Questions tagged [embedded]

Refer to devices with scarcity of resources (energy, memory, cpu power, ...). It gather any consumer electronics (radio receivers, television sets, MP3 players, video recorders, DVD players, digital cameras, camcorders, personal computers, video game consoles, telephones and mobile phones, tablets).

Filter by
Sorted by
Tagged with
-3
votes
1answer
359 views

What exactly is a SIM card?

Does a SIM card consist of only Flash memory or is there a microprocessor inside as well?
0
votes
1answer
226 views

Got root on IP camera, but init.d overwritten at boot. How to start telnetd at launch?

I've got a root shell via UART serial connection to an IP Camera that I've been playing with. Similar device is seen here: https://www.exploitee.rs/index.php/Belkin_NetCam_HD%2B It's got busybox with ...
1
vote
0answers
809 views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
5
votes
4answers
4k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
1
vote
3answers
3k views

How to extract content of NVRAM file?

How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash. NVRAM has been copied as mtdblock partition. An embedded device that run Linux v2.6.18_pro500. Linux version 2.6.18_pro500 ...
8
votes
2answers
2k views

C-sky CPU reverse-engineering

I am trying to RE a firmware for a TV STB, its based on a GX3201 chip which is based on C-sky CPU (CK610M I think). I am stuck in the following points : I am not able to properly identify the CPU ...
1
vote
1answer
1k views

Emulating Non-Linux Firmware Image of Embedded Devices

I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware ...
2
votes
0answers
603 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
-1
votes
1answer
305 views

How to read RAM of embedded system? [closed]

I have working device, that operates with RAM (random access memory). I want to grab RAM dump. I think it must be a hardware option. Is there a way to do this? Maybe anybody have some expirience?
2
votes
1answer
4k views

How to find Bootloader Load Address?

I've followed the tutorial found at: http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/ I've loaded the uboot image into IDA, but I'm not sure how to determine the load ...
1
vote
1answer
1k views

How to reverse engineer hex data on EEprom? [closed]

I am learning how to reverse engineer the EEprom data in Automotive ECUs. For such purposes as to disable the immobilisers, find millage data and workout encoded VIN numbers among other things. I ...
2
votes
1answer
2k views

Help mounting jffs2 dumped from NAND flash.

Ok so have been trying to look some settings from a jffs2 partition I extracted from a nand dump I had done previously Here ----> https://forum.openwrt.org/viewtopic.php?id=67564 Steps I have ...
3
votes
2answers
1k views

Technicolor TG799vac Modem/Router Dumping The Nand Flash

Ok, so I have been trying to dump the contents of a Technicolor TG799vac. So far I have removed the flash chip and read out the chip using the DumpFlash.py utility and used binwalk to locate the ...
1
vote
2answers
745 views

Is it possible copy and save bootloader using CLI telnet commands?

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy ...
0
votes
3answers
5k views

Limited BusyBox shell

I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell. BusyBox v1.19.2 (built-in shell (ash) Enter 'help' for a list of built-in ...
1
vote
2answers
622 views

Dlink DIR 600M firmware decompile issues

How to decompile the CGI & ROM files from the firmware bin? I am able to extract the HTML files using binwalk but the router OS and CGI files are missing. NOTE: Its not the same as DIR 600 ...
1
vote
1answer
1k views

Trying to get shell on embedded device. Analyzed firmware update, listened to Android app, no dice. Suggestions?

I have an ActiveON LX action camera i.e. a GoPro ersatz. It comes with an Android app to control it, and it does so by running its own WiFi AP for the phone to connect. Once the phone connects, it ...
5
votes
2answers
455 views

Thought I found serial port - broke embedded device instead! Help?

Well another weekend has gone by and my tinkering has caused another device to (potentially) bite the dust. I've been playing around with a couple of Slingboxes, an M1 and a 500. Today was the M1. I ...
3
votes
1answer
114 views

Help deciphering binary that creates 3 passwords

I found a binary on a device I've been working on, it's called genrandpass and the only user input is a public key (which is a .bin file) that's stored locally on the device. It also gathers some ...
2
votes
1answer
172 views

Help locating Serial Port on embedded device

I've been slowly working on getting into the workings of a set-top box. I hit a snag when the firmware that it downloads is encrypted. I managed to find some pictures of the circuit board (but haven't ...
1
vote
2answers
973 views

run netcat on qnx (armle)

I am researching an embedded device which runs QNX. I can login via telnet as a user but don't have the root password (in parallel I am running oclHashCat with the hash from the shadow file but it ...
2
votes
2answers
5k views

how to bypass CRC checksum in firmware header

I have this Ubiquiti firmware and I successfully extract the firmware and rebuild it, I modify Squashfs filesystem and rebuild it using build-firmware.sh script from firmware-mod-kit, but the problem ...
5
votes
1answer
2k views

Question about Keeloq - A car remote control standard

I have a question about Keeloq security. I have an original car remote controller (BFT Mitto 2) and I know this chip uses HCS301 with Keeloq implementation. I would like to clone this remote for my ...
2
votes
0answers
271 views

Puzzling 16bit checksum/CRC reverse engineering problem

We're having a hard time figuring out how the checksum/CRC is calculated for this serial communication protocol we're required to reverse engineer. This is a communication protocol used back in the ...
4
votes
2answers
605 views

Locating Memory Allocation Functions from Static Analysis

I'm currently working on reversing a firmware binary for an embedded device. This device is using an uncommon architecture: it is a modified Harvard architecture, running on a TMS320C55x chipset with ...
0
votes
0answers
893 views

Extracting Firmware problem with Binwalk

I'm in the process of trying to reverse engineer a firmware from unknown vendor. Here's what I got so far I have the firmware image (.mg file). AFAIK it's no common image, I couldn't find any ...
2
votes
1answer
138 views

How to connect to embedded device via charge-only USB?

