Questions tagged [firmware-analysis]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
0 answers
35 views

Reverse engineering LCD memory map

I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
  • 121
0 votes
0 answers
23 views

I have just started working on firmware analysis. I do not know where to start from and what steps to follow

I am in the final semester of my college degree and I am working on firmware analysis. I have tried reversing various bin files of firmware provided by dlink. All of them seems to be encrypted and I ...
2 votes
0 answers
86 views

rooting D-link DIR-x5460 - Weird Firmware

I have a D-link DIR-X5460 and I'm trying to get a shell on it. I connected to the UART interface and tried some default passwords, but none work. I downloaded the FW from D-link's website, decrypted ...
1 vote
0 answers
85 views

.bin firmware Standalone Binwalk returns garbage, Binwalk -I returns something but seems corrupted. Binwalk -X returns hundreds of raw deflate streams

As the title says I have the firmware of the WAX214 wifi access point. The firmware is actively preventing me from using the full available functionality of the device so I am trying to reverse it to ...
  • 11
1 vote
0 answers
28 views

LZ4N file format - file decoding

I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format. Non of linux available lz4 tools do ...
1 vote
0 answers
164 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
  • 111
2 votes
0 answers
99 views

How to disassemble Renesas RX210 MCU firmware?

I am a beginner in firmware reverse engineering. I have a dump file of Renesas RX210 MCU firmware but, I don't know how to disassemble it. Is any recommended software to disassemble it?
  • 55
1 vote
0 answers
69 views

Fix screen resolutions to landscape in bios

I've got an x86 tablet (Dere D10). It works fine, except the screen reports portait resolutions (1200x1920, 768x1024, 600x800, etc.) which causes bootloaders (windows recovery menu, grub, ventoy, etc.)...
  • 11
1 vote
0 answers
41 views

LG C1 Firmware Flashing/Modifying

I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
3 votes
0 answers
75 views

How to analyze EFI dynamically?

I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver. I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
  • 83
1 vote
1 answer
344 views

ARM - Understanding a "base address" when reversing firmware

I've read that when reversing firmware from an embedded system it's important to get the right base address of the firmware to make sure cross references to things such as strings work when looking at ...
0 votes
0 answers
69 views

Trouble Mounting Extracted Image

I'm trying to inspect some firmware for interoperability purposes. I used binwalk to scan the file, and then I used dd to extract what appeared to me to be the bootable portion. Unfortunately, when I ...
0 votes
0 answers
173 views

Unpack Fortinet VM upgrade package

I am researching FortiGate. Fortinet provide ovf files of their products to deploy in VMware, they also provide upgrade package with name ending with ".out", which can be uploaded to VM ...
1 vote
0 answers
157 views

Prevention of reverse engineering of a microcontroller's firmware

What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller? Options I see so far: Flood it with epoxy with quartz or metal dust to make ...
3 votes
2 answers
981 views

Disassembling ARM based Camera Firmware

I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file. Binwalk is unable to extract the known zip files. binwalk -e digicap.dav DECIMAL ...
  • 131
1 vote
0 answers
315 views

Firmware RE (Beginner)

I'm trying to learn RE, and I thought I'd look at some firmware that interests me. I'm looking at the Roland TD-11 drum module firmware, which is available for download from the Roland website I ...
1 vote
0 answers
80 views

Reverse Engineering SNES adapter

A good "Hello world" for everybody here I've bought a Mayflash PC052 adapter to convert an original SNES-mini controller (CLV-202) to a USB port on PC or PS4... The thing is, this CLV-202 ...
  • 11
4 votes
0 answers
606 views

How to extract sound file from a small 1MB binary

I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
  • 133
2 votes
2 answers
772 views

Harman Kardon firmware reverse engineering

First of all, I'm very new to reverse engineering, but I know about hex, binary, opcodes, et cetera. I'm trying to reverse engineer a Harman Kardon firmware file, because I think there are some API ...
1 vote
0 answers
178 views

Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset

I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP. The device has a custom android repo ...
0 votes
1 answer
1k views

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)? [closed]

Although I have no hope really I will leave this here in case someone has the ability and time to help. This is from a modem/router widely used in countries like Germany, Greece and others from ...
  • 9
1 vote
0 answers
544 views

ZTE AES-256-CBC Encrypted backup config file

i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output Encrypted Data Start Position: 227 ...
  • 21
1 vote
0 answers
83 views

How does one start with reversing router config encryption?

