Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
2
votes
0answers
30 views

How to perform full MIPS system emulation with QEMU, using the squashfs image and uBoot kernel image?

TL;DR: Need tips on emulation of MIPS-BE system using QEMU with the help of squashfs image file and uBoot Kernel image file extracted from the firmware file. Long Version: - What I have: A cheap ...
0
votes
0answers
43 views

Help to find the main menu apps in Nokia firmware

I am trying to custom Nokia 215 4G firmware I want to remove specific apps like games, radio, browser... If not removing it, redirecting it OR even damage it. So when you click on an app it will open ...
0
votes
0answers
40 views

Understanding operation of ALU in SAF80-C509

Good day. I'm reversing an automotive ECU firmware which works on SAF80-C509 processor (Intel 51 architecture). Now, I've got this part of code: code:64C5 mov MD0, R0 ; ...
0
votes
0answers
35 views

Questions about reverse engineering of a bootloader

I'm learning reversing, practicing with a old router(Huawei HG532s) I extracted the router's flash content with a script of this post https://wikidevi.wi-cat.ru/Huawei_HG532s 1 I have used binwalk to ...
0
votes
0answers
39 views

Help in extracting .bin firmware file of TV

I need help in extracting the .bin firmware of a tv (Sony W650A it is based on android) the firmware file is: Here I ran binwalk on it and here is the result: DECIMAL HEXADECIMAL DESCRIPTION ...
0
votes
0answers
32 views

QEMU & Firmware inside Docker

I am currently trying to run a router firmware via qemu inside a docker container. I'm using multiarch/qemu-user-static:x86_64-mips. Here is my Dockerfile: FROM multiarch/qemu-user-static:x86_64-mips ...
0
votes
0answers
45 views

Router firmware research

So I got a new tp-link router (Archer vr600) and downloaded the firmware version I'm running from the site (V2 firmware version 170504) in order to search for vulnerabilites. After some research I got ...
1
vote
1answer
93 views

how to extract this firmware .img?

how to extract this firmware .img?!? https://files.fm/u/bhgbk336r w/ binwalk i've this output: DECIMAL HEXADECIMAL DESCRIPTION ---------------------------------------------------------------...
0
votes
1answer
28 views

Which processor do I specify when I load HCS08 firmware to IDA?

Motorola/Freescale MC680xx, CPU32 (68330), MC6301, MC6303, MC6800, MC6801, MC6803, MC6805, MC6808, HCS08, MC6809, MC6811, M68H12C, ColdFire IDA claims to have the support for HCS08. But I can't see ...
0
votes
1answer
60 views

Grundfos Firmware

I am trying to understand the firmware of a Grundfos CIM 500 product. The CIM 500 is a control module for grundfos pumps which uses a web interface. From binwalk I have found that it is running eCos, ...
0
votes
0answers
26 views

HexRay API - Programatically rebaseing program on firmware

I am working on several firmwares (mostly ARM and PPC) that have no structure that IDA can decipher and so far I have been guessing BASE address until the functions and strings align with what I see ...
1
vote
0answers
57 views

Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset

I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP. The device has a custom android repo ...
2
votes
1answer
45 views

Dump Headunit Software

I am a computer engineering senior and have a few quick questions i couldn't find any hits about online. I know just enough to get myself into trouble. Note: I have no specialized tools just a DMM and ...
3
votes
1answer
112 views

Is it possible to sniff an ATA Drive password?

Context: I have a proprietary Tandberg Data RDX QuickStor Internal USB3 drive bay for PC (item number 8666-RDX) and some storage cartridges for it. Esentially, these are just regular TOSHIBA MK3276GSX ...
3
votes
1answer
302 views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
0
votes
0answers
102 views

How to flash Devolo Device (AR9331 MIPS) using U-Boot TFTP and .dev firmware file

after a regular firmware update using devolo-cockpit software, my Devolo dLAN 500 Wifi is bricked. The boot-loader still works and tries to download a firmware using tftp to flash it. This works but I ...
0
votes
1answer
237 views

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)? [closed]

Although I have no hope really I will leave this here in case someone has the ability and time to help. This is from a modem/router widely used in countries like Germany, Greece and others from ...
2
votes
0answers
58 views

How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?

I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them. I have dumped and decoded the bios and got some useful datas, according to datas we can see u-...
0
votes
1answer
64 views

How can I find a value in Tricore(TC1766) Arch?

I recently work on Tricore Processor, but I have some problems. With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
1
vote
0answers
62 views

ZTE AES-256-CBC Encrypted backup config file

i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output Encrypted Data Start Position: 227 ...
1
vote
0answers
52 views

How does one start with reversing router config encryption?

There is not enough info on the web from what I have seen. Most write ups/guides/blog-posts are like this: They provide only the decrypt/encrypt script-tool with how to run it and nothing else They ...
3
votes
2answers
77 views

BRANCH OCCURS in IDApro

Recently I work on TMS320C6xx Arch and when I reverse this firmware I saw functions graph nodes are separated. I have shown in below: As you see, BRANCH OCCURS wrote at the end of each node. I guess ...
0
votes
0answers
36 views

What are the open source symbolic execution tools for Firmware?

I have tried to use angr, KLEE, S2E to symbolically analyze firmware binaries such as DIR-815(httpd ELF binary). import claripy import angr p = angr.Project('./httpd', load_options={'auto_load_libs':...
1
vote
1answer
91 views

Where is the persistent storage on this router?

