Questions tagged [firmware-analysis]
The firmware-analysis tag has no usage guidance.
41
questions
18
votes
1
answer
23k
views
Approach to extract useful information from binary file
The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file.
I'...
- 195
15
votes
2
answers
7k
views
How does a SIM card work?
I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors.
They act as peripherals that are more than just flash memory.
I would like to be able to ...
- 329
7
votes
1
answer
9k
views
lzma: File format not recognized [Details enclosed]
I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized.
What am I doing wrong ?
First I used binwalk to fetch some details as below :
binwalk ...
- 211
26
votes
2
answers
67k
views
How do I extract a copy of an unknown firmware from a hardware device?
Appreciate it's a broad question, but despite days of Googling I haven't found straight forward explanation of the general principle of how to "capture" or copy an unkown firmware from a piece of ...
- 363
9
votes
3
answers
11k
views
Extracting a NAND flash dump with OOB data
I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed.
The dump was supposed to be just user ...
- 36.6k
7
votes
3
answers
2k
views
What is the Ubicom32 toolchain and where can I find it?
I am currently reversing firmware for some device.
Without any issues I was able to reach deep into its core and extract the file-system. Now I was trying to reverse some of the special applications ...
- 2,331
5
votes
4
answers
6k
views
Identify compression of this ZTE ZXV10 H201L V2 backup config file
This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can.
00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
- 515
3
votes
2
answers
5k
views
Reverse Engineering MIPS Bootloader
I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
- 173
3
votes
2
answers
3k
views
Weird binwalk output on GoPro Firmware
I'm trying to extract GoPro hero 3+ camera firmware but I'm getting a weird output from binwalk.
This is the binwalk output (Uploaded to pastebin):
http://pastebin.com/raw.php?i=yVZFGZT6
As you ...
- 725
23
votes
4
answers
19k
views
Firmware analysis and file system extraction?
I'm trying to analyse the firmware image of a NAS device.
I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
- 333
13
votes
4
answers
27k
views
Binwalk alternative
When examining bin firmware files Binwalk is an extremely helpful tool. There are times though that Binwalk comes up empty and a lot more digging is required to make sense of the data.
Are there any ...
- 437
11
votes
2
answers
4k
views
What techniques are used in reverse engineering embedded firmware?
This question is related to another question I posted here.
I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. ...
- 419
11
votes
1
answer
13k
views
Emulate TP-LINK WR740N with QEMU
I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the rootfs.img from the firmware, and downloaded vmlinux-2.6.32-5-4kc-malta from here: http://people.debian.org/~aurel32/qemu/...
- 123
8
votes
1
answer
3k
views
Unpack Billion 5102 firmware
I'm trying to unpack this firmware image but I'm getting some issues understanding the structure.
First of all I have one image which I called firmware.bin, and the file command shows me that it's a ...
- 725
8
votes
1
answer
9k
views
Router Decompiling
I am trying to extract the squashfs filesystem of my router. Here is firmware.
First, I unzipped the file. Next, I ran binwalk to get some information about the file.
DECIMAL HEX ...
- 257
6
votes
3
answers
5k
views
Running a binary identified as an ARM excutable by binwalk --disasm
I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
- 163
6
votes
1
answer
6k
views
Unsquashfs fails
I'm trying to unsquash a file I retrieved with binwalk.
DECIMAL HEX DESCRIPTION
-----------------------------------------------------------------------------------------------------------...
- 231
5
votes
2
answers
4k
views
How do I extract the firmware from this bluetooth speaker board?
I have a bluetooth speaker. Infinity Fuze 100.
It's a good speaker.
But it has annoying messages on startup and shutdown. And for other interface events. I'd like to either get rid of them entirely, ...
- 143
5
votes
1
answer
898
views
How to unpack a TFTP file with Firmware
I have 2 files but I have no idea, how to unpack them.
239113254011.ldr
239113254012.krn
Inside is a Firmware for ADB(iCan)3800TW used in Italy. We need to unpack it and delete the root password.
...
- 51
5
votes
1
answer
3k
views
Find file signatures inside an unknown file
I have a .bin file I would like to analyse. Especially find images embedded in this firmware update.
binwalk couldn't find anything.
What other tools do you know to search for possible embedded ...
- 3,079
5
votes
1
answer
4k
views
Disassembling VxWorks Firmware
I am trying to disassemble the firmware for the Cisco Sx300 switch as found here:
https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76
...
