Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
0
votes
0answers
42 views

Firmware reversing IP camera

I'm fairly new to reversing and was tasked to reverse a IP camera to find its authentication web CGI. stuck on reversing BFLT executable and not sure where to look for the authentication, found the ...
0
votes
0answers
23 views

C166 Memory and Addressing mode

Here I think I have some wrong in base concepts, In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5. So, we ...
0
votes
0answers
49 views

Lego Super Mario Circuit board

Has anyone an idea what circuit is running inside the Lego Super Mario set? The best that I was able to find around it was this video but unfortunately is not possible to see more details of the board....
1
vote
2answers
52 views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
2
votes
2answers
73 views

Determine firmware MCU from binary image

Tough problem - trying to reverse engineer a CANBUS controller for which I can download firmware (as far as I can tell, binary image, not ELF) but I dont know what MCU it uses. binwalk, r2 dont give ...
1
vote
1answer
83 views

Encrypted firmware, need some hints

I'm relatively new to firmware reverse engineering but it has been a very interesting journey, loved it! I am currently trying to crack open the firmware of my Panasonic Lumix DC-G9 camera to see if I ...
0
votes
0answers
28 views

Data XREF in IDAPro (C166/167 Arch)

try to reverse some algo in c167 arch. in a part of the file i saw a variable that located in XRAM mov to accumulator registers and finally xor with other registers. as below: mov r1, word_E1C4 ...
0
votes
1answer
60 views

How to dump firmware from ATWINC1510

I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file. I know that the IC offers an SPI interface through the pins described in the ...
0
votes
0answers
109 views

Reversing a bootloader code (MIPS)

I'm trying to reverse a bootloader code extracted from raw memory dump of data modem. I think I extracted it correctly. Bootloader size 32768 bytes. Device use BCM3382 CPU (MIPS32) big-endian(?), eCos ...
2
votes
1answer
71 views

crc - reverse engineering GAL16V8 checksum method

While working with the GAL16V8 (an old programmable logic device), I found out that the Programmers Electronic Signature (PES) of each GAL has a checksum byte I've read the PES of some GALs but was ...
2
votes
1answer
59 views

How to import a file system image with Ghidra Headless Analyzer?

I am currently debugging the EXT4 loader, and using the GUI and selecting the file every time is fairly annoying. The simpler solution would be to have a Headless Analyzer invocation that imports the ...
0
votes
0answers
81 views

Practicing Reverse Engineering To Find Default Password From Router Firmware

I am currently practicing reverse engineering to look for the default password of the Linksys V1.5 firmware here https://www.linksys.com/us/support-article?articleNum=148613 I tried to use binwalk to ...
1
vote
1answer
60 views

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
1
vote
1answer
91 views

Linux Embedded board - Kernel Panic problems

I need to duplicate an old embedded board based on a Yocto-based Linux. I have bought a new board with the same part number and now I need to put the old software in the new board (the new board has ...
0
votes
0answers
40 views

reverse engineering TP link TL-WR841N router

I am trying to reverse engineer my routers firmware. So as the first step I took uart pins and I could login to the router through serial console. I need to export the binary files to my host system. ...
1
vote
1answer
43 views

Interact with a network-less Chinese MP3 player running a modified version of Linux

My friend gave me this cheap little chinese MP3 player. I'm curious about exploring it learning more about the hardware, and potentially seeing if I could expand it's functionality in some way or run ...
0
votes
0answers
19 views

Getting dumped non linux based embedded firmware

For my research work, I am needed to get bunch of embedded firmware which is micro controller based and does not depend upon an OS like Linux and thus being solely bare metal. (Yeah! if it's not, I ...
1
vote
1answer
86 views

Custom nanddump and nandwrite tools

I am trying to reverse engineer a router's firmware. The device has a NAND chip, and has a cripled version of BusyBox v1.14.1. nanddump command exists but with intresting parameters, as I wasn't able ...
1
vote
0answers
57 views

USB packet capture; understanding the communication

Good Day- I have captured via Wireshark some data and am attempting to understand it as well as the communication protocol for USB. This one capture contains the sequence 02010c, which tells me the ...
0
votes
0answers
75 views

Obfuscated and/or encrypted firmware?

I own 3 samples file of a firmware but I can't determine if it's obfuscated and/or encrypted. Could you give some hint about it? Here is the following samples: Sample 1 Sample 2 Sample 3
0
votes
1answer
81 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
0
votes
0answers
97 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
0
votes
0answers
39 views

How to dump firmware from an SD card?

