Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

Unknown filesystem in GoPro Hero 9 firmware

I'm trying to extract the GoPro Hero 9's firmware to tweak some of the parameters. This is my first time doing any sort of reverse engineering but I'm hoping that by finding the filesystem I can ...
0
votes
0answers
17 views

Mitsubishi MAC-577IF2-E WIFI controller Firmware file

I recently installed Mitsubishi AC with Mitsubishi MAC-577IF2-E wifi controller and as always nowadays this devices comunicate with Cloud servers first then with you which practically means you need ...
1
vote
0answers
16 views

Unable to find the pci device mentioned in the processor datasheet

I have following intel processor 4th Generation Core Processor (Haswell U/Y). I want to check the value of PMBASE register in the processor. For that I have downloaded the processor datasheet, where I ...
3
votes
1answer
59 views

Fujifilm Firmware Checksum

I'm working on reverse engineering the firmware for my Fujifilm HS20EXR. I've figured out most of it, but I am currently stuck on what I am fairly certain is a checksum. If I modify it, the camera ...
0
votes
0answers
30 views

Unpacking firmware of TP-LINK IPC firmware

I have some TP-LINK IPC firmware that must be reversed (as a task). But I can not unpack the .bin firmware and extract the file system. Binwalk output: 576 0x240 xz compressed data ...
1
vote
1answer
83 views

Disassembling ARM based Camera Firmware

I'm trying to disassemble hikvision firmware 5.5.85. I want to extract the contents of digicap.dav file. Binwalk is unable to extract the known zip files. binwalk -e digicap.dav DECIMAL ...
5
votes
1answer
155 views

Would hiring a RE service be worth it?

Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
0
votes
0answers
35 views

Extracting files from NAND flash dump

I trying to extract files from nand flash dump (car radio player). Dump is done by desoldering and read with flash programmer.I see that there is a UBI file system, but cannot extract/mount any files. ...
0
votes
0answers
44 views

Inflate zlib Data Stream from Hex File

I am working on a firmware bin file that has been extracted from an EXE file. The Firmware was inserted as an encrypted PKZip resource in the EXE. I was able to fish the EXE password at runtime and ...
1
vote
0answers
101 views

Firmware RE (Beginner)

I'm trying to learn RE, and I thought I'd look at some firmware that interests me. I'm looking at the Roland TD-11 drum module firmware, which is available for download from the Roland website I ...
1
vote
0answers
32 views

How can I flash unpacked firmware into Alcatel MiFi?

I bought Alcatel MW40V from Vodafone Shop some weeks ago and I can't access USSD Codes within Web UI. Bus 001 Device 008: ID 1bbb:0195 T & A Mobile Phones Alcatel OneTouch L850V / Telekom ...
1
vote
0answers
70 views

ARM Cortex-M0 - How to either (non-intrusively) extract firmware or modify downloadable firmware (NuMicro NUC126)

As a hands-on introduction into RE, I've decided to take on a small, simple embedded device. In hindsight, it was probably a mistake. This "project" has consumed me for about 2 weeks. ...
0
votes
0answers
21 views

Only some files are unpacked while firmware reversing with binwalk tool

I am reversing a firmware with binwalk. Unpacking was succeed, but I can't find my target files. (CGI files in www folder) When I connect to the web page of my router, I can see links include CGI ...
1
vote
0answers
41 views

Reverse Engineering SNES adapter

A good "Hello world" for everybody here I've bought a Mayflash PC052 adapter to convert an original SNES-mini controller (CLV-202) to a USB port on PC or PS4... The thing is, this CLV-202 ...
-1
votes
3answers
107 views

How to reverse *.pkg file? This is a firmware file of a router

I am a newbi for reversing engineering. I am going to reversing a firmware file. (*.pkg) I could find many tutorials for reversing *.bin, but I can't find any tutorials for reversing *.pkg file. And I ...
3
votes
2answers
96 views