- 1,258
4
votes
1
answer
614
views
Reverse Engineering bios of ATM Machine
I bought an Hyosung NH1500 off Offer-up and it boots up and initializes some peripherals and then spits out and error of "COM download is failed". I've searched Google and 0 results came up, I've been ...
- 43
4
votes
1
answer
715
views
How can the problem posed for disassembly by the mixture of executable code and literal pools in ARM firmware be overcome?
Context and Background Information
Part 1: ARM firmware compared to firmware for other architectures
I looked at the ARM firmware in these two questions:
Running a binary identified as an ARM ...
- 7,138
4
votes
1
answer
708
views
Problems with extracting firmware
I am currently trying to reverse-engineer the firmware of an E-Cigarette but I cannot find any clues with the common tools. Heres everything I found so far.
Binwalk doesnt recognize anything even ...
- 43
4
votes
1
answer
4k
views
Need help extracting YAFFS from firmware .bin file
I've been working on reversing the slingbox firmware. I didn't get anywhere trying to get into a current firmware file (see my other question - appears to be encrypted), so I found a download for an ...
- 475
4
votes
2
answers
3k
views
Reverse engineering UEFI CAP files
I'm looking to identify code changes in the latest UEFI release for my motherboard, to verify whether the changes include mitigations for the row hammer vulnerability. I'm specifically looking at the ...
- 1,272
4
votes
1
answer
6k
views
Firmware extraction problems - binwalk is blank
I'm trying to extract the firmware from my set-top box (STB) because I realized its port 22 is open and running dropbear, and I'd like to login to it. Well, because it's there. I've tried binwalk, but ...
- 475
4
votes
2
answers
8k
views
How to extract N150R firmware from .img file
I'm trying to mount an img file for my wireless router firmware but I can't seem to do it successfully.
When I fun the file command on that .img it returns the following:
$ file file.img
file.img: ...
- 143
4
votes
1
answer
6k
views
Reverse engineering TP-Link TD-W8961N
After following the tutorial here, I decided I would try and reverse engineer my router's firmware. My router is the TP-Link TD-W8961N and the firmware version is V2.
I have been trying to figure ...
- 203
4
votes
1
answer
329
views
How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?
Goal:
1 - To load a older version of the firmware on the device because it has features the newer version does not.
2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
- 123
3
votes
1
answer
855
views
How to add new language to ARM firmware
I have piece of firmware (download from here) and I need to get access to its filesystem.
Here is the output of a binwalk scan:
root@kali:~/Desktop/E1200YDXNB1_OLAANB1# binwalk --dd=".*" ps.bin
...
- 31
3
votes
1
answer
2k
views
Emulate juan DVR R7816 in Qemu
I Want to emulate cctv dvr in qemu.this dvr is from juan cctv and the model is R7816.it is an 16ch dvr.I Have firmware upgrade file in .rom format which i can extract with binwalk.But i dont know what ...
- 31
3
votes
0
answers
2k
views
Analysing eCos image
I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step.
This is the current uncompressed image:
https://www.dropbox.com/s/...
- 31
2
votes
1
answer
2k
views
Emulating Non-Linux Firmware Image of Embedded Devices
I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware ...
- 397
2
votes
1
answer
1k
views
Stepping through ARM firmware image
I have a binary firmware image with a routine that I find hard to understand.
I want to step through this encryption routine step by step so I can better understand it.
I was able to obtain all the ...
2
votes
1
answer
2k
views
unpacking Download.img firmware for alcatel mw40
Hello i'm trying to unpack file Download.img from alcatel mw40 (based on qualcomm 9x07) firmware but it seems i can't do it with 7zip or mount the img file . someone already extracted the file which ...
- 111
1
vote
3
answers
2k
views
CSR DFU File Format
I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question ...
- 378
1
vote
1
answer
4k
views
Way to get all the function prototype using Ghidra
I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
- 281
1
vote
1
answer
2k
views
Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]
X-POST FROM unix.stackexchange.com
I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200.
I've decompiled it ...
- 146
0
votes
1
answer
5k
views
How can I put a Binwalk extracted firmware back into a .bin binary file?
So, I extracted my router's binary file with binwalk and got the filesystem. I made some changes to the WebUI of the router, and now I want to put it back together into a .bin file so that I can flash ...
0
votes
3
answers
9k
views
Limited BusyBox shell
I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell.
BusyBox v1.19.2 (built-in shell (ash)
Enter 'help' for a list of built-in ...
- 113