Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

105 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11
votes
0answers
482 views

Problems calculating checksum for AirConditioner

I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes. I discovered that the upper and lower nibbles need to be ...
9
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
8
votes
0answers
755 views

Firmware analysis, can't find file system

I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
7
votes
0answers
394 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
4
votes
0answers
2k views

Extracting ARM Boot zImage

I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
4
votes
0answers
833 views

What is a TROC Filesystem, and how do I mount it?

I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem: DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------------...
4
votes
0answers
247 views

How to perform manual flashing of a bricked device?

I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
4
votes
2answers
652 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
3
votes
1answer
211 views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
3
votes
0answers
81 views

Uniden FW Hacking

I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly. FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
3
votes
0answers
1k views

How to extract DVB firmware bin file?

I have a bin file of DVB(DTH) box firmware I want to change one image inside that bin file how I can do this please guide me in right direction. I tried bin walk but the file that it extracted ...
3
votes
0answers
123 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
3
votes
0answers
510 views

Reverse Engineering SCE .pkg Files

To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years ...
3
votes
0answers
308 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
3
votes
0answers
1k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
3
votes
0answers
396 views

How is the tp-link switch firmware obfuscated?

I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one. ...
3
votes
1answer
683 views

Reversal of unknown obfuscation or encryption with known plaintext

Introduction For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
2
votes
1answer
37 views

Dump Headunit Software

I am a computer engineering senior and have a few quick questions i couldn't find any hits about online. I know just enough to get myself into trouble. Note: I have no specialized tools just a DMM and ...
2
votes
0answers
46 views

How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?

I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them. I have dumped and decoded the bios and got some useful datas, according to datas we can see u-...
2
votes
0answers
197 views

How can I modify files in a jffs2 image

I'm working with the firmware of SIP phone. I extracted the JFFS2 file system image from the firmware and mounted it using modprobe ike this: sudo modprobe mtdram total_size=36360 sudo modprobe ...
2
votes
0answers
670 views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
2
votes
0answers
164 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
2
votes
1answer
100 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
2
votes
0answers
626 views

Extracting firmware image from binary

I have firmware file in .bin format, but I need get firmware.img image file and Kernel uImage file for reflashing bricked device. How can I get these parts? I used Binwalk to extract content, ...
2
votes
0answers
367 views

Extracting Firmware file from Wireshark Dump

I updated a device over a firmware update software and sniffed the whole traffic with wireshark. There is a TCP Stream with ~30MB which I exported as raw data. The resulting file is Zip archived data ...
2
votes
0answers
1k views

Arm hex firmware reverse

it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters. One of my goal was to understand how they bypassed (hacked) ...
2
votes
0answers
663 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
2
votes
0answers
1k views

Ducky Mini Firmware Hacking

This is my first reverse engineering project! I recently bought a Ducky Mini keyboard, which is controlled by an ARM Cortex-M3 SoC (to be specific, a Holtek HT32F1655,) and noticed that other ...
2
votes
0answers
783 views

Flash dump with encoded firmware

I downloaded firmware from 4MB spi flash in HDMI extender (more info here). It contains following sections: 0x00000000 – 0x00024e03 – SMEDIA02 …….456789ABCDEF (encoded – some strings suggesting ...
2
votes
0answers
342 views

Looking to RE a Ducky Shine 5

I know how to program in C++/C# and a few other low level languages. I'm however in the dark about reverse engineering firmware etc. I was wondering if anyone could point me towards some learning ...
2
votes
0answers
662 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
1
vote
0answers
51 views

Trouble backing up rom on locked proprietary mediatek device - mt8163 chipset

I have a proprietary tablet with mediatek chipset MT8163v, and getting the factory ROM and/or scatter file is out of the question. My goal is to flash with TWRP. The device has a custom android repo ...
1
vote
0answers
30 views

ZTE AES-256-CBC Encrypted backup config file

i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output Encrypted Data Start Position: 227 ...
1
vote
0answers
49 views

How does one start with reversing router config encryption?

There is not enough info on the web from what I have seen. Most write ups/guides/blog-posts are like this: They provide only the decrypt/encrypt script-tool with how to run it and nothing else They ...
1
vote
1answer
107 views

Unable to unsquash from a FW dump

After trying to unsquash a firmware dump from a router without success, I am asking for help. I have a router with a BCM68380 CPU. After desoldering the TOSHIBA NAND chip I dumped the firmware (link ...
1
vote
0answers
103 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
1
vote
0answers
27 views

advice for retrieving functions and tables from intel 8061/8065 bin file (reverse engineering) from Ford EECV ECU

I have under my disposal some Ford EECV bin files and my goal for the next few weeks is to retrieve the functions and tables and plot them out before going onto DIY hardware . . Does anyone know which ...
1
vote
0answers
41 views

Unpacking or split .BIN firmware for router device

Sorry for my question, i'm newbie! so i'm trying to split or unpack this file mobile_update.bin, it is an firmware for routeur device. (Based on qualcomm 9x07 and secureboot device also), i'm trying ...
1
vote
0answers
255 views

USB packet capture; understanding the communication

Good Day- I have captured via Wireshark some data and am attempting to understand it as well as the communication protocol for USB. This one capture contains the sequence 02010c, which tells me the ...
1
vote
0answers
154 views

No false positive on binwalk

I have the same problem from my previous post but this time, I don't think it's the same culprit again as I have solved the problems. This time, I'm very sure I had extracted the firmware. On my ...
1
vote
1answer
228 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
1
vote
0answers
328 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
1
vote
0answers
125 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
1
vote
0answers
351 views

Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate

I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to ...
1
vote
0answers
71 views

TMS320VC5416 DSP firmware reversing

I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers: page: 0000 offset: 0080 len: 0149 page: 0000 ...
1
vote
0answers
403 views

Decrypting the Config file of a Huawei router “HG630 V2”

followed that post from Wordpress https://hg658c.wordpress.com/2017/12/04/decrypting-configuration-files-from-other-huawei-home-gateway-routers/ Extracted the 4 Hex strings needed. But, looks ...
1
vote
0answers
73 views

How can I emulate Huawei routers HG5xx firmware?

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
1
vote
0answers
18 views

Avrdude inconsistent readings

I have a problem with this dude and i don't know what to do to make him do a consistent reading or to figure out which reading is the perfect one I'm trying to read my own arduino uno which has a ...
1
vote
0answers
201 views

Find File System in Firmware

This is my first attempt at working with firmware. We have some SNMP cards that are flaky & my ultimate goal is to try to make them better. The current firmware version is 12.06.0069. When ...
1
vote
0answers
85 views

Need help : restoring a netgear dgn1000 v3 adsl modem/router

coming in from openwrt forum: https://forum.openwrt.org/t/trying-to-rescue-bricked-dgn1000-v3-need-help/36909 currently have serial console but i may have borked the u-boot looking for help on how to ...