Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
1
vote
2answers
49 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
0
votes
1answer
39 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up for now what I have done was to use the Ghidra's included "Decompile" script and filtered out the function ...
0
votes
0answers
25 views

Problem rebuilding firmware

I'm new to reverse engineering. I only want to add an app to my sat receiver. To start I tried to extract my firmware with ./extract-firmware, it's ok, and I have 1 ecos RTOS, and two cramfs in fmk/ ...
2
votes
3answers
113 views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
1
vote
1answer
142 views

Tons of error bookmark on Ghidra

I'm new to Ghidra so go easy on me. Running it on Windows. After successfully extracting a Bluetooth door lock's firmware from a nRF51, I proceeded to decompile it using Ghidra. My aim is to able to ...
0
votes
0answers
95 views

No false positive on binwalk

I have the same problem from my previous post but this time, I don't think it's the same culprit again as I have solved the problems. This time, I'm very sure I had extracted the firmware. On my ...
0
votes
0answers
31 views

Loading garmin Foretrex 601 firmware into IDA Pro

I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin) But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch. The GCD file can be ...
1
vote
2answers
85 views

Intel ME partitions EFFS and FCRS?

What is the purpose of partitions EFFS and FCRS on systems with Intel ME 8.x? Is it currently possible to parse data in EFFS partition on a ME image? I hope anyone can help, there is so little ...
0
votes
1answer
61 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
0
votes
0answers
63 views

Approaches to detect (compressed) audio in firmware

Edit: The audio data is on a separate IC There are a few seconds of audio in a toy's 128 kB firmware - somewhere... Here is a downsampled look at the bits (white = 1): My beginner's attempts to ...
0
votes
0answers
44 views

Modifying a legacy uImage

I have an old device from which I extracted a uImage. I know it has a linux kernel and a cpio filesystem in the uImage, and I need to make some changes to the filesystem. I'm hoping someone can help ...
1
vote
1answer
33 views

Help with IDA pro please — functions made are not Xref'ing to the caller

I am reversing some Motorola 9s12 (68hc12) code and using IDA pro. I am having the strangest issue. The code makes a call to a function: ROM:B300 call $BFF7, #$FE when I go to ...
0
votes
1answer
53 views

Is it possible to reverse engineer a minelab metal detector? [closed]

Minelab have a metal detector called the equinox, there are 2 models which are essentially the same apart from the price. The minelab equinox 600 is the cheaper model The minelab equinox 800 is the ...
1
vote
0answers
53 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
1
vote
1answer
97 views

How to make sense of RTOS in firmware?

I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...
4
votes
1answer
160 views

Stuck on XOR decryption of firmware

TL;DR I have an encrypted image and the cleartext version, and I'm almost certain it's an XOR cipher, but I can't figure out how to decrypt it. I have a few clues listed below. Ciphertext excerpt (...
0
votes
0answers
24 views

i.MX28x device reading

I'm stuck at identifying JTAG pin layout There are 6 pins the lower one of them is ground but don't know about the other ones I used jtagulator to identify the pins which I used before and ...
2
votes
2answers
96 views

BIOS first jump leads to empty memory

I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
0
votes
1answer
63 views

Is it possible to read a device's firmware or internal programming in computer's RAM?

Let us say I want to reverse engineer a PCIe-based FPGA device. Can I read or extract the IP core or any firmware in the computer's RAM or by trying to communicate with the device in some way?
2
votes
0answers
101 views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
0
votes
0answers
71 views

WPA2-PSK default password generation algorithm in router - now what?

I'm interesting in reverse-engineering default WPA2-PSK password algorithm on specifics router. I have the firmware I find from a github (pretty lucky) and identified an ELF 32-bit MSB executable, ...
1
vote
0answers
80 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
0
votes
1answer
47 views

Is it possible to extract the binary firmware of a feature phone? [closed]

I am new at reverse engineering but very eager to learn. I have a feature phone it5081 and downloaded it's binary firmware. I have googled and came to know about tools like binwalk,firmware mod kit as ...
0
votes
0answers
79 views

Reversing Philips TV firmware

This is more an experiment than anything else, but here it goes, I'm no RE expert, but I have this Philips TV around, whose firmware can be downloaded here I unpacked it with binwalk and got this as ...
2
votes
1answer
130 views