I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card ...
0
votes
1answer
57 views

Need some help and advices as regards as reverse engineering IoT devices

Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker I ...
0
votes
0answers
26 views

Unknown 160bit challenge-response (36V ebike battery protocol)

I'm currently trying to build a custom battery pack for an electric bike. The bike uses 36V batteries from Panasonic (also sold under OEM brands Victoria, Kalkhoff, Rahleigh, Flyer, Kettler). We'...
2
votes
0answers
99 views

How can I modify files in a jffs2 image

I'm working with the firmware of SIP phone. I extracted the JFFS2 file system image from the firmware and mounted it using modprobe ike this: sudo modprobe mtdram total_size=36360 sudo modprobe ...
0
votes
0answers
64 views

Trying to extract an uncompressed Filesystem uImage

I'm trying to explore the firmware (Huawei LiteOS) of a Hi3518-based IP camera. From my explorations, it seems to be an uncompressed & unencrypted filesystem image but I can't seem to access the ...
3
votes
2answers
201 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
201 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
0
votes
0answers
87 views

Problem rebuilding firmware

I'm new to reverse engineering. I only want to add an app to my sat receiver. To start I tried to extract my firmware with ./extract-firmware, it's ok, and I have 1 ecos RTOS, and two cramfs in fmk/ ...
3
votes
3answers
411 views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
2
votes
1answer
217 views

Tons of error bookmark on Ghidra

I'm new to Ghidra so go easy on me. Running it on Windows. After successfully extracting a Bluetooth door lock's firmware from a nRF51, I proceeded to decompile it using Ghidra. My aim is to able to ...
1
vote
0answers
122 views

No false positive on binwalk

I have the same problem from my previous post but this time, I don't think it's the same culprit again as I have solved the problems. This time, I'm very sure I had extracted the firmware. On my ...
0
votes
0answers
61 views

Loading garmin Foretrex 601 firmware into IDA Pro

I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin) But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch. The GCD file can be ...
1
vote
2answers
132 views

Intel ME partitions EFFS and FCRS?

What is the purpose of partitions EFFS and FCRS on systems with Intel ME 8.x? Is it currently possible to parse data in EFFS partition on a ME image? I hope anyone can help, there is so little ...
0
votes
1answer
130 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
0
votes
0answers
70 views

Approaches to detect (compressed) audio in firmware

Edit: The audio data is on a separate IC There are a few seconds of audio in a toy's 128 kB firmware - somewhere... Here is a downsampled look at the bits (white = 1): My beginner's attempts to ...
0
votes
0answers
76 views

Modifying a legacy uImage

I have an old device from which I extracted a uImage. I know it has a linux kernel and a cpio filesystem in the uImage, and I need to make some changes to the filesystem. I'm hoping someone can help ...
1
vote
1answer
40 views

Help with IDA pro please — functions made are not Xref'ing to the caller

I am reversing some Motorola 9s12 (68hc12) code and using IDA pro. I am having the strangest issue. The code makes a call to a function: ROM:B300 call $BFF7, #$FE when I go to ...
0
votes
1answer
69 views

Is it possible to reverse engineer a minelab metal detector? [closed]

Minelab have a metal detector called the equinox, there are 2 models which are essentially the same apart from the price. The minelab equinox 600 is the cheaper model The minelab equinox 800 is the ...
1
vote
0answers
166 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
1
vote
1answer
288 views

How to make sense of RTOS in firmware?

I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...
5
votes
1answer
383 views

Stuck on XOR decryption of firmware

TL;DR I have an encrypted image and the cleartext version, and I'm almost certain it's an XOR cipher, but I can't figure out how to decrypt it. I have a few clues listed below. Ciphertext excerpt (...
0
votes
0answers
25 views

i.MX28x device reading

I'm stuck at identifying JTAG pin layout There are 6 pins the lower one of them is ground but don't know about the other ones I used jtagulator to identify the pins which I used before and ...
2
votes
2answers
119 views

BIOS first jump leads to empty memory

I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
0
votes
1answer
70 views

Is it possible to read a device's firmware or internal programming in computer's RAM?

Let us say I want to reverse engineer a PCIe-based FPGA device. Can I read or extract the IP core or any firmware in the computer's RAM or by trying to communicate with the device in some way?
2
votes
0answers
300 views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
0
votes
0answers
99 views

WPA2-PSK default password generation algorithm in router - now what?

I'm interesting in reverse-engineering default WPA2-PSK password algorithm on specifics router. I have the firmware I find from a github (pretty lucky) and identified an ELF 32-bit MSB executable, ...
1
vote
0answers
104 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...

1
2 3 4 5
7