Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
2
votes
0answers
34 views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
0
votes
0answers
35 views

WPA2-PSK default password generation algorithm in router - now what?

I'm interesting in reverse-engineering default WPA2-PSK password algorithm on specifics router. I have the firmware I find from a github (pretty lucky) and identified an ELF 32-bit MSB executable, ...
1
vote
0answers
55 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
0
votes
1answer
43 views

Is it possible to extract the binary firmware of a feature phone? [closed]

I am new at reverse engineering but very eager to learn. I have a feature phone it5081 and downloaded it's binary firmware. I have googled and came to know about tools like binwalk,firmware mod kit as ...
0
votes
0answers
47 views

Reversing Philips TV firmware

This is more an experiment than anything else, but here it goes, I'm no RE expert, but I have this Philips TV around, whose firmware can be downloaded here I unpacked it with binwalk and got this as ...
-2
votes
0answers
27 views

Getting Started with Firmware analysis

I want to learn firmware analysis and modification for making custom firmware for gadgets,I got inspired by this https://medium.com/@yogeshojha/i-hacked-miband-3-and-here-is-how-i-did-it-part-ii-...
2
votes
1answer
93 views

Analysis of BusyBox Shell router U-Boot firmware

I am trying to get access to the BusyBox Shell and if possible to get a firmware dump. The "U-Boot" has limited possibilities but what is good is "sf - SPI flash sub-system". Can anyone help me get ...
1
vote
1answer
28 views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
1
vote
0answers
43 views

Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate

I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to ...
3
votes
0answers
50 views

Uniden FW Hacking

I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly. FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
0
votes
0answers
35 views

How can I find loading adress of eCos firmware

From:https://www.tendacn.com/en/download/detail-3482.html Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside ...
3
votes
1answer
101 views

What, tools do I need to break down the N64 console for private study? [closed]

Alright, I need to know this ASAP, I'm breaking down my own n64 console for private study on the n64 firmware and how it does what it does best. So, what tools would I need To break down this console?...
1
vote
0answers
46 views

TMS320VC5416 DSP firmware reversing

I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers: page: 0000 offset: 0080 len: 0149 page: 0000 ...
2
votes
0answers
86 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
1
vote
1answer
82 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
2
votes
1answer
70 views

Identifying ROM segment in unknown firmware update file

I am working on reversing a firmware update from a FujiFilm FinePix S1800 camera. So far I have managed to identify the instruction set (ARCompact) and dump a few things from the camera using the ...
1
vote
1answer
81 views

Dumping USB firmware [closed]

How do I dump the firmware of a USB stick? What are the steps and what tools do I need? I understand that I may have to take the USB stick apart.
0
votes
0answers
33 views

How to extract file system from encrypted ROM image by emulating bootloader?

I have extracted a rom flash image from a Flash Memory chip on a modem I am trying to reverse engineer. The problem is that when I run binwalk it does not identify anything. When I look at the file ...
1
vote
1answer
126 views

CSR DFU File Format

I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question ...
1
vote
2answers
128 views

Way to know if firmware is compressed

I dumped a wifi firmware of ps3 console but it seems that this firmware is compressed. Here you can have some informations : https://www.psdevwiki.com/ps3/Wifi_Firmware What can I do to decompress it ...
0
votes
0answers
31 views

ZynOS decompress tools

is there any tools for decompressing zynos firmware and compress it after edit little things in it ??? I have firmware called ras I'm trying to edit it but couldn't find any thing help it's for tp-...
0
votes
1answer
36 views

Multiple memory regions mapped to same data

I'm analyzing a Seagate HDD that provides a serial boot console that allows reading/writing bytes to memory and setting an address pointer. There's a block of memory from 0x0 to 0x20000 and then it ...
2
votes
1answer
101 views

Problem with analyzing a JFFS2 Filesystem

I extracted the content of a NAND Flash and analyzed it with binwalk. Binwalk showed me that the dump contains a big endian JFFS2 filesystem. My next step was extracting the files into a directory. To ...
0
votes
0answers
84 views

How to repack reverse-engineered router firmware?

I managed to unpack the filesystem contents of a TP-Link router .bin file using binwalk, dd and unsquashfs. The squash FS was at the end of the bin file, the part before having a relatively large lzma ...
1
vote
1answer
69 views

SD card microcontroller

I have an SD card that I want to copy the firmware / memory from, my question is what pinouts do I connect to the SPI programmer and what are the commands to copy all of the firmware /memory. Thank ...
1
vote
1answer
57 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
0
votes
1answer
75 views

Found a lot of function names in firmware dump. Is it possible to recreate original code?