Find the entry point in Interrupt Vector Table ARM9

I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings. I've disassembled the firmware using ida pro, but I couldn't find the entry ...
4
votes
0answers
208 views

How to extract sound file from a small 1MB binary

I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
0
votes
0answers
14 views

Trotec Speedy 300 - Laser Run Length Encoding

I am trying to reverse engineering the Run Length Encoding that the Trotec Laser uses to engrave bitmap images. Does the following encoding correspond to a known schem? Each line is form a different ...
1
vote
0answers
38 views

Automotive engine management - reversing a PIN that has locked an MTX8 ECU

I'm after advice on how to identify a PIN that has been accidently entered and has locked an automotive ECU making it useless. The problem is resolvable by sending the computer back to the ...
1
vote
2answers
216 views

Harman Kardon firmware reverse engineering

First of all, I'm very new to reverse engineering, but I know about hex, binary, opcodes, et cetera. I'm trying to reverse engineer a Harman Kardon firmware file, because I think there are some API ...
0
votes
0answers
78 views

Stuck attempting to reverse Denon AVR encrypted update

I am trying to RE the update file for a Denon AVR for fun and to see if I can figure out how to access the device's webserver which otherwise returns HTTP 403, and how to enable Pandora on my EU ...
1
vote
1answer
43 views

Replacing firmware, Longshine Shinebook

Am wondering how to replace the firmware on a Longshine Shinebook (manual, firmware, more stuff). Assuming I modify the firmware files, how do I put the new version on the device? I'm guessing there ...
0
votes
0answers
49 views

Nokia 105(TA-1114) Firmware analysis using Binwalk

First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best. Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
3
votes
2answers
308 views

How do I extract the firmware from this bluetooth speaker board?

I have a bluetooth speaker. Infinity Fuze 100. It's a good speaker. But it has annoying messages on startup and shutdown. And for other interface events. I'd like to either get rid of them entirely, ...
2
votes
0answers
62 views

How to modify checksum after making changes in Nokia 215 4G firmware?

If I change any character in the firmware file and try to flash it, it will failed. But it will successfully flashed if I changed the string with the same number of character if it's not a function. ...
2
votes
0answers
106 views

How to perform full MIPS system emulation with QEMU, using the squashfs image and uBoot kernel image?

TL;DR: Need tips on emulation of MIPS-BE system using QEMU with the help of squashfs image file and uBoot Kernel image file extracted from the firmware file. Long Version: - What I have: A cheap ...
0
votes
0answers
88 views

Help to find the main menu apps in Nokia firmware

I am trying to custom Nokia 215 4G firmware I want to remove specific apps like games, radio, browser... If not removing it, redirecting it OR even damage it. So when you click on an app it will open ...
0
votes
0answers
52 views

Understanding operation of ALU in SAF80-C509

Good day. I'm reversing an automotive ECU firmware which works on SAF80-C509 processor (Intel 51 architecture). Now, I've got this part of code: code:64C5 mov MD0, R0 ; ...
0
votes
0answers
46 views

Questions about reverse engineering of a bootloader

I'm learning reversing, practicing with a old router(Huawei HG532s) I extracted the router's flash content with a script of this post https://wikidevi.wi-cat.ru/Huawei_HG532s 1 I have used binwalk to ...
0
votes
0answers
66 views

Help in extracting .bin firmware file of TV

I need help in extracting the .bin firmware of a tv (Sony W650A it is based on android) the firmware file is: Here I ran binwalk on it and here is the result: DECIMAL HEXADECIMAL DESCRIPTION ...
0
votes
0answers
44 views

QEMU & Firmware inside Docker

I am currently trying to run a router firmware via qemu inside a docker container. I'm using multiarch/qemu-user-static:x86_64-mips. Here is my Dockerfile: FROM multiarch/qemu-user-static:x86_64-mips ...
0
votes
0answers
58 views

Router firmware research

So I got a new tp-link router (Archer vr600) and downloaded the firmware version I'm running from the site (V2 firmware version 170504) in order to search for vulnerabilites. After some research I got ...
1
vote
1answer
113 views

how to extract this firmware .img?

how to extract this firmware .img?!? https://files.fm/u/bhgbk336r w/ binwalk i've this output: DECIMAL HEXADECIMAL DESCRIPTION ---------------------------------------------------------------...
0
votes
1answer
36 views

Which processor do I specify when I load HCS08 firmware to IDA?