For research purposes (vulnerability-analysis), I would like to connect to an embedded Linux-based device via USB. The USB is only intended for the (re)charging (according to the manufacturer of ...
3
votes
2answers
1k views

Information about Fitbit Charge firmware update mechanism?

I've been trying to get ahold of the firmware for a Fitbit Charge that I got recently. Since the device is sealed, I've been trying to see if I can get it to update its firmware and then analyze that. ...
6
votes
2answers
27k views

Extract files from a bin firmware

I have a firmware image that is used for flashing a BMW NBT navigation system that I want to research. I did a binwalk on the file (dump below). I want to extract the individual files, especially the ...
3
votes
2answers
236 views

Interpreting bluetooth string Pebble watch

I am trying to determine the bluetooth string that is sent when programmatically unloading an app from the Pebble watch. I have unloaded an app (in slot 2) 5 times, and got 5 similar but slightly ...
4
votes
1answer
2k views

Trying to reverse GPS Watch firmware image with binwalk

I'm in the process of trying to reverse engineer a GPS-watch firmware image in purpose of adding a new feature to the watch. Here's what I got so far I have the firmware image (.gcd file). AFAIK it's ...
1
vote
1answer
4k views

How to start learning reverse engineering to eventually help exploiting of modern consoles like Xbox One, PS4? [duplicate]

How can someone with little programming knowledge except for some Ruby on Rails/Ruby begin on a path of Reverse Engineering as a hobbyist to help the exploitation process of modern-day gaming consoles ...
6
votes
2answers
3k views

Why would copying a micro SD card using dd fail to produce a bootable card?

I have an embedded device which is loosely based around a Olinixino iMX233 design. This has a Freescale iMX233 microprocessor and boots from a socketed 2GB microSD card. I wish to alter the ...
3
votes
2answers
2k views

Weird binwalk output on GoPro Firmware

I'm trying to extract GoPro hero 3+ camera firmware but I'm getting a weird output from binwalk. This is the binwalk output (Uploaded to pastebin): http://pastebin.com/raw.php?i=yVZFGZT6 As you ...
4
votes
2answers
638 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
1
vote
1answer
260 views

How do I restore modified firmware to a read only mount

I have managed to get a root shell on my web filtering router by plugging into a UART on the PCB which allowed me to see a process (lockbox.bin - ELF executable) running which handles most of the ...
4
votes
3answers
8k views

Dumping firmware through mtdblock device

This is my first attempt at doing some reverse engineering. I'm trying to dump the filesystem off a huawei hg523a TalkTalk router. The problem is its quite limited in the amount of programs that are ...
2
votes
1answer
254 views

How can I figure where my router stores it's configuration across reboots?

I'm currently researching my home router (D-Link 2760-U) which has a (kind-of) proprietary ISP firmware. What I'm trying to achieve is understanding how the router is persisting it's configuration ...
11
votes
4answers
3k views

Identifying an unknown chip on a PCB

I'm working on reverse engineering a PCB (no documentation by manufacturer). I've identified all the other chips on this board but this one refuses to give up any google-able info. Are there any ...
4
votes
2answers
1k views

Proxy for TCP/UDP connections from embedded device to Internet

I have an embedded device which connects to the Internet using TCP and UDP using custom protocols on a series of ports along with DHCP, DNS, NTP and ICMP pings. It has two interfaces - a GPRS modem ...
1
vote
0answers
80 views

How to disassemble Ubicom32 binaries? [duplicate]

I cannot figure out how to disassemble these binaries I pulled from a wireless router I recently came into possession of. file output: httpd: ELF 32-bit MSB executable, version 1 (SYSV), dynamically ...
7
votes
3answers
2k views

Hauwei E586 firmware

I'm working on unpacking Hauwei E586 MiFi firmware. I downloaded firmware update pack which is available as Windows EXE, then used Hauwei Modem Flasher to unpack real firmware from installer. I've ...
20
votes
4answers
17k views

Firmware analysis and file system extraction?

I'm trying to analyse the firmware image of a NAS device. I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
5
votes
2answers
260 views

Embedding URL call into an image / movie

Is there a way to embed a URL call in the raw data of an image or movie file, such that when the image or movie is opened, it makes a call to a webserver? I want to be able to obtain someone's ...
12
votes
3answers
278k views

How do I get the location of the original audio/video file embedded on a webpage?

Some sites like The Free Dictionary, and many other translation and pronunciation services, offers a little icon next to the word so you could hear its pronunciation. How can I figure out the source ...
6
votes
1answer
1k views

How can I figure out the device memory map for an embedded system?

On many embedded systems, a great deal of communication with devices is done by reading and writing to memory-mapped I/O (MMIO) addresses in software. Supposing that I have access to the physical ...
7
votes
2answers
2k views

Does a Motorola SREC file give me any additional information over a binary ROM image?

When working with embedded systems, it is often easiest to use a downloadable firmware file rather than recover the firmware from the device. Mostly these are ROM images in the form of a .bin file. ...
1
vote
2answers
409 views

API for LockState Wireless Internet Thermostat

I want to develop a web-based API in Rails for some LockState wifi programmable thermostats, so that other different application can control these thermostats. But I'm cannot find any resource about ...

1
2