Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

1
vote
0answers
23 views

Building custom image with firmware mod kit

basically I have netis WF2409E router and i want to update it with custom image so I decided to try fmk. First I added gdbserver to usr/bin and re-packt it with fmk and upload it. After finishing ...
-1
votes
0answers
24 views

Reverse 6531E Chip flash/firmware [closed]

I have a feature phone and It has the phenomenon of sending messages and internet access illegally. I want to reverse it to know. Now I had a flash of this phone, but I don't know structure of this ...
1
vote
0answers
49 views

Binary Analysis Tool (BAT) no longer maintained - alternatives?

I read on the BAT github page that BAT is no longer actively maintained. Why did the project come to an end? What alternatives are there to unpack all kinds of archives / firmwares / binary ...
2
votes
1answer
60 views

Binwalk does not show anything when process binary

I tried use Binwalk to extract content of binary firmware image dumped from flash, but Binwalk does not show anything. I tried commands binwalk -Me file.bin binwalk --dd='.*' file.bin strings ...
1
vote
0answers
66 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...
1
vote
1answer
46 views

Recreating a lzma archive (non-streamed)

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from ...
1
vote
1answer
134 views

*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,… file firmware)

I have some questions well today I tried to emulate with (Qemu) a STB firmware (.abs extension file) in Qemu. So I tried to unpack the .abs file I got many files. Example for: Amiko HD8150 2.4.43 emu ...
0
votes
1answer
128 views

How to unpack(carve) files from a camera firmware .bin file? [closed]

Would anyone be willing to help me with carving/extracting files from a firmware file? I've tried to extract with binwalk, but it didn't extract everything. I checked it out with ent to see if there's ...
0
votes
1answer
87 views

Is this firmware using a substitution cipher?

I'm trying to extract data from a firmware file. I used binwalk on the firmware, which found a single chunk of Zlib compressed data. I uncompressed this data, and used strings on the result, which ...
4
votes
1answer
299 views

Strange or encrypted ipcam firmware

I'm trying to extract an IP camera firmware. I am searching for a sleeping service that could be a major threat. According to nmap there are no running services such as telnet, SSH, FTP or similar; ...
0
votes
0answers
69 views

How can I know that EEPROM image is ok?

My DVR device was with some port open for 1 night. Here is what I read from flash https://www.dropbox.com/s/wkeqi16iyl8t87r/qt2.bin?dl=0. Can I rebuild EEPROM image from firmware update downloaded ...
0
votes
1answer
46 views

How do the new Swedish implantable microchips work?

So now we see that the Swedes are going large with their implantable chips which allow them to carry out certain kinds of transactions without using plastic. Thousands of people in Sweden get ...
6
votes
2answers
181 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
1
vote
0answers
75 views

Microcontroller memory dump

I have a board which has STM32F103RE microcontroller. Its datasheet can be found here. Since I have found in the internet only firmware that seems to be encrypted/compressed, I'm trying to figure out ...
5
votes
0answers
179 views

What is a TROC Filesystem, and how do I mount it?

I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem: DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------------...
0
votes
2answers
128 views

How does QPST work and how can I make an app like it?

How does Qualcomm's QPST work? Or what protocol/commands does QPST use? As I wanted to develop an app like it, I searched for AT commands. But I can't find out any AT commands that allows me access(...
0
votes
1answer
384 views

binwalk showing “Unix path”, how to extract the filesystem?

When I run binwalk on a abs firmware that I'm trying to unpack, the output shows several "Unix path" entries DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------...
0
votes
2answers
237 views

Reverse Engineering 8051 firmware

I am looking to reverse engineer an 8051 firmware binary file and am not certain where to start. The firmware is for the Real RTL8188EE wireless card. It is located here: https://github.com/lwfinger/...
0
votes
4answers
669 views

Extract firmware from a usb device like for example a USB stick

I am breaking my head the last few days over how you should extract the firmware from a USB device I searched all over the internet but I could not find a straight forward way to do it. Just to ...
1
vote
1answer
186 views

How to add new language to ARM firmware

I have piece of firmware (download from here) and I need to get access to its filesystem. Here is the output of a binwalk scan: root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=".*" ps.bin ...
1
vote
0answers
308 views

Arm hex firmware reverse

it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters. One of my goal was to understand how they bypassed (hacked) ...
0
votes
1answer
177 views

Finding JTAG/UART Connections

I need help identifying the UART or JTAG connections on this board. I would like to dump the firmware using a pirate bus.
5
votes
0answers
194 views

Issues with reversing LZSS compression algorithm

I am trying to reverse engineer my HP printer's firmware, so I dumped the SPI chip from the board, and there are a lot of strings, but almost always look something like this: I noticed a pattern that ...
0
votes
1answer
441 views

Adding additional language to Linux based Firmware of Volkswagen Car Radio

I'm owning a CarPlay head unit from Volkswagen called RCD330 plus. It is possible to upgrade/downgrade to any available firmwares. For example here are two firmware versions: http://rcd330plus.com/rcd/...
0
votes
1answer
40 views

Where Is device specific information kept on smart devices

I am doing a project for school on Emulation of device using its firmware. Using firmadyne, I can start up the smart device unfortunately because it is not a real device, information fields like ...
5
votes
2answers
2k views

Binwalk alternative

When examining bin firmware files Binwalk is an extremely helpful tool. There are times though that Binwalk comes up empty and a lot more digging is required to make sense of the data. Are there any ...
1
vote
1answer
286 views

Binwalk could not extract the full content

Binwalk v2.1.1 on Ubuntu, and tried to research Zyxel Router firmware. First I unzipped FW, there was 3 files: 360AUG0C0.bin, 360AUG0C0.rom, AUG107.bm I used binwalk to extract content of bin file, ...
2
votes
1answer
186 views