Motorola/Freescale MC680xx, CPU32 (68330), MC6301, MC6303, MC6800, MC6801, MC6803, MC6805, MC6808, HCS08, MC6809, MC6811, M68H12C, ColdFire IDA claims to have the support for HCS08. But I can't see ...
0
votes
1answer
71 views

Grundfos Firmware

I am trying to understand the firmware of a Grundfos CIM 500 product. The CIM 500 is a control module for grundfos pumps which uses a web interface. From binwalk I have found that it is running eCos, ...
0
votes
0answers
28 views

HexRay API - Programatically rebaseing program on firmware

I am working on several firmwares (mostly ARM and PPC) that have no structure that IDA can decipher and so far I have been guessing BASE address until the functions and strings align with what I see ...
1
vote
0answers
79 views

Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset

I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP. The device has a custom android repo ...
3
votes
1answer
69 views

Dump Headunit Software

I am a computer engineering senior and have a few quick questions i couldn't find any hits about online. I know just enough to get myself into trouble. Note: I have no specialized tools just a DMM and ...
3
votes
1answer
153 views

Is it possible to sniff an ATA Drive password?

Context: I have a proprietary Tandberg Data RDX QuickStor Internal USB3 drive bay for PC (item number 8666-RDX) and some storage cartridges for it. Esentially, these are just regular TOSHIBA MK3276GSX ...
3
votes
1answer
553 views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
0
votes
0answers
173 views

How to flash Devolo Device (AR9331 MIPS) using U-Boot TFTP and .dev firmware file

after a regular firmware update using devolo-cockpit software, my Devolo dLAN 500 Wifi is bricked. The boot-loader still works and tries to download a firmware using tftp to flash it. This works but I ...
0
votes
1answer
381 views

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)? [closed]

Although I have no hope really I will leave this here in case someone has the ability and time to help. This is from a modem/router widely used in countries like Germany, Greece and others from ...
2
votes
0answers
89 views

How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?

I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them. I have dumped and decoded the bios and got some useful datas, according to datas we can see u-...
0
votes
1answer
73 views

How can I find a value in Tricore(TC1766) Arch?

I recently work on Tricore Processor, but I have some problems. With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
1
vote
0answers
136 views

ZTE AES-256-CBC Encrypted backup config file

i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output Encrypted Data Start Position: 227 ...
1
vote
0answers
56 views

How does one start with reversing router config encryption?

There is not enough info on the web from what I have seen. Most write ups/guides/blog-posts are like this: They provide only the decrypt/encrypt script-tool with how to run it and nothing else They ...
3
votes
2answers
98 views

BRANCH OCCURS in IDApro

Recently I work on TMS320C6xx Arch and when I reverse this firmware I saw functions graph nodes are separated. I have shown in below: As you see, BRANCH OCCURS wrote at the end of each node. I guess ...
0
votes
0answers
49 views

What are the open source symbolic execution tools for Firmware?

I have tried to use angr, KLEE, S2E to symbolically analyze firmware binaries such as DIR-815(httpd ELF binary). import claripy import angr p = angr.Project('./httpd', load_options={'auto_load_libs':...
1
vote
1answer
106 views

Where is the persistent storage on this router?

I am working on reversing a router for which I cannot find downloadable firmware anywhere. I managed to get a root shell on the router. I am now confused as I cannot see any persistent writeable ...
2
votes
1answer
157 views

Unable to unsquash from a FW dump

After trying to unsquash a firmware dump from a router without success, I am asking for help. I have a router with a BCM68380 CPU. After desoldering the TOSHIBA NAND chip I dumped the firmware (link ...

1
2 3 4 5
8