Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
14
votes
1answer
20k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
15
votes
2answers
6k views

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
6
votes
1answer
7k views

lzma: File format not recognized [Details enclosed]

I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized. What am I doing wrong ? First I used binwalk to fetch some details as below : binwalk ...
25
votes
2answers
59k views

How do I extract a copy of an unknown firmware from a hardware device?

Appreciate it's a broad question, but despite days of Googling I haven't found straight forward explanation of the general principle of how to "capture" or copy an unkown firmware from a piece of ...
9
votes
3answers
8k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
5
votes
4answers
5k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
3
votes
2answers
4k views

Reverse Engineering MIPS Bootloader

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
6
votes
3answers
1k views

What is the Ubicom32 toolchain and where can I find it?

I am currently reversing firmware for some device. Without any issues I was able to reach deep into its core and extract the file-system. Now I was trying to reverse some of the special applications ...
1
vote
2answers
1k views

CSR DFU File Format

I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question ...
21
votes
4answers
18k views

Firmware analysis and file system extraction?

I'm trying to analyse the firmware image of a NAS device. I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
11
votes
4answers
20k views

Binwalk alternative

When examining bin firmware files Binwalk is an extremely helpful tool. There are times though that Binwalk comes up empty and a lot more digging is required to make sense of the data. Are there any ...
10
votes
1answer
11k views

Emulate TP-LINK WR740N with QEMU

I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the rootfs.img from the firmware, and downloaded vmlinux-2.6.32-5-4kc-malta from here: http://people.debian.org/~aurel32/qemu/...
14
votes
3answers
35k views

Extracting a firmware image via U-Boot

I have a inexpensive Chinese IP-Camera that runs a linux (busybox, to be precise) off a 8-MB SPI flash IC. I'm trying to get access to the device. It has a hardware serial port, and I've gotten ...
11
votes
2answers
3k views

What techniques are used in reverse engineering embedded firmware?

This question is related to another question I posted here. I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. ...
4
votes
1answer
793 views

How to unpack a TFTP file with Firmware

I have 2 files but I have no idea, how to unpack them. 239113254011.ldr 239113254012.krn Inside is a Firmware for ADB(iCan)3800TW used in Italy. We need to unpack it and delete the root password. ...
4
votes
1answer
5k views

Reverse engineering TP-Link TD-W8961N

After following the tutorial here, I decided I would try and reverse engineer my router's firmware. My router is the TP-Link TD-W8961N and the firmware version is V2. I have been trying to figure ...
4
votes
1answer
3k views

Need help extracting YAFFS from firmware .bin file

I've been working on reversing the slingbox firmware. I didn't get anywhere trying to get into a current firmware file (see my other question - appears to be encrypted), so I found a download for an ...
3
votes
1answer
4k views

Firmware extraction problems - binwalk is blank

I'm trying to extract the firmware from my set-top box (STB) because I realized its port 22 is open and running dropbear, and I'd like to login to it. Well, because it's there. I've tried binwalk, but ...
7
votes
1answer
3k views

Unpack Billion 5102 firmware

I'm trying to unpack this firmware image but I'm getting some issues understanding the structure. First of all I have one image which I called firmware.bin, and the file command shows me that it's a ...
5
votes
1answer
3k views

Disassembling VxWorks Firmware

I am trying to disassemble the firmware for the Cisco Sx300 switch as found here: https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76 ...
2
votes
1answer
2k views

Emulating Non-Linux Firmware Image of Embedded Devices

I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware ...
1
vote
1answer
679 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
1
vote
1answer
1k views

Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]

X-POST FROM unix.stackexchange.com I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200. I've decompiled it ...
8
votes
1answer
8k views

Router Decompiling

I am trying to extract the squashfs filesystem of my router. Here is firmware. First, I unzipped the file. Next, I ran binwalk to get some information about the file. DECIMAL HEX ...
6
votes
3answers
4k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
4
votes
1answer
423 views

Reverse Engineering bios of ATM Machine

I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
4
votes
1answer
549 views

Problems with extracting firmware

I am currently trying to reverse-engineer the firmware of an E-Cigarette but I cannot find any clues with the common tools. Heres everything I found so far. Binwalk doesnt recognize anything even ...
3
votes
2answers
7k views

How to extract N150R firmware from .img file

I'm trying to mount an img file for my wireless router firmware but I can't seem to do it successfully. When I fun the file command on that .img it returns the following: $ file file.img file.img: ...
3
votes
1answer
2k views

Emulate juan DVR R7816 in Qemu

I Want to emulate cctv dvr in qemu.this dvr is from juan cctv and the model is R7816.it is an 16ch dvr.I Have firmware upgrade file in .rom format which i can extract with binwalk.But i dont know what ...
3
votes
0answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
3
votes
2answers
2k views

Reverse engineering UEFI CAP files

I'm looking to identify code changes in the latest UEFI release for my motherboard, to verify whether the changes include mitigations for the row hammer vulnerability. I'm specifically looking at the ...
2
votes
1answer
1k views

unpacking Download.img firmware for alcatel mw40

Hello i'm trying to unpack file Download.img from alcatel mw40 (based on qualcomm 9x07) firmware but it seems i can't do it with 7zip or mount the img file . someone already extracted the file which ...
0
votes
1answer
3k views

How can I put a Binwalk extracted firmware back into a .bin binary file?

So, I extracted my router's binary file with binwalk and got the filesystem. I made some changes to the WebUI of the router, and now I want to put it back together into a .bin file so that I can flash ...
6
votes
1answer
5k views

Unsquashfs fails

I'm trying to unsquash a file I retrieved with binwalk. DECIMAL HEX DESCRIPTION -----------------------------------------------------------------------------------------------------------...
5
votes
1answer
521 views

How can the problem posed for disassembly by the mixture of executable code and literal pools in ARM firmware be overcome?

Context and Background Information Part 1: ARM firmware compared to firmware for other architectures I looked at the ARM firmware in these two questions: Running a binary identified as an ARM ...
4
votes
1answer
3k views

Find file signatures inside an unknown file

I have a .bin file I would like to analyse. Especially find images embedded in this firmware update. binwalk couldn't find anything. What other tools do you know to search for possible embedded ...
4
votes
1answer
282 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
3
votes
2answers
310 views

How do I extract the firmware from this bluetooth speaker board?

I have a bluetooth speaker. Infinity Fuze 100. It's a good speaker. But it has annoying messages on startup and shutdown. And for other interface events. I'd like to either get rid of them entirely, ...
3
votes
2answers
2k views

Weird binwalk output on GoPro Firmware

I'm trying to extract GoPro hero 3+ camera firmware but I'm getting a weird output from binwalk. This is the binwalk output (Uploaded to pastebin): http://pastebin.com/raw.php?i=yVZFGZT6 As you ...
2
votes
1answer
1k views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
2
votes
1answer
603 views

How to add new language to ARM firmware

I have piece of firmware (download from here) and I need to get access to its filesystem. Here is the output of a binwalk scan: root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=".*" ps.bin ...
0
votes
3answers
6k views

Limited BusyBox shell

I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell. BusyBox v1.19.2 (built-in shell (ash) Enter 'help' for a list of built-in ...