Analysis of BusyBox Shell router U-Boot firmware

I am trying to get access to the BusyBox Shell and if possible to get a firmware dump. The "U-Boot" has limited possibilities but what is good is "sf - SPI flash sub-system". Can anyone help me get ...
1
vote
1answer
117 views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
1
vote
0answers
119 views

Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate

I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to ...
3
votes
0answers
55 views

Uniden FW Hacking

I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly. FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
0
votes
0answers
51 views

How can I find loading adress of eCos firmware

From:https://www.tendacn.com/en/download/detail-3482.html Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside ...
3
votes
1answer
115 views

What, tools do I need to break down the N64 console for private study? [closed]

Alright, I need to know this ASAP, I'm breaking down my own n64 console for private study on the n64 firmware and how it does what it does best. So, what tools would I need To break down this console?...
1
vote
0answers
50 views

TMS320VC5416 DSP firmware reversing

I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers: page: 0000 offset: 0080 len: 0149 page: 0000 ...
2
votes
0answers
103 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
1
vote
1answer
123 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
2
votes
1answer
95 views

Identifying ROM segment in unknown firmware update file

I am working on reversing a firmware update from a FujiFilm FinePix S1800 camera. So far I have managed to identify the instruction set (ARCompact) and dump a few things from the camera using the ...
1
vote
1answer
120 views

Dumping USB firmware [closed]

How do I dump the firmware of a USB stick? What are the steps and what tools do I need? I understand that I may have to take the USB stick apart.
0
votes
0answers
38 views

How to extract file system from encrypted ROM image by emulating bootloader?

I have extracted a rom flash image from a Flash Memory chip on a modem I am trying to reverse engineer. The problem is that when I run binwalk it does not identify anything. When I look at the file ...
1
vote
1answer
226 views

CSR DFU File Format

I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question ...
1
vote
2answers
150 views

Way to know if firmware is compressed

I dumped a wifi firmware of ps3 console but it seems that this firmware is compressed. Here you can have some informations : https://www.psdevwiki.com/ps3/Wifi_Firmware What can I do to decompress it ...
0
votes
0answers
52 views

ZynOS decompress tools

is there any tools for decompressing zynos firmware and compress it after edit little things in it ??? I have firmware called ras I'm trying to edit it but couldn't find any thing help it's for tp-...
0
votes
1answer
38 views

Multiple memory regions mapped to same data

I'm analyzing a Seagate HDD that provides a serial boot console that allows reading/writing bytes to memory and setting an address pointer. There's a block of memory from 0x0 to 0x20000 and then it ...
2
votes
1answer
222 views

Problem with analyzing a JFFS2 Filesystem

I extracted the content of a NAND Flash and analyzed it with binwalk. Binwalk showed me that the dump contains a big endian JFFS2 filesystem. My next step was extracting the files into a directory. To ...
0
votes
0answers
139 views

How to repack reverse-engineered router firmware?

I managed to unpack the filesystem contents of a TP-Link router .bin file using binwalk, dd and unsquashfs. The squash FS was at the end of the bin file, the part before having a relatively large lzma ...
1
vote
1answer
80 views

SD card microcontroller

I have an SD card that I want to copy the firmware / memory from, my question is what pinouts do I connect to the SPI programmer and what are the commands to copy all of the firmware /memory. Thank ...
1
vote
1answer
74 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
0
votes
1answer
107 views

Found a lot of function names in firmware dump. Is it possible to recreate original code?

I'm using IDA PRO 5.0 Free to analyze firmware from a camcorder (mn103 processor). I'm a complete newbie in reverse engineering so it's hard for me to learn how it works only using assembly code. I ...
0
votes
0answers
174 views

How do I decompile/modify a .dfu file?

I'm trying to get my old 3D printer to work with wifi again. A while ago the company was shut down and the printer relied on their website for print queues and stuff, so now the only way to use the ...
1
vote
1answer
115 views

Loading 8051 binary to IDA with ROM+External RAM configuration

I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses: In this example the ROM size is ...
0
votes
2answers
221 views

Using NAND flash dump with OOB data

I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions ...
2
votes
0answers
318 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
3
votes
0answers
175 views

Reverse Engineering Firmware Aether Cone

I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no ...

1
2 3 4 5
7