Questions tagged [firmware-analysis]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
28 views

Binwalk firmware analysis

When I run binwalk on a .rom using -Me it shows md5cheksum and a 411 signature under dec hex and description are blank why is it blank I’ve used binwalk on bios chip and got data the binary in ...
Strix Strong's user avatar
0 votes
0 answers
31 views

NxP3143 Uboot encrypted image and roots help

I have an encrypted firmware based on 2 files uImage (kernel) and rootfs (filesystem) and I have got the encryption keys from someone who cracked it. However I don’t know where to start so I can mount ...
Armandooooo's user avatar
0 votes
0 answers
29 views

Change Mac address

I have read the NAND memory MT29F2G08ABAEAWP contents via the RT809F programmer from IP Camera, when I have written the program (.bin) to the new NAND memory the Mac address and serial number of ...
Motaz's user avatar
  • 1
0 votes
0 answers
32 views

Finding JTAG/UART Connections on smart doorbell

Trying to dump firmware of this device. I can't find the UART/JTAG connections. I've searched over it for awhile now; I feel like I must just be missing something.
Eric's user avatar
  • 1
1 vote
0 answers
68 views

Is this (router) firmware file encrypted?

I am new to reverse engineering. Nice community you folks have here. I am trying to determine if this, VOX3v_CLOSED_19.2.0203.3261005.rbi (https://vfcc.publicacs.vodafone.co.uk/firmware/UK-CC/...
Mohamed Bana's user avatar
0 votes
0 answers
60 views

Help Extracting a CramFS filesystem from .img binary

I'm trying to extract a CramFS filesystem from a firmware binary for the FVS318Gv2. It downloads as a .zip file that can be decompressed to reveal a firmware .img file and a readme.htm. Running ...
cdbrunow's user avatar
1 vote
1 answer
63 views

finding unknown CRC 32 bit algorithm used in a firmware file

I want to modify a firmware image for a WiFi router. The image file consist of an UBI image, 0x04100000 bytes in size. Additonally, 20 bytes of unknown metadata have been appended to the UBI image ...
Shamblr's user avatar
  • 31
0 votes
2 answers
152 views

Firmware disassembler for c-sky processor (ck803s)

can you tell me why objdump does not correctly disassemble the firmware for the C-SKY (ck803s) processor? what is .long: between the lines, unknown instructions? or am I setting the parameters for ...
Andynvkz's user avatar
0 votes
0 answers
31 views

Modification/packaging of firmware for TV motherboards based on MSD3663

Is it possible to somehow unpack or modify the firmware for the TP.MSD3663S.PB805 TV motherboard? For example, edit configuration files, graphic images or change them. What programs should I use for ...
jkanponos's user avatar
1 vote
1 answer
81 views

What to do when the .img is corrupted?

After getting rejected from a promising interview process with Company A, the interviewer reached out to me and provided me with Reverse Engineering challenges Company A provides publicly to work on. ...
Robert Gates's user avatar
0 votes
0 answers
31 views

Error when using Operation not supported using firmadyne

I'm using firmware-analysis-toolkits, and as part of the toolkit, it uses firmadyne. When trying to emulate a TP-LINK firmware, I'm encountering this error. swRegWrite: Operation not supported ...
Shinomoto Asakura's user avatar
0 votes
0 answers
81 views

Extracting KIA care update firmware

I have a new KIA sportage NQ5 car. Now I want to enable wifi and turn on ADB so I can install custom app and use AA Wireless or Carplay wireless. Sadly, the old trick to access android setting app ...
Khánh Nguyễn Nhật's user avatar
0 votes
0 answers
460 views

Hello Watch 3+ smart watch firmware extracting

I have a firmware file of Hello Watch 3+ smart watch. I want to customize this firmware. I tried binwalk but no result. I am trying reverse engineering for the first time. Can you help me? File link: ...
Eray Eser's user avatar
1 vote
0 answers
112 views

Got access to SWD, but I need to identify the chip

I was able to connect to the chip via SWD/openocd, but I can't figure out what chip it is (says SM9PQ1 2322-52 on chip, googled but cant find anything). I'm hoping to download the firmware after I ...
Low Est's user avatar
  • 11
1 vote
2 answers
377 views

Using IDA 8.3 Freeware on a Z180 .bin file

The last time I tried my hand at disassembly it was in 1986-1988... a Z80 embedded processor PROM image file... 42K of code turned into 27000+ lines of assembler code... using a disassembly program ...
Mike's user avatar
  • 21
1 vote
1 answer
426 views

How can I tell ghidra what structure an address register points to?

