Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
0
votes
1answer
394 views

Disassembling Hexagon - Corrupted ELF

I downloaded and unpacked the modem from Google source, after that I used laginimaineb's script to unify all modem binary data. However, when loading this binary to IDA, I get an error says: "Binary ...
5
votes
2answers
664 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
2
votes
1answer
136 views

Unable to unsquash from a FW dump

After trying to unsquash a firmware dump from a router without success, I am asking for help. I have a router with a BCM68380 CPU. After desoldering the TOSHIBA NAND chip I dumped the firmware (link ...
1
vote
0answers
19 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
1
vote
1answer
94 views

how to extract this firmware .img?

how to extract this firmware .img?!? https://files.fm/u/bhgbk336r w/ binwalk i've this output: DECIMAL HEXADECIMAL DESCRIPTION ---------------------------------------------------------------...
2
votes
0answers
36 views

How to perform full MIPS system emulation with QEMU, using the squashfs image and uBoot kernel image?

TL;DR: Need tips on emulation of MIPS-BE system using QEMU with the help of squashfs image file and uBoot Kernel image file extracted from the firmware file. Long Version: - What I have: A cheap ...
0
votes
0answers
48 views

Help to find the main menu apps in Nokia firmware

I am trying to custom Nokia 215 4G firmware I want to remove specific apps like games, radio, browser... If not removing it, redirecting it OR even damage it. So when you click on an app it will open ...
0
votes
0answers
43 views

Understanding operation of ALU in SAF80-C509

Good day. I'm reversing an automotive ECU firmware which works on SAF80-C509 processor (Intel 51 architecture). Now, I've got this part of code: code:64C5 mov MD0, R0 ; ...
0
votes
0answers
35 views

Questions about reverse engineering of a bootloader

I'm learning reversing, practicing with a old router(Huawei HG532s) I extracted the router's flash content with a script of this post https://wikidevi.wi-cat.ru/Huawei_HG532s 1 I have used binwalk to ...
0
votes
0answers
40 views

Help in extracting .bin firmware file of TV

I need help in extracting the .bin firmware of a tv (Sony W650A it is based on android) the firmware file is: Here I ran binwalk on it and here is the result: DECIMAL HEXADECIMAL DESCRIPTION ...
1
vote
1answer
260 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
0
votes
0answers
33 views

QEMU & Firmware inside Docker

I am currently trying to run a router firmware via qemu inside a docker container. I'm using multiarch/qemu-user-static:x86_64-mips. Here is my Dockerfile: FROM multiarch/qemu-user-static:x86_64-mips ...
0
votes
0answers
45 views

Router firmware research

So I got a new tp-link router (Archer vr600) and downloaded the firmware version I'm running from the site (V2 firmware version 170504) in order to search for vulnerabilites. After some research I got ...
0
votes
2answers
260 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
2
votes
1answer
107 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
0
votes
0answers
53 views

Unknown 160bit challenge-response (36V ebike battery protocol)

I'm currently trying to build a custom battery pack for an electric bike. The bike uses 36V batteries from Panasonic (also sold under OEM brands Victoria, Kalkhoff, Rahleigh, Flyer, Kettler). We'...
2
votes
1answer
48 views

Dump Headunit Software

I am a computer engineering senior and have a few quick questions i couldn't find any hits about online. I know just enough to get myself into trouble. Note: I have no specialized tools just a DMM and ...
0
votes
1answer
168 views

Need help opening a .img file from a camera firmware (trying to get out of the Meari/Zumimall/PPstrong cloud!)

I've got a cloud-based battery powered camera which I'm really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!). I've managed to get a .bin file. Binwalk ...
0
votes
1answer
29 views

Which processor do I specify when I load HCS08 firmware to IDA?

Motorola/Freescale MC680xx, CPU32 (68330), MC6301, MC6303, MC6800, MC6801, MC6803, MC6805, MC6808, HCS08, MC6809, MC6811, M68H12C, ColdFire IDA claims to have the support for HCS08. But I can't see ...
1
vote
0answers
59 views

Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset

I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP. The device has a custom android repo ...
0
votes
1answer
61 views

Grundfos Firmware

I am trying to understand the firmware of a Grundfos CIM 500 product. The CIM 500 is a control module for grundfos pumps which uses a web interface. From binwalk I have found that it is running eCos, ...
3
votes
1answer
318 views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
0
votes
0answers
26 views

HexRay API - Programatically rebaseing program on firmware

I am working on several firmwares (mostly ARM and PPC) that have no structure that IDA can decipher and so far I have been guessing BASE address until the functions and strings align with what I see ...
0
votes
1answer
217 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
3
votes
3answers
5k views

Speedport entry 2i zte home router's firmware

I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(it's an ISP's speedport entry 2i router(zte variant)). So long story ...
4
votes
2answers
498 views

Reverse Engineering Firmware Aether Cone

I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no ...
0
votes
1answer
64 views

How can I find a value in Tricore(TC1766) Arch?

