Questions tagged [firmware-analysis]
The firmware-analysis tag has no usage guidance.
155
questions with no upvoted or accepted answers
13
votes
0
answers
554
views
Problems calculating checksum for AirConditioner
I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes.
I discovered that the upper and lower nibbles need to be ...
- 131
10
votes
0
answers
3k
views
RE Tplink TD-W8960N V7
I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
- 265
9
votes
0
answers
1k
views
Firmware analysis, can't find file system
I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
- 91
8
votes
0
answers
670
views
How do I reverse this firmware? 8-bit handheld console
I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
- 81
6
votes
1
answer
2k
views
Huawei HG8245H, can't read some system files
I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly:
SU_WAP>shell
...
- 101
5
votes
0
answers
129
views
JTAG Dumped Flash is scrambled
I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander.
Here is an example of a line of HTML stored on memory.
<!DOC^...
- 51
5
votes
0
answers
5k
views
Extracting ARM Boot zImage
I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
- 380
5
votes
2
answers
728
views
Getting empty files using firmware modification kit
im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far.
I got the admin ...
- 51
4
votes
0
answers
156
views
remove the computrace by flashing the bios
Is there a way to remove the computrace by flashing the bios or deleting/altering the contents of it? Someone gave me a laptop and I found out that it was not usable because it was equipped with ...
- 81
4
votes
0
answers
110
views
How to analyze EFI dynamically?
I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver.
I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
- 163
4
votes
0
answers
797
views
How to extract sound file from a small 1MB binary
I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
- 143
4
votes
0
answers
4k
views
What is a TROC Filesystem, and how do I mount it?
I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem:
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------...
- 149
4
votes
0
answers
333
views
How to perform manual flashing of a bricked device?
I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
- 51
3
votes
0
answers
66
views
Reverse engineering LCD memory map
I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
- 131
3
votes
0
answers
304
views
Delphi MT05.3 ecu
Hi I have a Honda IGX800 V twin engine with a Delphi MT05.3 ecu The engine has an idle of 1400 rpm
I would like to be able to gain access to the ecu and reduce the idle rpm to around 950 /1000 rpm
...
- 31
3
votes
0
answers
103
views
debug stripped file
I've system embedded mips big endian with gdb-server and I want debug stripped file of the target, I can run in target gdb server with stripped file (--attach PID), but when I try to connect with gdb-...
- 31
3
votes
0
answers
144
views
rooting D-link DIR-x5460 - Weird Firmware
I have a D-link DIR-X5460 and I'm trying to get a shell on it.
I connected to the UART interface and tried some default passwords, but none work.
I downloaded the FW from D-link's website, decrypted ...
- 31
3
votes
0
answers
237
views
Reverse engineering firmware to CD/DVD drive to enable scrambled mode support
I am a volunteer of the redump.org project, the goal of our website is to archive game CDs in the best possible quality. Unfortunately, this site requires only DiscImageCreator to be used for CD and ...
- 31
3
votes
0
answers
330
views
Is it possible to dump firmware of a device via USB port?
I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port.
lsusb command says that this device has following ...
3
votes
0
answers
469
views
Modify bin firmware file of an old phone
I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y.
So i start searching for the way to do that...
I used HxH ...
- 53
3
votes
0
answers
296
views
Uniden FW Hacking
I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly.
FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
- 31
3
votes
0
answers
213
views
Handling firmware with many copies of the same code/data in different address spaces
When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region.
I normal load the code/data into the destination location and leave the ...
- 932
3
votes
0
answers
1k
views
When to use qemu user mode versus system mode?
This seems to be a pretty basic question but I can't seem to find a good answer.
I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
- 101
3
votes
0
answers
631
views
Reverse Engineering SCE .pkg Files
To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years ...
- 31
3
votes
0
answers
2k
views
Decrypting Firmware File
I am by no means a hardware or software expert. But I've got a bit of a dilemma. I have on my hands an "encrypted" firmware image. I say that with air quotes because I'm not sure if it's encrypted, ...
- 141
3
votes
0
answers
371
views
Running vmlinux ELF under QEMU
I have a vmlinux ELF file to run under QEMU.
My arguments to qemu-system-arm.exe are:
The correct -cpu argument.
The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
- 403
3
votes
0
answers
2k
views
Analysing eCos image
I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step.
This is the current uncompressed image:
https://www.dropbox.com/s/...
- 31
3
votes
0
answers
441
views
How is the tp-link switch firmware obfuscated?
I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one.
...
- 131
3
votes
1
answer
843
views
Reversal of unknown obfuscation or encryption with known plaintext
Introduction
For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
- 39
2
votes
0
answers
176
views
ZTE F670 V1.1.10P3T21 encrypted config.bin
I want to decrypt config.bin
For this I found in cspd
following code
undefined4 CspDBInitPdtInterface(undefined4 *param_1)
{
dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml");
...
- 21
2
votes
0
answers
66
views
How can I patch out shm in Ghidra?
I've been trying to emulate a Mips binary in qemu, but I kept getting an error for shared memory allocation. I decompiled the function where it happens in Ghidra:
local_18 = dm_shmInit(0);
if (...
- 21
2
votes
0
answers
504
views
How to extract the firmware from the flash chip of the router?
Hi, I've been struggling with a subject since 2 weeks.
I have MSS5004W model router from RicherLink. The board is RL-S4005ef. This device has OpenWrt installed but it's not normally supported by that ...
- 21
2
votes
0
answers
131
views
In IDA freeware, how to create a new database in IDC and load a file into it?
I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder.
What ...
2
votes
0
answers
165
views
How to Decompile HP LaserJet Pro M12w firmware in Ghidra
I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra,
after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
- 21
2
votes
0
answers
32
views
Is there a way to run arbitrary code on a vtech Nitro Vision?
Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
- 21
2
votes
0
answers
52
views
Access to CPU registers in GMM space
AMD's BIOS and Kernel Developer’s Guide (BKDG) documents GMM registers and access to them:
GMMxXXXXX: GPU memory mapped registers; XXXXX specifies the hexadecimal byte address offset (this may be 2 ...
- 121
2
votes
0
answers
262
views
.bin firmware Standalone Binwalk returns garbage, Binwalk -I returns something but seems corrupted. Binwalk -X returns hundreds of raw deflate streams
As the title says I have the firmware of the WAX214 wifi access point. The firmware is actively preventing me from using the full available functionality of the device so I am trying to reverse it to ...
- 21
2
votes
0
answers
43
views
LZ4N file format - file decoding
I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format.
Non of linux available lz4 tools do ...
- 21
2
votes
0
answers
551
views
Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code
I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this).
After the analysis I get only few codelines with a lot of similar messages:
...
- 121
2
votes
0
answers
233
views
How to disassemble Renesas RX210 MCU firmware?
I am a beginner in firmware reverse engineering. I have a dump file of Renesas RX210 MCU firmware but, I don't know how to disassemble it. Is any recommended software to disassemble it?
- 55
2
votes
0
answers
146
views
Fix screen resolutions to landscape in bios
I've got an x86 tablet (Dere D10). It works fine, except the screen reports portait resolutions (1200x1920, 768x1024, 600x800, etc.) which causes bootloaders (windows recovery menu, grub, ventoy, etc.)...
- 21
2
votes
0
answers
77
views
LG C1 Firmware Flashing/Modifying
I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
2
votes
0
answers
188
views
Prevention of reverse engineering of a microcontroller's firmware
What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller?
Options I see so far:
Flood it with epoxy with quartz or metal dust to make ...
2
votes
0
answers
339
views
Nokia 105(TA-1114) Firmware analysis using Binwalk
First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best.
Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
