Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

99 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11
votes
0answers
465 views

Problems calculating checksum for AirConditioner

I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes. I discovered that the upper and lower nibbles need to be ...
9
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
8
votes
0answers
661 views

Firmware analysis, can't find file system

I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
7
votes
0answers
340 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
4
votes
0answers
1k views

Extracting ARM Boot zImage

I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
4
votes
0answers
715 views

What is a TROC Filesystem, and how do I mount it?

I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem: DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------------...
4
votes
0answers
229 views

How to perform manual flashing of a bricked device?

I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
4
votes
2answers
648 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
3
votes
0answers
71 views

Uniden FW Hacking

I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly. FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
3
votes
2answers
381 views

Reverse Engineering Firmware Aether Cone

I have been trying to work out if its possible to reverse engineer the firmware for the Aether Cone. This is a good sound quality WIFI and Bluetooth speaker, but with Aether going bust, there is no ...
3
votes
0answers
962 views

How to extract DVB firmware bin file?

I have a bin file of DVB(DTH) box firmware I want to change one image inside that bin file how I can do this please guide me in right direction. I tried bin walk but the file that it extracted ...
3
votes
0answers
116 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
3
votes
0answers
481 views

Reverse Engineering SCE .pkg Files

To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years ...
3
votes
0answers
306 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
3
votes
0answers
1k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
3
votes
0answers
393 views

How is the tp-link switch firmware obfuscated?

I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one. ...
3
votes
1answer
638 views

Reversal of unknown obfuscation or encryption with known plaintext

Introduction For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
2
votes
0answers
118 views

How can I modify files in a jffs2 image

I'm working with the firmware of SIP phone. I extracted the JFFS2 file system image from the firmware and mounted it using modprobe ike this: sudo modprobe mtdram total_size=36360 sudo modprobe ...
2
votes
0answers
354 views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
2
votes
0answers
135 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
2
votes
1answer
91 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
2
votes
0answers
501 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
2
votes
0answers
302 views

Extracting Firmware file from Wireshark Dump

I updated a device over a firmware update software and sniffed the whole traffic with wireshark. There is a TCP Stream with ~30MB which I exported as raw data. The resulting file is Zip archived data ...
2
votes
0answers
1k views

Arm hex firmware reverse

it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters. One of my goal was to understand how they bypassed (hacked) ...
2
votes
0answers
613 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
2
votes
0answers
1k views

Ducky Mini Firmware Hacking

This is my first reverse engineering project! I recently bought a Ducky Mini keyboard, which is controlled by an ARM Cortex-M3 SoC (to be specific, a Holtek HT32F1655,) and noticed that other ...
2
votes
0answers
775 views

Flash dump with encoded firmware

I downloaded firmware from 4MB spi flash in HDMI extender (more info here). It contains following sections: 0x00000000 – 0x00024e03 – SMEDIA02 …….456789ABCDEF (encoded – some strings suggesting ...
2
votes
0answers
341 views

Looking to RE a Ducky Shine 5

I know how to program in C++/C# and a few other low level languages. I'm however in the dark about reverse engineering firmware etc. I was wondering if anyone could point me towards some learning ...
2
votes
0answers
629 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
1
vote
0answers
31 views

Unpacking or split .BIN firmware for router device

Sorry for my question, i'm newbie! so i'm trying to split or unpack this file mobile_update.bin, it is an firmware for routeur device. (Based on qualcomm 9x07 and secureboot device also), i'm trying ...
1
vote
1answer
119 views

Custom nanddump and nandwrite tools

I am trying to reverse engineer a router's firmware. The device has a NAND chip, and has a cripled version of BusyBox v1.14.1. nanddump command exists but with intresting parameters, as I wasn't able ...
1
vote
0answers
78 views

USB packet capture; understanding the communication

Good Day- I have captured via Wireshark some data and am attempting to understand it as well as the communication protocol for USB. This one capture contains the sequence 02010c, which tells me the ...
1
vote
0answers
127 views

No false positive on binwalk

I have the same problem from my previous post but this time, I don't think it's the same culprit again as I have solved the problems. This time, I'm very sure I had extracted the firmware. On my ...
1
vote
0answers
191 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
1
vote
0answers
110 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
1
vote
0answers
249 views

Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate

I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to ...
1
vote
0answers
64 views

TMS320VC5416 DSP firmware reversing

I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers: page: 0000 offset: 0080 len: 0149 page: 0000 ...
1
vote
0answers
320 views

Decrypting the Config file of a Huawei router “HG630 V2”

followed that post from Wordpress https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/ Extracted the 4 Hex strings needed. But, looks ...
1
vote
0answers
70 views

How can I emulate Huawei routers HG5xx firmware?

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
1
vote
0answers
18 views

Avrdude inconsistent readings

I have a problem with this dude and i don't know what to do to make him do a consistent reading or to figure out which reading is the perfect one I'm trying to read my own arduino uno which has a ...
1
vote
0answers
155 views

Find File System in Firmware

This is my first attempt at working with firmware. We have some SNMP cards that are flaky & my ultimate goal is to try to make them better. The current firmware version is 12.06.0069. When ...
1
vote
0answers
75 views

Need help : restoring a netgear dgn1000 v3 adsl modem/router

coming in from openwrt forum: https://forum.openwrt.org/t/trying-to-rescue-bricked-dgn1000-v3-need-help/36909 currently have serial console but i may have borked the u-boot looking for help on how to ...
1
vote
0answers
112 views

Help investigating a printer firmware image

We're having issues with the WiFi connectivity on the printers that we're using on a current project. The printer connects fine, but the ports that should be opened are not opened. They work fine on ...
1
vote
0answers
144 views

Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)

Why I want to decrypt: Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS. Problems I met: The macOS BT firmware ...
1
vote
0answers
82 views

Finding the function of test points on a router

I have a BCM3383 based cable router here where I ultimately want to dump the firmware. I have serial access to the broadcom bootloader and the linux console. Login for linux is unkown and telnet does ...
1
vote
0answers
105 views

Which architecture is this firmware?

I am currently investigating GSL touch-screen controllers firmwares. A firmware example can be found here : https://github.com/onitake/gsl-firmware/blob/master/firmware/4good/t803i/silead_ts.fw In ...
1
vote
0answers
116 views

How to dump firmware from R5F71424 MCU

I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware. It has a limited boot mode that only allows writing to the MCU. Any pointers or ideas would be helpful....
1
vote
0answers
122 views

Attempting to RE DI-8002W Dlink Firmware. Cannot find file system

I'm attempting to reverse engineer the DI-8002W firmware from Dlink in order to search for vulnerabilities within the router. I'm at the point where I've recovered the Linux Image, but I cannot ...
1
vote
0answers
214 views

Building custom image with firmware mod kit

basically I have netis WF2409E router and i want to update it with custom image so I decided to try fmk. First I added gdbserver to usr/bin and re-packt it with fmk and upload it. After finishing ...
1
vote
0answers
296 views

What is the format of this binary file?

I have a binary file that I found on a 3D printer that is used to program a dsPIC30F5011 microcontroller. It is responsible for some basic data encryption. The only problem is, I am not sure how this ...