Questions tagged [firmware-analysis]
The firmware-analysis tag has no usage guidance.
76
questions
0
votes
1
answer
100
views
How can I tell ghidra what structure an address register points to?
I am reversing a raw bare-metal binary firmware for a tricore processor (TC1762/TC1766).
In many functions i'm currently reversing there is access to offsets of the address stored in the a0 register. ...
0
votes
0
answers
28
views
How to load correctly a SPC56AP54 dump in Ghidra or IDA?
I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
- 51
0
votes
0
answers
51
views
Tips on how to extract Apple firmware for a Broadcom Wireless chip, using binwalk or a similar tool?
TLDR: I have a dump of my wireless chip's RAM, but am having trouble separating firmware from, possibly the driver itself, from the nvram configuration portion.
So, I'm trying to enhance the ...
0
votes
0
answers
50
views
embedded Linux, UART & JTAG disabled, how to access system?
So i have this device running embedded Linux, UART and JTAG interfaces are disabled by software. The device creates a WiFi hotspot and i know the password. By entering the devices IP adress i can ...
- 1
1
vote
1
answer
90
views
Why I can't decompile this ARM function?
I have an ARM (thumb) function from Nokia's firmware:
ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p
ROM:10A5409C
ROM:10A5409C var_18 = -0x18
ROM:...
- 249
0
votes
0
answers
78
views
i would like to know how to reverse engineer a steam pc game thats limited to a 30min demo ill explain
I Have a steam game its a demo not very big company or anything you are limited to only 30 min of game play then at the end of the 30 min your session ends and you are brought to a screen encouraging ...
0
votes
0
answers
37
views
Firmware not attached to WinDBG while debugging Windows boot process
I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process.
Short ...
- 11
0
votes
1
answer
83
views
Bluetooth speaker firmware modification
I don't know if this is the right community to ask this to but I have this speaker and I want to change the startup, shutdown sound effect of it. It is not a chinese BT speaker but a Hama soundbarrel. ...
- 1
1
vote
0
answers
235
views
Would it be possible to reverse engineer the wooting 60he keyboard to create a new pcb?
Would it be possible to build a pcb that is essentially a copy of the wooting Hall effect pcbs but with different layouts? (Ie: 65% or 75% layouts)
Would it be possible to transfer the firmware from ...
- 11
2
votes
0
answers
125
views
ZTE F670 V1.1.10P3T21 encrypted config.bin
I want to decrypt config.bin
For this I found in cspd
following code
undefined4 CspDBInitPdtInterface(undefined4 *param_1)
{
dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml");
...
- 21
2
votes
0
answers
58
views
How can I patch out shm in Ghidra?
I've been trying to emulate a Mips binary in qemu, but I kept getting an error for shared memory allocation. I decompiled the function where it happens in Ghidra:
local_18 = dm_shmInit(0);
if (...
- 21
4
votes
0
answers
129
views
remove the computrace by flashing the bios
Is there a way to remove the computrace by flashing the bios or deleting/altering the contents of it? Someone gave me a laptop and I found out that it was not usable because it was equipped with ...
- 81
2
votes
0
answers
430
views
How to extract the firmware from the flash chip of the router?
Hi, I've been struggling with a subject since 2 weeks.
I have MSS5004W model router from RicherLink. The board is RL-S4005ef. This device has OpenWrt installed but it's not normally supported by that ...
- 21
4
votes
1
answer
125
views
💻 This code does not crash on ARM (qemu). Why?
I found a couple of interesting integer underflows leading to memcpy() wild copies in a TLV parser process of some random IoT firmware. It is 32-bit ARMv7.
I'm able to emulate the userspace process ...
- 61
2
votes
0
answers
98
views
In IDA freeware, how to create a new database in IDC and load a file into it?
I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder.
What ...
3
votes
0
answers
59
views
Reverse engineering LCD memory map
I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
- 131
0
votes
0
answers
41
views
I have just started working on firmware analysis. I do not know where to start from and what steps to follow
I am in the final semester of my college degree and I am working on firmware analysis. I have tried reversing various bin files of firmware provided by dlink. All of them seems to be encrypted and I ...
3
votes
0
answers
134
views
rooting D-link DIR-x5460 - Weird Firmware
I have a D-link DIR-X5460 and I'm trying to get a shell on it.
I connected to the UART interface and tried some default passwords, but none work.
I downloaded the FW from D-link's website, decrypted ...
- 31
2
votes
0
answers
223
views
.bin firmware Standalone Binwalk returns garbage, Binwalk -I returns something but seems corrupted. Binwalk -X returns hundreds of raw deflate streams
As the title says I have the firmware of the WAX214 wifi access point. The firmware is actively preventing me from using the full available functionality of the device so I am trying to reverse it to ...
- 21
2
votes
0
answers
41
views
LZ4N file format - file decoding
I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format.
Non of linux available lz4 tools do ...
- 21
2
votes
0
answers
474
views
Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code
I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this).
After the analysis I get only few codelines with a lot of similar messages:
...
- 121
2
votes
0
answers
209
views
How to disassemble Renesas RX210 MCU firmware?
I am a beginner in firmware reverse engineering. I have a dump file of Renesas RX210 MCU firmware but, I don't know how to disassemble it. Is any recommended software to disassemble it?