There is not enough info on the web from what I have seen. Most write ups/guides/blog-posts are like this: They provide only the decrypt/encrypt script-tool with how to run it and nothing else They ...
  • 21
3 votes
0 answers
292 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
  • 53
1 vote
1 answer
64 views

Why do some firmware binaries have more than 1 file system structures

As I unpack and explore the packing structure of firmware, I am noticing that some firmware will have several file system structures. I can't seem to find any documentation as to why one device may ...
  • 123
0 votes
0 answers
719 views

Reverse engineering TP-Link TD-W8961N V3

I'm trying to reverse engineering the router's TP-Link TD-W8961N V3 firmware. After following the same question here i used the script zynos.py for unpacking the firmware and i got some files -rw-r--r-...
1 vote
0 answers
624 views

c-sky family based gx6605 firmware analysis to read data

from past few days i am fiddling with the firmware file of dvb s2 receiver of gx6605s processor. my preliminary purpose is to read the hidden menu password for given firmware.(password used to hide-...
1 vote
2 answers
998 views

How to determine ARM architecture from the ELF file extracted from the firmware?

I have extracted the ELF file from the flash dump of a printer, I cannot find too much information about the SoC chip on the printer. What's the best practice to determine the ARM architecture (ARMv7-...
2 votes
1 answer
334 views

How to dump firmware from ATWINC1510

I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file. I know that the IC offers an SPI interface through the pins described in the ...
  • 121
1 vote
1 answer
139 views

I need help reverse engineering my ereader (trying to get into the shell)

I'm trying to reverse engineer my E-Reader. It's a Denver EBO-620. I want to change the off screen image and add my own fonts. With help of Reddit I've managed to log the startup sequence (shown down ...
1 vote
1 answer
127 views

Interact with a network-less Chinese MP3 player running a modified version of Linux

My friend gave me this cheap little chinese MP3 player. I'm curious about exploring it learning more about the hardware, and potentially seeing if I could expand it's functionality in some way or run ...
1 vote
0 answers
148 views

ARM chip gpio/ identification from firmware code

Device: i was able to recover bricked Chinese IOT a Sous Vide cooker. Replaced damaged capacitor. it works. it has ARM soc/mcu/processor WI-FI (broadcom) LCD touch screen + 16bit STM mcu. EEPROM ...
  • 11
0 votes
0 answers
132 views

How to dump firmware from an SD card?

I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card ...
  • 1,397
0 votes
0 answers
388 views

Trying to extract an uncompressed Filesystem uImage

I'm trying to explore the firmware (Huawei LiteOS) of a Hi3518-based IP camera. From my explorations, it seems to be an uncompressed & unencrypted filesystem image but I can't seem to access the ...
  • 1
1 vote
0 answers
2k views

Windows binwalk refuses to extract files

I'm trying to reverse engineer the firmware for an AutoDrive AD-520 dashcam. The firmware is available for download here. I've installed binwalk on windows, I can get it to read the file just fine, ...
0 votes
0 answers
108 views

Approaches to detect (compressed) audio in firmware

Edit: The audio data is on a separate IC There are a few seconds of audio in a toy's 128 kB firmware - somewhere... Here is a downsampled look at the bits (white = 1): My beginner's attempts to ...
  • 111
0 votes
1 answer
1k views

Extract/Repack EEPROM Dump

I want to get more information from this dump I have: http://s000.tinyupload.com/index.php?file_id=42095249658483515063 binwalk dump.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------...
  • 51
1 vote
0 answers
889 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
  • 133
1 vote
1 answer
1k views

How to make sense of RTOS in firmware?

I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...
  • 1,738
2 votes
2 answers
312 views

BIOS first jump leads to empty memory

I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
0 votes
1 answer
141 views

Is it possible to read a device's firmware or internal programming in computer's RAM?

Let us say I want to reverse engineer a PCIe-based FPGA device. Can I read or extract the IP core or any firmware in the computer's RAM or by trying to communicate with the device in some way?
  • 101
2 votes
0 answers
2k views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
  • 1,738
2 votes
1 answer
924 views

Analysis of BusyBox Shell router U-Boot firmware

I am trying to get access to the BusyBox Shell and if possible to get a firmware dump. The "U-Boot" has limited possibilities but what is good is "sf - SPI flash sub-system". Can anyone help me get ...
2 votes
1 answer
1k views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
1 vote
0 answers
819 views

Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate

I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to ...
2 votes
0 answers
245 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
  • 21
2 votes
1 answer
1k views

Dumping a NAND Flash

I am currently trying to dump the content of a NAND Flash that is part of an embedded system. The chip is a QCA4531 and the NAND Flash is a GD5F1GQ4RCYIG. The module consists of 28 Pins, 14 per side....
  • 108
1 vote
0 answers
39 views

Firewire film scanner

There is firewire photo film scanner Konica-minolta (scanner part of the minilab) that is standard mashine vision firewire linescan camera, connected to controler that deal with motor film fee, light, ...
2 votes
3 answers
715 views

Open a NEC binary in Ghidra

I have a binary dump from a 76F0219F1 NEC processor. I tried to open it in Ghidra, but I don't see any NEC in the list of supported processors. Does Ghidra support NEC processors? Is there anything I ...
  • 51
5 votes
0 answers
110 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...