Questions tagged [firmware-analysis]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
0 answers
57 views

rooting D-link DIR-x5460 - Weird Firmware

I have a D-link DIR-X5460 and I'm trying to get a shell on it. I connected to the UART interface and tried some default passwords, but none work. I downloaded the FW from D-link's website, decrypted ...
1 vote
0 answers
38 views

.bin firmware Standalone Binwalk returns garbage, Binwalk -I returns something but seems corrupted. Binwalk -X returns hundreds of raw deflate streams

As the title says I have the firmware of the WAX214 wifi access point. The firmware is actively preventing me from using the full available functionality of the device so I am trying to reverse it to ...
  • 11
1 vote
0 answers
27 views

LZ4N file format - file decoding

I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format. Non of linux available lz4 tools do ...
1 vote
0 answers
104 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
  • 111
2 votes
0 answers
77 views

How to disassemble Renesas RX210 MCU firmware?

I am a beginner in firmware reverse engineering. I have a dump file of Renesas RX210 MCU firmware but, I don't know how to disassemble it. Is any recommended software to disassemble it?
  • 55
1 vote
0 answers
64 views

Fix screen resolutions to landscape in bios

I've got an x86 tablet (Dere D10). It works fine, except the screen reports portait resolutions (1200x1920, 768x1024, 600x800, etc.) which causes bootloaders (windows recovery menu, grub, ventoy, etc.)...
  • 11
1 vote
0 answers
33 views

LG C1 Firmware Flashing/Modifying

I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
3 votes
0 answers
67 views

How to analyze EFI dynamically?

I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver. I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
  • 83
1 vote
1 answer
276 views

ARM - Understanding a "base address" when reversing firmware

I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
0 votes
0 answers
58 views

Trouble Mounting Extracted Image

I'm trying to inspect some firmware for interoperability purposes. I used binwalk to scan the file, and then I used dd to extract what appeared to me to be the bootable portion. Unfortunately, when I ...
0 votes
0 answers
141 views

Unpack Fortinet VM upgrade package

I am researching FortiGate. Fortinet provide ovf files of their products to deploy in VMware, they also provide upgrade package with name ending with ".out", which can be uploaded to VM ...
1 vote
0 answers
149 views

Prevention of reverse engineering of a microcontroller's firmware

What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller? Options I see so far: Flood it with epoxy with quartz or metal dust to make ...
3 votes
2 answers
889 views

Disassembling ARM based Camera Firmware

I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file. Binwalk is unable to extract the known zip files. binwalk -e digicap.dav DECIMAL ...
  • 131
1 vote
0 answers
296 views

Firmware RE (Beginner)

I'm trying to learn RE, and I thought I'd look at some firmware that interests me. I'm looking at the Roland TD-11 drum module firmware, which is available for download from the Roland website I ...
1 vote
0 answers
72 views

Reverse Engineering SNES adapter

A good "Hello world" for everybody here I've bought a Mayflash PC052 adapter to convert an original SNES-mini controller (CLV-202) to a USB port on PC or PS4... The thing is, this CLV-202 ...
  • 11
4 votes
0 answers
565 views

How to extract sound file from a small 1MB binary

I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
  • 133
2 votes
2 answers
648 views

Harman Kardon firmware reverse engineering

First of all, I'm very new to reverse engineering, but I know about hex, binary, opcodes, et cetera. I'm trying to reverse engineer a Harman Kardon firmware file, because I think there are some API ...
1 vote
0 answers
166 views

Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset

I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP. The device has a custom android repo ...
0 votes
1 answer
1k views

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)? [closed]

Although I have no hope really I will leave this here in case someone has the ability and time to help. This is from a modem/router widely used in countries like Germany, Greece and others from ...
  • 9
1 vote
0 answers
500 views

ZTE AES-256-CBC Encrypted backup config file

i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output Encrypted Data Start Position: 227 ...
  • 21
1 vote
0 answers
75 views

How does one start with reversing router config encryption?