I am working on reversing a router for which I cannot find downloadable firmware anywhere. I managed to get a root shell on the router. I am now confused as I cannot see any persistent writeable ...
1
vote
1answer
129 views

Unable to unsquash from a FW dump

After trying to unsquash a firmware dump from a router without success, I am asking for help. I have a router with a BCM68380 CPU. After desoldering the TOSHIBA NAND chip I dumped the firmware (link ...
2
votes
0answers
111 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
0
votes
1answer
119 views

can't extract a lzma compressed file

hello i want to do the reverse engineering. for tp linkTD-W8961ND_V3 firmware here is the output DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------...
0
votes
0answers
57 views

binwalk not showing file descriptions (signatures) after 1st try

I have a bin file that shows a list of lzma compressed files which I extracted generically to .7z files using this format "binwalk -D "elf 32-bit lsb shared object":.so image.bin" ...
1
vote
0answers
28 views

advice for retrieving functions and tables from intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU

I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables and plot them out before going onto DIY hardware . . Does anyone know which ...
0
votes
0answers
117 views

Extracting a firmware image via U-Boot and mounting/expanding it

I'm attempting to extract the file system from an embedded Hi3518 SoC that runs Linux (Busybox) but has a U-Boot boot loader. There is no console once the device is fully booted, so it seems that the ...
0
votes
0answers
152 views

Binwalk on flash dump yielding useless files and empty file systems

I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer. However when I use binwalk on these dumps I end up with fragments of files mixed in ...
1
vote
1answer
92 views

how do I calculate crc32 of a u-boot header in a modified firmware image?

I'm trying to modify an openWRT frimware in order to be able to flash it in a router, these are the steps: download the latest nbg-419n2-initramfs-kernel.bin use hexedit and change first 4 bytes to “...
1
vote
1answer
46 views

Why do some firmware binaries have more than 1 file system structures

As I unpack and explore the packing structure of firmware, I am noticing that some firmware will have several file system structures. I can't seem to find any documentation as to why one device may ...
0
votes
0answers
236 views

Reverse engineering TP-Link TD-W8961N V3

I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware. After following the same question here i used the script zynos.py for unpacking the firmware and i got some files -rw-r--r-...
0
votes
0answers
50 views

firmware reversing zlib file

I get a firmware https://www.zyxel.com/us/en/support/DownloadLandingSR.shtml?c=us&l=en&kbid=M-02811&md=GS1200-5#searchZyxelTab4 I would like to look at the filesystem, but i don't figure ...
1
vote
0answers
44 views

Unpacking or split .BIN firmware for router device

Sorry for my question, i'm newbie! so i'm trying to split or unpack this file mobile_update.bin, it is an firmware for routeur device. (Based on qualcomm 9x07 and secureboot device also), i'm trying ...
0
votes
0answers
35 views

WiFi router flash layout - brick?

I'm working on to get openwrt to this Linksys e3200 router. Stock and wrt firmware did flash ok through web interface. In the progress of testing different openwrt builds I happen to brick it. I have ...
0
votes
1answer
166 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
0
votes
0answers
63 views

Firmware reversing IP camera

I'm fairly new to reversing and was tasked to reverse a IP camera to find its authentication web CGI. stuck on reversing BFLT executable and not sure where to look for the authentication, found the ...
0
votes
0answers
30 views

C166 Memory and Addressing mode

Here I think I have some wrong in base concepts, In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5. So, we ...
0
votes
0answers
124 views

Lego Super Mario Circuit board

Has anyone an idea what circuit is running inside the Lego Super Mario set? The best that I was able to find around it was this video but unfortunately is not possible to see more details of the board....
1
vote
2answers
177 views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
2
votes
2answers
115 views

Determine firmware MCU from binary image

Tough problem - trying to reverse engineer a CANBUS controller for which I can download firmware (as far as I can tell, binary image, not ELF) but I dont know what MCU it uses. binwalk, r2 dont give ...
1
vote
1answer
175 views

Encrypted firmware, need some hints

I'm relatively new to firmware reverse engineering but it has been a very interesting journey, loved it! I am currently trying to crack open the firmware of my Panasonic Lumix DC-G9 camera to see if I ...
0
votes
0answers
40 views

Data XREF in IDAPro (C166/167 Arch)

try to reverse some algo in c167 arch. in a part of the file i saw a variable that located in XRAM mov to accumulator registers and finally xor with other registers. as below: mov r1, word_E1C4 ...
0
votes
1answer
120 views

How to dump firmware from ATWINC1510

I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file. I know that the IC offers an SPI interface through the pins described in the ...
0
votes
0answers
170 views

Reversing a bootloader code (MIPS)

I'm trying to reverse a bootloader code extracted from raw memory dump of data modem. I think I extracted it correctly. Bootloader size 32768 bytes. Device use BCM3382 CPU (MIPS32) big-endian(?), eCos ...
2
votes
1answer
94 views

crc - reverse engineering GAL16V8 checksum method

While working with the GAL16V8 (an old programmable logic device), I found out that the Programmers Electronic Signature (PES) of each GAL has a checksum byte I've read the PES of some GALs but was ...
2
votes
1answer
225 views

How to import a file system image with Ghidra Headless Analyzer?

I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the ...

1
2 3 4 5
8