I recently work on Tricore Processor, but I have some problems. With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
3
votes
2answers
81 views

BRANCH OCCURS in IDApro

Recently I work on TMS320C6xx Arch and when I reverse this firmware I saw functions graph nodes are separated. I have shown in below: As you see, BRANCH OCCURS wrote at the end of each node. I guess ...
3
votes
1answer
114 views

Is it possible to sniff an ATA Drive password?

Context: I have a proprietary Tandberg Data RDX QuickStor Internal USB3 drive bay for PC (item number 8666-RDX) and some storage cartridges for it. Esentially, these are just regular TOSHIBA MK3276GSX ...
2
votes
0answers
111 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
2
votes
1answer
481 views

Analysis of BusyBox Shell router U-Boot firmware

I am trying to get access to the BusyBox Shell and if possible to get a firmware dump. The "U-Boot" has limited possibilities but what is good is "sf - SPI flash sub-system". Can anyone help me get ...
0
votes
1answer
248 views

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)? [closed]

Although I have no hope really I will leave this here in case someone has the ability and time to help. This is from a modem/router widely used in countries like Germany, Greece and others from ...
0
votes
0answers
106 views

How to flash Devolo Device (AR9331 MIPS) using U-Boot TFTP and .dev firmware file

after a regular firmware update using devolo-cockpit software, my Devolo dLAN 500 Wifi is bricked. The boot-loader still works and tries to download a firmware using tftp to flash it. This works but I ...
7
votes
1answer
2k views

Reverse engineering Devolo firmware

I am trying to do some reverse engineering to a Devolo dlan wifi 500 device (MIPS architecture). My objective is to put there some firmware modified by me. This is where I got so far: Downloaded a ...
0
votes
1answer
121 views

How to dump firmware from ATWINC1510

I got a ATWINC-1510 based device in front of me where I want to dump the firmware / flash contents from into a bin file. I know that the IC offers an SPI interface through the pins described in the ...
2
votes
0answers
61 views

How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?

I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them. I have dumped and decoded the bios and got some useful datas, according to datas we can see u-...
1
vote
0answers
52 views

How does one start with reversing router config encryption?

There is not enough info on the web from what I have seen. Most write ups/guides/blog-posts are like this: They provide only the decrypt/encrypt script-tool with how to run it and nothing else They ...
1
vote
0answers
67 views

ZTE AES-256-CBC Encrypted backup config file

i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output Encrypted Data Start Position: 227 ...
1
vote
2answers
3k views

Reverse Engineer STM32L151's Firmware

I have the STM32L151's firmware that I extracted via JTAG, but I cannot find a start point in IDA. I have tried two methods: 1) I start IDA, drag the binary into the workspace, select ARM Little-...
1
vote
2answers
893 views

CSR DFU File Format

I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question ...
2
votes
1answer
9k views

Reverse Engineering a Firmware. Someone can help me?

I am currently trying to reverse-engineer a firmware file to learn the topic but I am a little bit stuck. I tried to use binwalk to get more information about the file but this did not produce ...
0
votes
0answers
36 views

What are the open source symbolic execution tools for Firmware?

I have tried to use angr, KLEE, S2E to symbolically analyze firmware binaries such as DIR-815(httpd ELF binary). import claripy import angr p = angr.Project('./httpd', load_options={'auto_load_libs':...
1
vote
1answer
92 views

Where is the persistent storage on this router?

I am working on reversing a router for which I cannot find downloadable firmware anywhere. I managed to get a root shell on the router. I am now confused as I cannot see any persistent writeable ...
5
votes
4answers
4k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
0
votes
2answers
939 views

How to read firmware from an STC microcontroller?

I have some printed circuit boards of a device that is no longer manufactured. I need to repair these boards but there is no replacement for them. I can make other boards, buy the components, but I ...
1
vote
2answers
463 views

Using NAND flash dump with OOB data

I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions ...
0
votes
1answer
2k views

how can i decrypt huawei HG531s v1 config file?

I have tried to follow this guide but libxmlapi.so didn't have the required ATP_GetInfo1 function so i moved to the next file libhttpapi.so it had ATP_GetInfo1 ATP_GetInfo2 ATP_GetInfo3 ...
0
votes
1answer
124 views

can't extract a lzma compressed file

hello i want to do the reverse engineering. for tp linkTD-W8961ND_V3 firmware here is the output DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------...
0
votes
0answers
58 views

binwalk not showing file descriptions (signatures) after 1st try

I have a bin file that shows a list of lzma compressed files which I extracted generically to .7z files using this format "binwalk -D "elf 32-bit lsb shared object":.so image.bin" ...
1
vote
0answers
29 views

advice for retrieving functions and tables from intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU

I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables and plot them out before going onto DIY hardware . . Does anyone know which ...

1
2 3 4 5
8