Questions tagged [firmware-analysis]
The firmware-analysis tag has no usage guidance.
487
questions
0
votes
1
answer
102
views
How can I tell ghidra what structure an address register points to?
I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766).
In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
CommunityBot
- 1
3
votes
1
answer
392
views
Reversing Novation's Circuit Tracks firmware
Motivation:
The Circuit Tracks is a great little groovebox made by Novation, but it feels like they intentionally limited it's capabilities. They also sell the Circuit Rhythm, which has some of the ...
0
votes
0
answers
29
views
How to load correctly a SPC56AP54 dump in Ghidra or IDA?
I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
- 51
0
votes
0
answers
52
views
Tips on how to extract Apple firmware for a Broadcom Wireless chip, using binwalk or a similar tool?
TLDR: I have a dump of my wireless chip's RAM, but am having trouble separating firmware from, possibly the driver itself, from the nvram configuration portion.
So, I'm trying to enhance the ...
1
vote
3
answers
2k
views
CSR DFU File Format
I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question ...
- 1
1
vote
1
answer
92
views
Why I can't decompile this ARM function?
I have an ARM (thumb) function from Nokia's firmware:
ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p
ROM:10A5409C
ROM:10A5409C var_18 = -0x18
ROM:...
- 171
0
votes
0
answers
50
views
embedded Linux, UART & JTAG disabled, how to access system?
So i have this device running embedded Linux, UART and JTAG interfaces are disabled by software. The device creates a WiFi hotspot and i know the password. By entering the devices IP adress i can ...
- 1
0
votes
0
answers
37
views
Firmware not attached to WinDBG while debugging Windows boot process
I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process.
Short ...
- 326
3
votes
2
answers
2k
views
Mitsubishi MAC-577IF2-E WIFI controller Firmware file
I recently installed Mitsubishi AC with Mitsubishi MAC-577IF2-E
Wi-Fi controller, and as always nowadays these devices communicate with Cloud servers first, then with you, which practically means you ...
- 255
0
votes
0
answers
81
views
i would like to know how to reverse engineer a steam pc game thats limited to a 30min demo ill explain
I Have a steam game its a demo not very big company or anything you are limited to only 30 min of game play then at the end of the 30 min your session ends and you are brought to a screen encouraging ...
6
votes
1
answer
2k
views
Huawei HG8245H, can't read some system files
I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly:
SU_WAP>shell
...
CommunityBot
- 1
4
votes
1
answer
6k
views
Firmware extraction problems - binwalk is blank
I'm trying to extract the firmware from my set-top box (STB) because I realized its port 22 is open and running dropbear, and I'd like to login to it. Well, because it's there. I've tried binwalk, but ...
- 103
1
vote
2
answers
1k
views
Reverse engineering TP-Link TD-W8961N V3
I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware.
After following the same question here
i used the script zynos.py for unpacking the firmware and i got some files
-rw-r--r-...
- 11
5
votes
1
answer
260
views
Would hiring a RE service be worth it?
Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
0
votes
1
answer
83
views
Bluetooth speaker firmware modification
I don't know if this is the right community to ask this to but I have this speaker and I want to change the startup, shutdown sound effect of it. It is not a chinese BT speaker but a Hama soundbarrel. ...
1
vote
0
answers
245
views
Would it be possible to reverse engineer the wooting 60he keyboard to create a new pcb?
Would it be possible to build a pcb that is essentially a copy of the wooting Hall effect pcbs but with different layouts? (Ie: 65% or 75% layouts)
Would it be possible to transfer the firmware from ...
- 11
1
vote
0
answers
271
views
Reverse Engineering Android ROMS to detect malicious code
I'm working on reverse Engineering Android ROMS (Firmware you can flash onto your phone) so that I can scan them for malicious behavior. I've been looking all over the internet but unfortunately I'm ...
2
votes
0
answers
128
views
ZTE F670 V1.1.10P3T21 encrypted config.bin
I want to decrypt config.bin
For this I found in cspd
following code
undefined4 CspDBInitPdtInterface(undefined4 *param_1)
{
dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml");
...
- 21
5
votes
2
answers
709
views
Unable to unsquash from a FW dump
After trying to unsquash a firmware dump from a router without success, I am asking for help.
I have a router with a BCM68380 CPU. After desoldering the TOSHIBA NAND chip I dumped the firmware (link ...
- 255
5
votes
2
answers
416
views
BIOS first jump leads to empty memory
I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
- 1
2
votes
0
answers
59
views
How can I patch out shm in Ghidra?
I've been trying to emulate a Mips binary in qemu, but I kept getting an error for shared memory allocation. I decompiled the function where it happens in Ghidra:
local_18 = dm_shmInit(0);
if (...
- 21
2
votes
0
answers
100
views
In IDA freeware, how to create a new database in IDC and load a file into it?
I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder.
What ...
- 255
4
votes
0
answers
131
views
remove the computrace by flashing the bios
Is there a way to remove the computrace by flashing the bios or deleting/altering the contents of it? Someone gave me a laptop and I found out that it was not usable because it was equipped with ...
- 81
2
votes
0
answers
438
views
How to extract the firmware from the flash chip of the router?
Hi, I've been struggling with a subject since 2 weeks.