I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766). In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
user103675's user avatar
0 votes
0 answers
97 views

How to load correctly a SPC56AP54 dump in Ghidra or IDA?

I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
C0DER's user avatar
  • 51
0 votes
0 answers
120 views

Tips on how to extract Apple firmware for a Broadcom Wireless chip, using binwalk or a similar tool?

TLDR: I have a dump of my wireless chip's RAM, but am having trouble separating firmware from, possibly the driver itself, from the nvram configuration portion. So, I'm trying to enhance the ...
Gregorio Litenstein's user avatar
0 votes
0 answers
73 views

embedded Linux, UART & JTAG disabled, how to access system?

So i have this device running embedded Linux, UART and JTAG interfaces are disabled by software. The device creates a WiFi hotspot and i know the password. By entering the devices IP adress i can ...
AB.M's user avatar
  • 1
1 vote
1 answer
112 views

Why I can't decompile this ARM function?

I have an ARM (thumb) function from Nokia's firmware: ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p ROM:10A5409C ROM:10A5409C var_18 = -0x18 ROM:...
raspiduino's user avatar
0 votes
0 answers
125 views

i would like to know how to reverse engineer a steam pc game thats limited to a 30min demo ill explain

I Have a steam game its a demo not very big company or anything you are limited to only 30 min of game play then at the end of the 30 min your session ends and you are brought to a screen encouraging ...
New2wheels-Pray4Me's user avatar
0 votes
0 answers
52 views

Firmware not attached to WinDBG while debugging Windows boot process

I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process. Short ...
gergeerew's user avatar
0 votes
1 answer
126 views

Bluetooth speaker firmware modification

I don't know if this is the right community to ask this to but I have this speaker and I want to change the startup, shutdown sound effect of it. It is not a chinese BT speaker but a Hama soundbarrel. ...
B3nceee's user avatar
1 vote
1 answer
553 views

Would it be possible to reverse engineer the wooting 60he keyboard to create a new pcb?

Would it be possible to build a pcb that is essentially a copy of the wooting Hall effect pcbs but with different layouts? (Ie: 65% or 75% layouts) Would it be possible to transfer the firmware from ...
Brandon's user avatar
  • 11
2 votes
0 answers
296 views

ZTE F670 V1.1.10P3T21 encrypted config.bin

I want to decrypt config.bin For this I found in cspd following code undefined4 CspDBInitPdtInterface(undefined4 *param_1) { dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml"); ...
Elec Art's user avatar
2 votes
0 answers
68 views

How can I patch out shm in Ghidra?

I've been trying to emulate a Mips binary in qemu, but I kept getting an error for shared memory allocation. I decompiled the function where it happens in Ghidra: local_18 = dm_shmInit(0); if (...
qwfpgjluy's user avatar
4 votes
0 answers
217 views

remove the computrace by flashing the bios

Is there a way to remove the computrace by flashing the bios or deleting/altering the contents of it? Someone gave me a laptop and I found out that it was not usable because it was equipped with ...
pao's user avatar
  • 81
2 votes
0 answers
595 views

How to extract the firmware from the flash chip of the router?

Hi, I've been struggling with a subject since 2 weeks. I have MSS5004W model router from RicherLink. The board is RL-S4005ef. This device has OpenWrt installed but it's not normally supported by that ...
SwordLion's user avatar
4 votes
1 answer
139 views

💻 This code does not crash on ARM (qemu). Why?

I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7. I'm able to emulate the userspace process ...
Attila Szász's user avatar
2 votes
0 answers
196 views

In IDA freeware, how to create a new database in IDC and load a file into it?

