Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
4
votes
1answer
102 views

Is it possible to sniff an ATA Drive password?

Context: I have a proprietary Tandberg Data RDX QuickStor Internal USB3 drive bay for PC (item number 8666-RDX) and some storage cartridges for it. Esentially, these are just regular TOSHIBA MK3276GSX ...
-1
votes
0answers
28 views

sat receiver with GX6605S firmware binary image format and extract

I am trying to get a grip on the software of a cheap chinese sat receiver to use it as a development platform for DVB-S2 reception and further hobby exploration. It uses the GX6605S chipset from China-...
4
votes
1answer
133 views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
1
vote
0answers
23 views

How to flash Devolo Device (AR9331 MIPS) using U-Boot TFTP and .dev firmware file

after a regular firmware update using devolo-cockpit software, my Devolo dLAN 500 Wifi is bricked. The boot-loader still works and tries to download a firmware using tftp to flash it. This works but I ...
1
vote
1answer
108 views

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)? [closed]

Although I have no hope really I will leave this here in case someone has the ability and time to help. This is from a modem/router widely used in countries like Germany, Greece and others from ...
2
votes
0answers
39 views

How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?

I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them. I have dumped and decoded the bios and got some useful datas, according to datas we can see u-...
0
votes
1answer
56 views

How can I find a value in Tricore(TC1766) Arch?

I recently work on Tricore Processor, but I have some problems. With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
1
vote
0answers
22 views

ZTE AES-256-CBC Encrypted backup config file

i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output Encrypted Data Start Position: 227 ...
1
vote
0answers
46 views

How does one start with reversing router config encryption?

There is not enough info on the web from what I have seen. Most write ups/guides/blog-posts are like this: They provide only the decrypt/encrypt script-tool with how to run it and nothing else They ...
2
votes
2answers
60 views

BRANCH OCCURS in IDApro

Recently I work on TMS320C6xx Arch and when I reverse this firmware I saw functions graph nodes are separated. I have shown in below: As you see, BRANCH OCCURS wrote at the end of each node. I guess ...
0
votes
0answers
29 views

What are the open source symbolic execution tools for Firmware?

I have tried to use angr, KLEE, S2E to symbolically analyze firmware binaries such as DIR-815(httpd ELF binary). import claripy import angr p = angr.Project('./httpd', load_options={'auto_load_libs':...
1
vote
1answer
78 views

Where is the persistent storage on this router?

I am working on reversing a router for which I cannot find downloadable firmware anywhere. I managed to get a root shell on the router. I am now confused as I cannot see any persistent writeable ...
1
vote
1answer
93 views

Unable to unsquash from a FW dump

After trying to unsquash a firmware dump from a router without success, I am asking for help. I have a router with a BCM68380 CPU. After desoldering the TOSHIBA NAND chip I dumped the firmware (link ...
1
vote
0answers
91 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
0
votes
1answer
85 views

can't extract a lzma compressed file

hello i want to do the reverse engineering. for tp linkTD-W8961ND_V3 firmware here is the output DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------...
0
votes
0answers
38 views

binwalk not showing file descriptions (signatures) after 1st try

I have a bin file that shows a list of lzma compressed files which I extracted generically to .7z files using this format "binwalk -D "elf 32-bit lsb shared object":.so image.bin" ...
1
vote
0answers
24 views

advice for retrieving functions and tables from intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU

I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables and plot them out before going onto DIY hardware . . Does anyone know which ...
0
votes
0answers
64 views

Extracting a firmware image via U-Boot and mounting/expanding it

I'm attempting to extract the file system from an embedded Hi3518 SoC that runs Linux (Busybox) but has a U-Boot boot loader. There is no console once the device is fully booted, so it seems that the ...
0
votes
0answers
106 views

Binwalk on flash dump yielding useless files and empty file systems

I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer. However when I use binwalk on these dumps I end up with fragments of files mixed in ...
1
vote
1answer
39 views

how do I calculate crc32 of a u-boot header in a modified firmware image?

I'm trying to modify an openWRT frimware in order to be able to flash it in a router, these are the steps: download the latest nbg-419n2-initramfs-kernel.bin use hexedit and change first 4 bytes to “...
1
vote
1answer
44 views

Why do some firmware binaries have more than 1 file system structures

As I unpack and explore the packing structure of firmware, I am noticing that some firmware will have several file system structures. I can't seem to find any documentation as to why one device may ...
0
votes
0answers
138 views

Reverse engineering TP-Link TD-W8961N V3

I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware. After following the same question here i used the script zynos.py for unpacking the firmware and i got some files -rw-r--r-...
0
votes
0answers
35 views

firmware reversing zlib file

I get a firmware https://www.zyxel.com/us/en/support/DownloadLandingSR.shtml?c=us&l=en&kbid=M-02811&md=GS1200-5#searchZyxelTab4 I would like to look at the filesystem, but i don't figure ...
1
vote
0answers
39 views

Unpacking or split .BIN firmware for router device

Sorry for my question, i'm newbie! so i'm trying to split or unpack this file mobile_update.bin, it is an firmware for routeur device. (Based on qualcomm 9x07 and secureboot device also), i'm trying ...
0
votes
0answers
34 views

WiFi router flash layout - brick?

I'm working on to get openwrt to this Linksys e3200 router. Stock and wrt firmware did flash ok through web interface. In the progress of testing different openwrt builds I happen to brick it. I have ...
0
votes
1answer
112 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
0
votes
0answers
58 views

Firmware reversing IP camera

I'm fairly new to reversing and was tasked to reverse a IP camera to find its authentication web CGI. stuck on reversing BFLT executable and not sure where to look for the authentication, found the ...
0
votes
0answers
27 views

C166 Memory and Addressing mode

Here I think I have some wrong in base concepts, In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5. So, we ...
0
votes
0answers
108 views

Lego Super Mario Circuit board

Has anyone an idea what circuit is running inside the Lego Super Mario set? The best that I was able to find around it was this video but unfortunately is not possible to see more details of the board....
1
vote
2answers
117 views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
2
votes
2answers
94 views

Determine firmware MCU from binary image

Tough problem - trying to reverse engineer a CANBUS controller for which I can download firmware (as far as I can tell, binary image, not ELF) but I dont know what MCU it uses. binwalk, r2 dont give ...
1
vote
1answer
135 views

Encrypted firmware, need some hints

I'm relatively new to firmware reverse engineering but it has been a very interesting journey, loved it! I am currently trying to crack open the firmware of my Panasonic Lumix DC-G9 camera to see if I ...
0
votes
0answers
36 views

Data XREF in IDAPro (C166/167 Arch)

try to reverse some algo in c167 arch. in a part of the file i saw a variable that located in XRAM mov to accumulator registers and finally xor with other registers. as below: mov r1, word_E1C4 ...
0
votes
1answer
94 views

How to dump firmware from ATWINC1510

I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file. I know that the IC offers an SPI interface through the pins described in the ...
0
votes
0answers
138 views

Reversing a bootloader code (MIPS)

I'm trying to reverse a bootloader code extracted from raw memory dump of data modem. I think I extracted it correctly. Bootloader size 32768 bytes. Device use BCM3382 CPU (MIPS32) big-endian(?), eCos ...
2
votes
1answer
86 views

crc - reverse engineering GAL16V8 checksum method

While working with the GAL16V8 (an old programmable logic device), I found out that the Programmers Electronic Signature (PES) of each GAL has a checksum byte I've read the PES of some GALs but was ...
2
votes
1answer
148 views

How to import a file system image with Ghidra Headless Analyzer?

I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the ...
0
votes
0answers
124 views

Practicing Reverse Engineering To Find Default Password From Router Firmware

I am currently practicing reverse engineering to look for the default password of the Linksys V1.5 firmware here https://www.linksys.com/us/support-article?articleNum=148613 I tried to use binwalk to ...
1
vote
1answer
69 views

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
1
vote
1answer
110 views

Linux Embedded board - Kernel Panic problems

I need to duplicate an old embedded board based on a Yocto-based Linux. I have bought a new board with the same part number and now I need to put the old software in the new board (the new board has ...
0
votes
0answers
82 views

reverse engineering TP link TL-WR841N router

I am trying to reverse engineer my routers firmware. So as the first step I took uart pins and I could login to the router through serial console. I need to export the binary files to my host system. ...
1
vote
1answer
55 views

Interact with a network-less Chinese MP3 player running a modified version of Linux

My friend gave me this cheap little chinese MP3 player. I'm curious about exploring it learning more about the hardware, and potentially seeing if I could expand it's functionality in some way or run ...
0
votes
0answers
20 views

Getting dumped non linux based embedded firmware

For my research work, I am needed to get bunch of embedded firmware which is micro controller based and does not depend upon an OS like Linux and thus being solely bare metal. (Yeah! if it's not, I ...
3
votes
1answer
185 views

Custom nanddump and nandwrite tools

I am trying to reverse engineer a router's firmware. The device has a NAND chip, and has a cripled version of BusyBox v1.14.1. nanddump command exists but with intresting parameters, as I wasn't able ...
1
vote
0answers
177 views

USB packet capture; understanding the communication

Good Day- I have captured via Wireshark some data and am attempting to understand it as well as the communication protocol for USB. This one capture contains the sequence 02010c, which tells me the ...
0
votes
0answers
84 views

Obfuscated and/or encrypted firmware?

I own 3 samples file of a firmware but I can't determine if it's obfuscated and/or encrypted. Could you give some hint about it? Here is the following samples: Sample 1 Sample 2 Sample 3
0
votes
2answers
177 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
0
votes
0answers
142 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
0
votes
0answers
58 views

How to dump firmware from an SD card?

I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card ...
0
votes
1answer
69 views

Need some help and advices as regards as reverse engineering IoT devices

Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker I ...

1
2 3 4 5
8