Disassemble CC2541 firmware (TI SensorTag)

I'm digging into a BLE product based on a CC2541 MCU (similar to the Texas Instruments SensorTag). So for experimenting we can use an official firmware: http://processors.wiki.ti.com/images/1/10/...
1
vote
1answer
293 views

Reverse Engineering BIOS (AMI A0.57)

Recently I got really interested in BIOS RE and I used chipsec to dump the content of SPI Flash ROM of my HP Omen Desktop PC to start my journey. But unlike older BIOSes, the binary file was pretty ...
3
votes
1answer
553 views

Entry point for STM32 firmware

I'm trying to disassemble a firmware for a DIY project, open hardware but closed firmware. My question is how to initialize the disassembler properly (Hopper Disassembler). The values I try to figure ...
1
vote
1answer
263 views

Rebuilding firmware back to binary file

I used Binwalk to extract firmware files, extracted content include 2 folders and one binary file. squashfs-root _351C.extracted 351C Squashfs-root contains file system, '_351C.extracted' folder ...
1
vote
1answer
85 views

How to check proprietary firmware for GPL violation

I have a proprietary binary (firmware), and I'd like to check whether it contains opensource components. I'm thinking about extracting what it contains - probably binaries - and use strings, grep and ...
0
votes
0answers
311 views

Reversing TP Link's TX6610 firmware (header)

I'm working on REing TP Link's TX6610 firmware. I have been able to successfully unpack the files from the firmware by using binwalk (thus the results are not quite accurate). I also have been working ...
1
vote
0answers
72 views

Difficulty decrypting nested PKCS #7 / AES router configuration file

I am trying to decrypt a router configuration backup file that appears to be a combination of a 128-byte header, a PKCS #7 encrypted file, and another OpenSSL salted format encrypted file. I think ...
0
votes
1answer
431 views

Unpacking firmware

I have a ROM dump firmware which must be reversed (as a task). Binwalk output: DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------...
0
votes
1answer
199 views

Unpacking ROM dump

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode ...
4
votes
1answer
139 views

Decoding LZSS buffer lookup indices

I'm working on unpacking a camera firmware file which consists of various sections that I am able to correctly split and validate. One section within this file is additionally compressed with a form ...
5
votes
1answer
631 views

Disassembling VxWorks Firmware

I am trying to disassemble the firmware for the Cisco Sx300 switch as found here: https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76 ...
1
vote
1answer
338 views

How can I convert a .bin file to either assembly or C?

I have a .bin file (It's a firmware belongs to a hardware (Cisco Access-Point) ). All I need to do is modifying that .bin file. As you know, .bin files aren't human readable. I need to convert it to ...
4
votes
2answers
444 views

Are there any project based books that teach reverse engineering?

I want to learn to reverse engineer hardware/firmware as well as software (eventually, i want to focus on hardware/firmware now). I have some experience programming STM32 microcontrollers as well as ...
4
votes
2answers
622 views

Is there a method for “guessing” the addresses for unknown areas in bare metal firmware binaries?

Imagine this: You have a binary for a piece of ARM firmware. You are nearly 100% it is ARM, and that it runs on the bare metal. You obtained this firmware from a manufacturers update page. However, ...
1
vote
1answer
71 views

Redirecting Program Output from /dev/*char_device* to Text File

I am currently trying to reverse an IoT machine running the 2.6 Linux Kernel on which I have root. On this machine, software writes to /dev/some_device to control what I believe to be are GPIO pins ...
6
votes
3answers
6k views

Help reversing end-of-life'd Logitech Link. How to get Flash Contents

See Update below. I got an email from Logitech that they are End of Lifing their Harmony Link product (see https://community.logitech.com/s/question/0D55A0000745EkCSAU/harmony-link-eos-or-eol). So I ...
0
votes
0answers
73 views

Numark NDX400 firmware modifying (DSP code)

The Numark NDX400 is quite a good player if you only look it for a short time: has CD and USB support, good button layout, decent sound and build quality. But as you use it more, the shortcomings are ...
0
votes
0answers
140 views

Help identifying unknown boot console UART ARM CPU before U-Boot bootloader and/or read flash image?

I have an embedded Linux device with flash storage, using a U-Boot boot loader, that I am accessing via serial UART. The ARM Linux kernel that loads identifies the device as having an ARM926EJ-S ...
0
votes
2answers
395 views

binwalk on reversing switch firmware

everyone. I am a green apple in reversing. Recently i wanna reverse a switch but get some problems. i reaaaaaaaaly need your guys help. first i extract the .bin file from the switch and use binwalk ...
1
vote
1answer
390 views

How to unpack the Fortigate firmware?

I want to unpack the fortigate firmware - FGT_110C-v400-build0092-FORTINET.out. binwalk only gives a hint about gzip compressed data. ~/Documents# binwalk -i FGT_110C-v400-build0092-FORTINET.out ...
1
vote
2answers
1k views

Home router's firmware reverse engineering

I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(it's an ISP's speedport entry 2i router(zte variant)). So long story ...
0
votes
0answers
434 views

jffs2 extraction

I took the firmware from the EEPROM of my IP camera, it has jffs2 file system. once i extract it there is no file system, the entire folder is empty. what will be the reason and any suggestion? ...
0
votes
1answer
373 views

Disassembling Hikvision DVR firmware?

The firmware update page on Hikvision provide .dav files. I've been trying to disassemble these files, but to no success. Binwalk isn't helping here as well. This is what it outputs: Here's a link ...