I have MSS5004W model router from RicherLink. The board is RL-S4005ef. This device has OpenWrt installed but it's not normally supported by that ...
- 21
3
votes
0
answers
266
views
Delphi MT05.3 ecu
Hi I have a Honda IGX800 V twin engine with a Delphi MT05.3 ecu The engine has an idle of 1400 rpm
I would like to be able to gain access to the ecu and reduce the idle rpm to around 950 /1000 rpm
...
- 1
5
votes
2
answers
3k
views
How do I extract the firmware from this bluetooth speaker board?
I have a bluetooth speaker. Infinity Fuze 100.
It's a good speaker.
But it has annoying messages on startup and shutdown. And for other interface events. I'd like to either get rid of them entirely, ...
4
votes
1
answer
100
views
I am having problems while modifying router firmware and uploading it
So, I have an Edimax BR-6208ac V2 router and I would like to modify the firmware to enable telnet on it. However, when I repack the firmware and upload it I get an error of it being the wrong file ...
CommunityBot
- 1
2
votes
1
answer
226
views
Odd jsr destination in SuperH disassembly w/ Ghidra
I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
CommunityBot
- 1
4
votes
1
answer
126
views
💻 This code does not crash on ARM (qemu). Why?
I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7.
I'm able to emulate the userspace process ...
- 61
1
vote
1
answer
890
views
how do I calculate crc32 of a u-boot header in a modified firmware image?
I'm trying to modify an openWRT frimware in order to be able to flash it in a router, these are the steps:
download the latest nbg-419n2-initramfs-kernel.bin use hexedit and
change first 4 bytes to “...
- 1
3
votes
0
answers
212
views
Reverse engineering firmware to CD/DVD drive to enable scrambled mode support
I am a volunteer of the redump.org project, the goal of our website is to archive game CDs in the best possible quality. Unfortunately, this site requires only DiscImageCreator to be used for CD and ...
- 10.9k
3
votes
1
answer
288
views
Reverse-engineering a 90s CNC machine (FORTH like) firmware
Here's an undertaking I'm currently in, and would absolutely love someone to assist more directly. I'll list the subjects that I would greatly appreciate more knowledge within. Know anything about one ...
3
votes
0
answers
59
views
Reverse engineering LCD memory map
I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
- 131
0
votes
0
answers
43
views
I have just started working on firmware analysis. I do not know where to start from and what steps to follow
I am in the final semester of my college degree and I am working on firmware analysis. I have tried reversing various bin files of firmware provided by dlink. All of them seems to be encrypted and I ...
2
votes
0
answers
227
views
.bin firmware Standalone Binwalk returns garbage, Binwalk -I returns something but seems corrupted. Binwalk -X returns hundreds of raw deflate streams
As the title says I have the firmware of the WAX214 wifi access point. The firmware is actively preventing me from using the full available functionality of the device so I am trying to reverse it to ...
2
votes
1
answer
140
views
Help in reverse engineering a boarding gate scanner's firmware
I'm working on a custom Access Control system for my local airport that will validate passengers' boarding passes and I've been given two DESKO GRSK 502 scanners.
Unfortunately, there's absolutely no ...
- 255
2
votes
0
answers
153
views
How to Decompile HP LaserJet Pro M12w firmware in Ghidra
I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra,
after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
- 10.9k
2
votes
0
answers
29
views
Is there a way to run arbitrary code on a vtech Nitro Vision?
Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
- 21
4
votes
1
answer
2k
views
How to extract DVB firmware bin file?
I have a bin file of DVB (DTH) box firmware. I want to change one image inside that bin file, how I can do this? Please guide me in right direction.
I tried bin walk, but the file that it extracted ...
- 10.9k
3
votes
0
answers
92
views
debug stripped file
I've system embedded mips big endian with gdb-server and I want debug stripped file of the target, I can run in target gdb server with stripped file (--attach PID), but when I try to connect with gdb-...
- 31
3
votes
2
answers
2k
views
Disassembling ARM based Camera Firmware
I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file.
Binwalk is unable to extract the known zip files.
binwalk -e digicap.dav
DECIMAL ...
- 21
2
votes
2
answers
791
views
ARM (STM32) memory mapping on Ghidra: offset only part of the firmware file
I have a binary firmware that I'm trying to reverse engineer. I loaded it up on Ghidra, setting the file as raw binary, ARM Cortex, little endian. I used an address offset of zero for the file. And I ...
- 193
2
votes
0
answers
52
views
Access to CPU registers in GMM space
AMD's BIOS and Kernel Developer’s Guide (BKDG) documents GMM registers and access to them:
GMMxXXXXX: GPU memory mapped registers; XXXXX specifies the hexadecimal byte address offset (this may be 2 ...
- 121
3
votes
0
answers
135
views
rooting D-link DIR-x5460 - Weird Firmware
I have a D-link DIR-X5460 and I'm trying to get a shell on it.
I connected to the UART interface and tried some default passwords, but none work.
I downloaded the FW from D-link's website, decrypted ...
- 10.9k
1
vote
1
answer
2k
views
how to decrypt zte zxhn h108n V2.5.5_VDFT13 config.bin?
I need the root password from my router. I need to change my snr because my provider had lock it at a high value. I try to decrypt my config.bin file but no result. I try first with zte-config-utility
...