There is not enough info on the web from what I have seen. Most write ups/guides/blog-posts are like this: They provide only the decrypt/encrypt script-tool with how to run it and nothing else They ...
  • 21
3 votes
0 answers
249 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
  • 53
1 vote
1 answer
62 views

Why do some firmware binaries have more than 1 file system structures

As I unpack and explore the packing structure of firmware, I am noticing that some firmware will have several file system structures. I can't seem to find any documentation as to why one device may ...
  • 123
0 votes
0 answers
640 views

Reverse engineering TP-Link TD-W8961N V3

I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware. After following the same question here i used the script zynos.py for unpacking the firmware and i got some files -rw-r--r-...
1 vote
0 answers
590 views

c-sky family based gx6605 firmware analysis to read data

from past few days i am fiddling with the firmware file of dvb s2 receiver of gx6605s processor. my preliminary purpose is to read the hidden menu password for given firmware.(password used to hide-...
1 vote
2 answers
854 views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
2 votes
1 answer
320 views

How to dump firmware from ATWINC1510

I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file. I know that the IC offers an SPI interface through the pins described in the ...
  • 121
1 vote
1 answer
137 views

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
1 vote
1 answer
115 views

Interact with a network-less Chinese MP3 player running a modified version of Linux

My friend gave me this cheap little chinese MP3 player. I'm curious about exploring it learning more about the hardware, and potentially seeing if I could expand it's functionality in some way or run ...
1 vote
0 answers
143 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
  • 11
0 votes
0 answers
128 views

How to dump firmware from an SD card?

I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card ...
  • 1,357
0 votes
0 answers
367 views

Trying to extract an uncompressed Filesystem uImage

I'm trying to explore the firmware (Huawei LiteOS) of a Hi3518-based IP camera. From my explorations, it seems to be an uncompressed & unencrypted filesystem image but I can't seem to access the ...
  • 1
1 vote
0 answers
2k views

Windows binwalk refuses to extract files

I'm trying to reverse engineer the firmware for an AutoDrive AD-520 dashcam. The firmware is available for download here. I've installed binwalk on windows, I can get it to read the file just fine, ...
0 votes
0 answers
106 views

Approaches to detect (compressed) audio in firmware

Edit: The audio data is on a separate IC There are a few seconds of audio in a toy's 128 kB firmware - somewhere... Here is a downsampled look at the bits (white = 1): My beginner's attempts to ...
  • 111
0 votes
1 answer
1k views

Extract/Repack EEPROM Dump

I want to get more information from this dump I have: http://s000.tinyupload.com/index.php?file_id=42095249658483515063 binwalk dump.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------...
  • 51
1 vote
0 answers
835 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
  • 133
1 vote
1 answer
1k views

How to make sense of RTOS in firmware?

I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...
  • 1,708
2 votes
2 answers
299 views

BIOS first jump leads to empty memory

I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
0 votes
1 answer
138 views

Is it possible to read a device's firmware or internal programming in computer's RAM?

Let us say I want to reverse engineer a PCIe-based FPGA device. Can I read or extract the IP core or any firmware in the computer's RAM or by trying to communicate with the device in some way?
  • 101
2 votes
0 answers
2k views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
  • 1,708
2 votes
1 answer
883 views

Analysis of BusyBox Shell router U-Boot firmware

I am trying to get access to the BusyBox Shell and if possible to get a firmware dump. The "U-Boot" has limited possibilities but what is good is "sf - SPI flash sub-system". Can anyone help me get ...
2 votes
1 answer
1k views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
1 vote
0 answers
762 views

Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate

I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to ...
2 votes
0 answers
238 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
  • 21
2 votes
1 answer
1k views

Dumping a NAND Flash

I am currently trying to dump the content of a NAND Flash that is part of an embedded system. The chip is a QCA4531 and the NAND Flash is a GD5F1GQ4RCYIG. The module consists of 28 Pins, 14 per side....
  • 108
1 vote
0 answers
39 views

Firewire film scanner

There is firewire photo film scanner Konica-minolta (scanner part of the minilab) that is standard mashine vision firewire linescan camera, connected to controler that deal with motor film fee, light, ...
2 votes
3 answers
693 views

Open a NEC binary in Ghidra

I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors. Does Ghidra support NEC processors? Is there anything I ...
  • 51
5 votes
0 answers
107 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
1 vote
2 answers
2k views

ECU tune and reverse engineering

I'm new to the ECU (or chip) tune concept, and I try to understand what is going on there. I understand the concept and the goal, but I'm having difficulties to understand what is actually going on ...
1 vote
0 answers
148 views

How can I emulate Huawei routers HG5xx firmware?

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .