeing if I can clone it. I popped open the case and I see it's using a Microchip HCS361. The HCS361 stores it'...
2
votes
2answers
320 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
2
votes
0answers
75 views

Identifying unknown chip - markings erased

There seems to be a (relatively) easy way to remove the markings on a chip via laser. When reverse engineering a device with such a chip, what would be some methods of identifying it. It seems that ...
2
votes
0answers
596 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
2
votes
0answers
270 views

Puzzling 16bit checksum/CRC reverse engineering problem

We're having a hard time figuring out how the checksum/CRC is calculated for this serial communication protocol we're required to reverse engineer. This is a communication protocol used back in the ...
1
vote
0answers
63 views

8 bit CRC help - Automotive

Reverse engineering some Automotive CAN data and the CRC is getting me. 8 bytes per message, with Byte 0 being the CRC. Byte 1 & 0xF contains a counter [0x0 to 0xF]. The rest of the message is ...
1
vote
3answers
128 views

Reverse Engineering RS232 protocol misterious last byte

I have an old water purifier system that consists of a PDA and a main board (I think the ic is a Renesas) that communicate by RS232, I need to know the protocol they use to communicate in order to ...
1
vote
0answers
14 views

Debug only one thread with ida-gdb server

If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida. The problem is if this process has 1 thread that can't stop over than x ...
1
vote
0answers
654 views

ZyXEL P-2812HNU-F1, replacing the U-Boot on the board

I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider). To do this, I should first replace the U-Boot image ...
1
vote
0answers
806 views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
0
votes
0answers
16 views

Getting dumped non linux based embedded firmware

For my research work, I am needed to get bunch of embedded firmware which is micro controller based and does not depend upon an OS like Linux and thus being solely bare metal. (Yeah! if it's not, I ...
0
votes
0answers
26 views

Unknown 160bit challenge-response (36V ebike battery protocol)

I'm currently trying to build a custom battery pack for an electric bike. The bike uses 36V batteries from Panasonic (also sold under OEM brands Victoria, Kalkhoff, Rahleigh, Flyer, Kettler). We'...
0
votes
1answer
88 views

Reverse engineering MCU with “poor” datasheet

I'm reverse engineering a chinese MCU. The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck. This is what i've done: I got ...
0
votes
1answer
90 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
0
votes
0answers
33 views

Does IDA Support Segment Shadows/Aliases

Is it possible in IDA to map a single segment (block of code/data) to multiple addresses in a single address space (a much more limited solution to the problem would be to specify how many address ...
0
votes
1answer
76 views

Protected shell in embedded linux

When I run telnetd -l /bin/sh on an embedded Linux device and use Putty to telnet to it, the provided shell is /bin/psh (protected shell). On this device, /bin/sh is a symbolic link to /bin/busybox. ...
0
votes
0answers
86 views

Radare2 jump/switch table walk for 8051

For 8051 target exist famous no-return function with body of d083d082f8e4937012740193700da3a393f8740193f5828883e4737402936860efa3a3a380df which correspond to ?C?CCASE function: / 38: fcn.00000000 ...
0
votes
0answers
37 views

What kind of memory representation is this?

I am reverse engineering a protocol used by an embedded device. This protocol message contains an 8-bit field which I believe to represent an integer number. To analyze the format used to encode such ...
0
votes
0answers
890 views

Extracting Firmware problem with Binwalk

I'm in the process of trying to reverse engineer a firmware from unknown vendor. Here's what I got so far I have the firmware image (.mg file). AFAIK it's no common image, I couldn't find any ...