Questions tagged [firmware-analysis]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

What are the open source symbolic execution tools for Firmware?

I have tried to use angr, KLEE, S2E to symbolically analyze firmware binaries such as DIR-815(httpd ELF binary). import claripy import angr p = angr.Project('./httpd', load_options={'auto_load_libs':...
1
vote
0answers
58 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
1
vote
1answer
44 views

Why do some firmware binaries have more than 1 file system structures

As I unpack and explore the packing structure of firmware, I am noticing that some firmware will have several file system structures. I can't seem to find any documentation as to why one device may ...
0
votes
0answers
76 views

Reverse engineering TP-Link TD-W8961N V3

I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware. After following the same question here i used the script zynos.py for unpacking the firmware and i got some files -rw-r--r-...
1
vote
0answers
110 views

c-sky family based gx6605 firmware analysis to read data

from past few days i am fiddling with the firmware file of dvb s2 receiver of gx6605s processor. my preliminary purpose is to read the hidden menu password for given firmware.(password used to hide-...
1
vote
2answers
83 views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
0
votes
1answer
66 views

How to dump firmware from ATWINC1510

I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file. I know that the IC offers an SPI interface through the pins described in the ...
1
vote
1answer
68 views

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
1
vote
1answer
50 views

Interact with a network-less Chinese MP3 player running a modified version of Linux

My friend gave me this cheap little chinese MP3 player. I'm curious about exploring it learning more about the hardware, and potentially seeing if I could expand it's functionality in some way or run ...
1
vote
0answers
48 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
0
votes
0answers
19 views

Getting dumped non linux based embedded firmware

For my research work, I am needed to get bunch of embedded firmware which is micro controller based and does not depend upon an OS like Linux and thus being solely bare metal. (Yeah! if it's not, I ...
0
votes
0answers
45 views

How to dump firmware from an SD card?

I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card ...
0
votes
0answers
87 views

Trying to extract an uncompressed Filesystem uImage

I'm trying to explore the firmware (Huawei LiteOS) of a Hi3518-based IP camera. From my explorations, it seems to be an uncompressed & unencrypted filesystem image but I can't seem to access the ...
1
vote
0answers
733 views

Windows binwalk refuses to extract files

I'm trying to reverse engineer the firmware for an AutoDrive AD-520 dashcam. The firmware is available for download here. I've installed binwalk on windows, I can get it to read the file just fine, ...
0
votes
0answers
74 views

Loading garmin Foretrex 601 firmware into IDA Pro

I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin) But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch. The GCD file can be ...
0
votes
0answers
73 views

Approaches to detect (compressed) audio in firmware

Edit: The audio data is on a separate IC There are a few seconds of audio in a toy's 128 kB firmware - somewhere... Here is a downsampled look at the bits (white = 1): My beginner's attempts to ...
0
votes
1answer
263 views

Extract/Repack EEPROM Dump

I want to get more information from this dump I have: http://s000.tinyupload.com/index.php?file_id=42095249658483515063 binwalk dump.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------...
1
vote
0answers
240 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
1
vote
1answer
392 views

How to make sense of RTOS in firmware?

I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...
2
votes
2answers
142 views

BIOS first jump leads to empty memory

I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
0
votes
1answer
70 views

Is it possible to read a device's firmware or internal programming in computer's RAM?

Let us say I want to reverse engineer a PCIe-based FPGA device. Can I read or extract the IP core or any firmware in the computer's RAM or by trying to communicate with the device in some way?
2
votes
0answers
422 views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
0
votes
0answers
117 views

WPA2-PSK default password generation algorithm in router - now what?

I'm interesting in reverse-engineering default WPA2-PSK password algorithm on specifics router. I have the firmware I find from a github (pretty lucky) and identified an ELF 32-bit MSB executable, ...
2
votes
1answer
342 views

Analysis of BusyBox Shell router U-Boot firmware

I am trying to get access to the BusyBox Shell and if possible to get a firmware dump. The "U-Boot" has limited possibilities but what is good is "sf - SPI flash sub-system". Can anyone help me get ...
1
vote
1answer
311 views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
1
vote
0answers
280 views

Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate

I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to ...
2
votes
0answers
143 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
1
vote
1answer
575 views

Dumping a NAND Flash

I am currently trying to dump the content of a NAND Flash that is part of an embedded system. The chip is a QCA4531 and the NAND Flash is a GD5F1GQ4RCYIG. The module consists of 28 Pins, 14 per side....
1
vote
0answers
26 views

Firewire film scanner

There is firewire photo film scanner Konica-minolta (scanner part of the minilab) that is standard mashine vision firewire linescan camera, connected to controler that deal with motor film fee, light, ...
2
votes
3answers
408 views

Open a NEC binary in Ghidra

I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors. Does Ghidra support NEC processors? Is there anything I ...
0
votes
1answer
98 views

BOSCH EDC development

I'm trying to reverse engineer some BOSCH EDCs firmware (there are many of them on the internet, for example: Here). To understand it better, I was wondering if someone has any idea how those EDCs ...
4
votes
0answers
78 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
1
vote
2answers
739 views

ECU tune and reverse engineering

I'm new to the ECU (or chip) tune concept, and I try to understand what is going on there. I understand the concept and the goal, but I'm having difficulties to understand what is actually going on ...
1
vote
0answers
71 views

How can I emulate Huawei routers HG5xx firmware?

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
1
vote
1answer
48 views

SqashFS 3.0 file system has 40 “random” bytes of 0xFF in it

I'm looking at a firmware dump from a NAND flash chip and comparing it against another similar firmware dump I have. I am able to open one of them to see the root folder structure, however the other I ...
1
vote
0answers
125 views

Reverse Engineering Android ROMS to detect malicious code

I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm ...
0
votes
0answers
715 views

Disassembling ARM binary

I am trying to disassemble a firmware binary which I am interested in. Yet I don't have much experience in this field, which is why I would like some input from you guys. My current state is that I ...
3
votes
0answers
1k views

How to extract DVB firmware bin file?

I have a bin file of DVB(DTH) box firmware I want to change one image inside that bin file how I can do this please guide me in right direction. I tried bin walk but the file that it extracted ...
4
votes
1answer
227 views

Tektronix firmware XOR puzzle

As a means of learning about packing firmware and for fun I am trying to unpack the latest firmware for an entry level Tektronix Function generator firmware attached I have read the forum and ...
2
votes
1answer
2k views

GDB: Could not load shared library symbols

I'm currently having a look at the Damn Vulnerable Router Firmware, and I'm roughly following the description that is given here: https://p16.praetorian.com/blog/getting-started-with-damn-vulnerable-...
1
vote
0answers
106 views

Which architecture is this firmware?

I am currently investigating GSL touch-screen controllers firmwares. A firmware example can be found here : https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw In ...
1
vote
1answer
333 views

.fpk firmware unpacking

I am working on firmware update file prod-build-Isat2-V02.00.03-DFU.fp2. I extracted it and I've got some bin files. I analyzed these binary files with binwalk: binwalk -E RDA-533.bin The entropy of ...
2
votes
1answer
310 views

Can't decompress firmware

I'm trying to reverse engineer a firmware for a vape mod. I've downloaded it from their official website. First I tried dissassemble it in IDA but it couldn't identify any architecture in it. Then I ...
4
votes
1answer
485 views

Problems with extracting firmware

I am currently trying to reverse-engineer the firmware of an E-Cigarette but I cannot find any clues with the common tools. Heres everything I found so far. Binwalk doesnt recognize anything even ...