- 55
2
votes
0
answers
120
views
Fix screen resolutions to landscape in bios
I've got an x86 tablet (Dere D10). It works fine, except the screen reports portait resolutions (1200x1920, 768x1024, 600x800, etc.) which causes bootloaders (windows recovery menu, grub, ventoy, etc.)...
- 21
2
votes
0
answers
65
views
LG C1 Firmware Flashing/Modifying
I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
4
votes
0
answers
101
views
How to analyze EFI dynamically?
I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver.
I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
- 163
1
vote
1
answer
643
views
ARM - Understanding a "base address" when reversing firmware
I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
2
votes
0
answers
186
views
Prevention of reverse engineering of a microcontroller's firmware
What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller?
Options I see so far:
Flood it with epoxy with quartz or metal dust to make ...
3
votes
2
answers
2k
views
Mitsubishi MAC-577IF2-E WIFI controller Firmware file
I recently installed Mitsubishi AC with Mitsubishi MAC-577IF2-E
Wi-Fi controller, and as always nowadays these devices communicate with Cloud servers first, then with you, which practically means you ...
- 31
3
votes
2
answers
2k
views
Disassembling ARM based Camera Firmware
I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file.
Binwalk is unable to extract the known zip files.
binwalk -e digicap.dav
DECIMAL ...
- 131
1
vote
0
answers
389
views
Firmware RE (Beginner)
I'm trying to learn RE, and I thought I'd look at some firmware that interests me. I'm looking at the Roland TD-11 drum module firmware, which is available for download from the Roland website
I ...
- 11
1
vote
0
answers
100
views
Reverse Engineering SNES adapter
A good "Hello world" for everybody here
I've bought a Mayflash PC052 adapter to convert an original SNES-mini controller (CLV-202) to a USB port on PC or PS4...
The thing is, this CLV-202 ...
- 11
4
votes
0
answers
758
views
How to extract sound file from a small 1MB binary
I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
- 143
2
votes
2
answers
1k
views
Harman Kardon firmware reverse engineering
First of all, I'm very new to reverse engineering, but I know about hex, binary, opcodes, et cetera.
I'm trying to reverse engineer a Harman Kardon firmware file, because I think there are some API ...
- 23
1
vote
0
answers
224
views
Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset
I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP.
The device has a custom android repo ...
0
votes
1
answer
1k
views
decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)? [closed]
Although I have no hope really I will leave this here in case someone has the ability and time to help.
This is from a modem/router widely used in countries like Germany, Greece and others from ...
- 9
2
votes
0
answers
697
views
ZTE AES-256-CBC Encrypted backup config file
i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output
Encrypted Data Start Position: 227
...
- 31
1
vote
0
answers
100
views
How does one start with reversing router config encryption?
There is not enough info on the web from what I have seen.
Most write ups/guides/blog-posts are like this:
They provide only the decrypt/encrypt script-tool with how to run it and nothing else
They ...
- 31
3
votes
0
answers
434
views
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.
So i start searching for the way to do that...
I used HxH ...
- 53
1
vote
1
answer
85
views
Why do some firmware binaries have more than 1 file system structures
As I unpack and explore the packing structure of firmware, I am noticing that some firmware will have several file system structures. I can't seem to find any documentation as to why one device may ...
- 123
1
vote
2
answers
1k
views
Reverse engineering TP-Link TD-W8961N V3
I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware.
After following the same question here
i used the script zynos.py for unpacking the firmware and i got some files
-rw-r--r-...
1
vote
0
answers
734
views
c-sky family based gx6605 firmware analysis to read data
from past few days i am fiddling with the firmware file of dvb s2 receiver of gx6605s processor.
my preliminary purpose is to read the hidden menu password for given firmware.(password used to hide-...
1
vote
2
answers
2k
views
How to determine ARM architecture from the ELF file extracted from the firmware?
I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
- 11
2
votes
1
answer
363
views
How to dump firmware from ATWINC1510
I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file.
I know that the IC offers an SPI interface through the pins described in the ...
- 121
1
vote
1
answer
168
views
I need help reverse engineering my ereader (trying to get into the shell)
I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
- 11
1
vote
1
answer
166
views
Interact with a network-less Chinese MP3 player running a modified version of Linux
My friend gave me this cheap little chinese MP3 player. I'm curious about exploring it learning more about the hardware, and potentially seeing if I could expand it's functionality in some way or run ...
- 111
1
vote
0
answers
163
views
ARM chip gpio/ identification from firmware code
Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works.
it has
ARM soc/mcu/processor
WI-FI (broadcom)
LCD touch screen + 16bit STM mcu.
EEPROM ...
- 11
0
votes
0
answers
157
views
How to dump firmware from an SD card?
I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card ...
- 1,517
0
votes
0
answers
449
views
Trying to extract an uncompressed Filesystem uImage
I'm trying to explore the firmware (Huawei LiteOS) of a Hi3518-based IP camera. From my explorations, it seems to be an uncompressed & unencrypted filesystem image but I can't seem to access the ...
- 1
1
vote
0
answers
2k
views
Windows binwalk refuses to extract files
I'm trying to reverse engineer the firmware for an AutoDrive AD-520 dashcam. The firmware is available for download here. I've installed binwalk on windows, I can get it to read the file just fine, ...
- 111
0
votes
0
answers
118
views
Approaches to detect (compressed) audio in firmware
Edit: The audio data is on a separate IC
There are a few seconds of audio in a toy's 128 kB firmware - somewhere...
Here is a downsampled look at the bits (white = 1):
My beginner's attempts to ...
- 111