I'm using IDA PRO 5.0 Free to analyze firmware from a camcorder (mn103 processor). I'm a complete newbie in reverse engineering so it's hard for me to learn how it works only using assembly code. I ...
0
votes
0answers
109 views

How do I decompile/modify a .dfu file?

I'm trying to get my old 3D printer to work with wifi again. A while ago the company was shut down and the printer relied on their website for print queues and stuff, so now the only way to use the ...
1
vote
1answer
83 views

Loading 8051 binary to IDA with ROM+External RAM configuration

I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses: In this example the ROM size is ...
0
votes
2answers
124 views

Using NAND flash dump with OOB data

I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions ...
2
votes
0answers
217 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
3
votes
0answers
117 views

Reverse Engineering Firmware Aether Cone

I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no ...
1
vote
0answers
125 views

Decrypting the Config file of a Huawei router “HG630 V2”

followed that post from Wordpress https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/ Extracted the 4 Hex strings needed. But, looks ...
4
votes
2answers
178 views

router: how to break into boot?

I have an ISP-provided router, Huawei B5318-42. I connected to it through UART and a UART-USB converter, copied the output from boot, and managed to figure out which chip is the onboard flash memory. ...
1
vote
1answer
83 views

Extract Web Contents From Cisco Firmware Data IMG File

I download firmware https://software.cisco.com/download/home/284973404/type/284971397/release/1.1.4.1 I extract with binwalk sudo apt-get install -y binwalk' binwalk -eM Sx220-R1.1.4.1.bin cd ...
1
vote
3answers
221 views

Open a NEC binary in Ghidra

I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors. Does Ghidra support NEC processors? Is there anything I ...
0
votes
1answer
52 views

BOSCH EDC development

I'm trying to reverse engineer some BOSCH EDCs firmware (there are many of them on the internet, for example: Here). To understand it better, I was wondering if someone has any idea how those EDCs ...
1
vote
1answer
172 views

How to extract firmware from a western digital hard drive with custom firmware

Hi all i got a western digital hard drive from a DVR which contains custom firmware so you will not be able to install any hard drive you want on the DVR device. (digital video recorder) something ...
1
vote
2answers
259 views

ECU tune and reverse engineering

I'm new to the ECU (or chip) tune concept, and I try to understand what is going on there. I understand the concept and the goal, but I'm having difficulties to understand what is actually going on ...
1
vote
0answers
49 views

How can I emulate Huawei routers HG5xx firmware?

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
1
vote
1answer
435 views

unpacking Download.img firmware for alcatel mw40

Hello i'm trying to unpack file Download.img from alcatel mw40 (based on qualcomm 9x07) firmware but it seems i can't do it with 7zip or mount the img file . someone already extracted the file which ...
1
vote
2answers
115 views

Split IDA segment into sub segments

I'm reversing a firmware, that comes in one big binary chunk(.bin file). After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
0
votes
1answer
546 views

how can i decrypt huawei HG531s v1 config file?

I have tried to follow this guide but libxmlapi.so didn't have the required ATP_GetInfo1 function so i moved to the next file libhttpapi.so it had ATP_GetInfo1 ATP_GetInfo2 ATP_GetInfo3 ...
1
vote
0answers
18 views

Avrdude inconsistent readings

I have a problem with this dude and i don't know what to do to make him do a consistent reading or to figure out which reading is the perfect one I'm trying to read my own arduino uno which has a ...
1
vote
1answer
78 views

vector table address in mpcXXXX microcontrollers

I'm disassembling some mpcXXXX microcontroller firmware, and I'm trying to find the vector table and the reset interrupt. For example, I know that in ARM, in some of the microcontrollers, the vector ...
2
votes
0answers
536 views

Extracting ARM Boot zImage

I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
1
vote
0answers
104 views

Find File System in Firmware

This is my first attempt at working with firmware. We have some SNMP cards that are flaky & my ultimate goal is to try to make them better. The current firmware version is 12.06.0069. When ...
0
votes
0answers
219 views

unsquashfs failed to read SquashFS file

I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor. binwalk ...
1
vote
0answers
63 views

Need help : restoring a netgear dgn1000 v3 adsl modem/router

coming in from openwrt forum: https://forum.openwrt.org/t/trying-to-rescue-bricked-dgn1000-v3-need-help/36909 currently have serial console but i may have borked the u-boot looking for help on how to ...
1
vote
0answers
469 views

How to extract DVB firmware bin file?

I have a bin file of DVB(DTH) box firmware I want to change one image inside that bin file how I can do this please guide me in right direction. I tried bin walk but the file that it extracted ...