I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder. What ...
IDAIDCMalAnalysis's user avatar
3 votes
0 answers
72 views

Reverse engineering LCD memory map

I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
artsin's user avatar
  • 131
3 votes
0 answers
160 views

rooting D-link DIR-x5460 - Weird Firmware

I have a D-link DIR-X5460 and I'm trying to get a shell on it. I connected to the UART interface and tried some default passwords, but none work. I downloaded the FW from D-link's website, decrypted ...
Barakinio's user avatar
2 votes
0 answers
312 views

.bin firmware Standalone Binwalk returns garbage, Binwalk -I returns something but seems corrupted. Binwalk -X returns hundreds of raw deflate streams

As the title says I have the firmware of the WAX214 wifi access point. The firmware is actively preventing me from using the full available functionality of the device so I am trying to reverse it to ...
Arimodu's user avatar
  • 21
2 votes
0 answers
47 views

LZ4N file format - file decoding

I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format. Non of linux available lz4 tools do ...
Krystian's user avatar
2 votes
0 answers
695 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
AndreaF's user avatar
  • 121
2 votes
0 answers
317 views

How to disassemble Renesas RX210 MCU firmware?

I am a beginner in firmware reverse engineering. I have a dump file of Renesas RX210 MCU firmware but, I don't know how to disassemble it. Is any recommended software to disassemble it?
ManJaro's user avatar
  • 55
2 votes
0 answers
210 views

Fix screen resolutions to landscape in bios

I've got an x86 tablet (Dere D10). It works fine, except the screen reports portait resolutions (1200x1920, 768x1024, 600x800, etc.) which causes bootloaders (windows recovery menu, grub, ventoy, etc.)...
REmorin's user avatar
  • 21
2 votes
0 answers
86 views

LG C1 Firmware Flashing/Modifying

I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
GrandmaNeedsHelp's user avatar
4 votes
0 answers
123 views

How to analyze EFI dynamically?

I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver. I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
Raafat's user avatar
  • 163
1 vote
1 answer
938 views

ARM - Understanding a "base address" when reversing firmware

I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
BeepBeepComputer's user avatar
2 votes
0 answers
195 views

Prevention of reverse engineering of a microcontroller's firmware

What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller? Options I see so far: Flood it with epoxy with quartz or metal dust to make ...
Surprised Seagull's user avatar
3 votes
2 answers
2k views

Mitsubishi MAC-577IF2-E WIFI controller Firmware file

I recently installed Mitsubishi AC with Mitsubishi MAC-577IF2-E Wi-Fi controller, and as always nowadays these devices communicate with Cloud servers first, then with you, which practically means you ...
Hojzerice's user avatar
3 votes
2 answers
2k views

Disassembling ARM based Camera Firmware

I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file. Binwalk is unable to extract the known zip files. binwalk -e digicap.dav DECIMAL ...
ArkoD's user avatar
  • 131
1 vote
0 answers
471 views

Firmware RE (Beginner)

I'm trying to learn RE, and I thought I'd look at some firmware that interests me. I'm looking at the Roland TD-11 drum module firmware, which is available for download from the Roland website I ...
Odysseus's user avatar
1 vote
0 answers
113 views

Reverse Engineering SNES adapter

A good "Hello world" for everybody here I've bought a Mayflash PC052 adapter to convert an original SNES-mini controller (CLV-202) to a USB port on PC or PS4... The thing is, this CLV-202 ...
Thiago's user avatar
  • 11
4 votes
0 answers
869 views

How to extract sound file from a small 1MB binary

I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
Capstone's user avatar
  • 143
2 votes
2 answers
2k views

Harman Kardon firmware reverse engineering

First of all, I'm very new to reverse engineering, but I know about hex, binary, opcodes, et cetera. I'm trying to reverse engineer a Harman Kardon firmware file, because I think there are some API ...
Lars Jansen's user avatar
1 vote
0 answers
300 views

Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset

I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP. The device has a custom android repo ...
silencedogood's user avatar
0 votes
1 answer
2k views

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)? [closed]

Although I have no hope really I will leave this here in case someone has the ability and time to help. This is from a modem/router widely used in countries like Germany, Greece and others from ...
N.K.K.'s user avatar
  • 9
2 votes
0 answers
791 views

ZTE AES-256-CBC Encrypted backup config file

i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output Encrypted Data Start Position: 227 ...
MoooonX's user avatar
  • 31