Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
25
votes
2answers
59k views

How do I extract a copy of an unknown firmware from a hardware device?

Appreciate it's a broad question, but despite days of Googling I haven't found straight forward explanation of the general principle of how to "capture" or copy an unkown firmware from a piece of ...
21
votes
4answers
18k views

Firmware analysis and file system extraction?

I'm trying to analyse the firmware image of a NAS device. I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
15
votes
2answers
6k views

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
14
votes
1answer
20k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
14
votes
3answers
35k views

Extracting a firmware image via U-Boot

I have a inexpensive Chinese IP-Camera that runs a linux (busybox, to be precise) off a 8-MB SPI flash IC. I'm trying to get access to the device. It has a hardware serial port, and I've gotten ...
13
votes
2answers
18k views

Extract SquashFS filesystem with shsq magic number

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it: DECIMAL HEX DESCRIPTION -----------...
11
votes
4answers
20k views

Binwalk alternative

When examining bin firmware files Binwalk is an extremely helpful tool. There are times though that Binwalk comes up empty and a lot more digging is required to make sense of the data. Are there any ...
11
votes
2answers
1k views

Is there a collaborative reversing forum for people that deal with firmware?

The question pretty much says it. Beyond knowing people that are interested in the same things, is there a collaborative reversing dumping ground for documenting specifically disassembly of closed ...
11
votes
2answers
3k views

What techniques are used in reverse engineering embedded firmware?

This question is related to another question I posted here. I'm working with a small public transit agency on a neat open-source project that will help us to offer realtime data to local developers. ...
11
votes
0answers
491 views

Problems calculating checksum for AirConditioner

I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes. I discovered that the upper and lower nibbles need to be ...
10
votes
1answer
2k views

Finding the actual Thumb code in firmware

I'm planning to buy my first mechanical keyboard, a KBT Poker II, and apart from the physical characteristics of it, another thing that caught my attention is that it sports reflashable firmware! ...
10
votes
1answer
11k views

Emulate TP-LINK WR740N with QEMU

I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the rootfs.img from the firmware, and downloaded vmlinux-2.6.32-5-4kc-malta from here: http://people.debian.org/~aurel32/qemu/...
10
votes
1answer
5k views

Reverse Engineering ZyXel C1100Z modem firmware

first time post so please bear with me. For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck. I have a Zyxel C1100Z DSL modem that I've purchased from ...
9
votes
3answers
8k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
9
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
8
votes
4answers
3k views

What's the easiest way to determine the OS contained in a firmware binary?

I have pulled the Firmware binary from a PPC and have it loaded into IDA. Now I'm trying to determine what operating system it contains but don't know where to start.
8
votes
1answer
1k views

Legality of reverse engineering firmware

Not sure if this is the correct place to post this, but I am having some questions regarding the legality of reverse engineering firmware. Specifically, I was looking into the Nintendo 3DS firmware. ...
8
votes
1answer
8k views

Router Decompiling

I am trying to extract the squashfs filesystem of my router. Here is firmware. First, I unzipped the file. Next, I ran binwalk to get some information about the file. DECIMAL HEX ...
8
votes
3answers
2k views

Reversing Apple Airport Express firmware updates

Apple provides firmware updates for their Airport products through 'Airport Utility'. Firmware files can be downloaded with the help of ~/Library/Application\ Support/Apple/AirPort/Firmware/version....
8
votes
1answer
9k views

How i can extract TP-LINK firmware from squashfs?

I have installed FMK and binwalk. FMK have an old binwalk that does not work. So, I ran a fresh binwalk (from git) as follow: $> binwalk -e wr741ndv4_ru_3_13_2_up_boot(140521).bin And in the ...
8
votes
0answers
864 views

Firmware analysis, can't find file system

I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
7
votes
2answers
2k views

Does a Motorola SREC file give me any additional information over a binary ROM image?

When working with embedded systems, it is often easiest to use a downloadable firmware file rather than recover the firmware from the device. Mostly these are ROM images in the form of a .bin file. ...
7
votes
3answers
2k views

Hauwei E586 firmware

I'm working on unpacking Hauwei E586 MiFi firmware. I downloaded firmware update pack which is available as Windows EXE, then used Hauwei Modem Flasher to unpack real firmware from installer. I've ...
7
votes
1answer
1k views

Reversing DLink DIR100 firmware

I'm trying to extract this firmware but I'm running into some issues. The first lecture of the firmware with binwalk shows this: DECIMAL HEX DESCRIPTION -----------------------------------...
7
votes
1answer
3k views

Unpack Billion 5102 firmware

I'm trying to unpack this firmware image but I'm getting some issues understanding the structure. First of all I have one image which I called firmware.bin, and the file command shows me that it's a ...
7
votes
1answer
6k views

Emulating Routers and other Embedded Devices with QEMU

I'm thinking about reverse engineering a few router models and trying to get them running with QEMU. In particular I'm trying to get the web server running. The current issue I'm thinking might be a ...
7
votes
2answers
3k views

Are there any project based books that teach reverse engineering?

I want to learn to reverse engineer hardware/firmware as well as software (eventually, i want to focus on hardware/firmware now). I have some experience programming STM32 microcontrollers as well as ...
7
votes
2answers
729 views

Best Way to Identify Statically Linked Functions in Firmware

I have a piece of firmware that I pulled off an NXP LPC17XX series chip. Through reviewing the processor manual, I was able to identify the entry point of the code and disassemble the code without any ...
7
votes
1answer
2k views

Reverse engineering Devolo firmware

I am trying to do some reverse engineering to a Devolo dlan wifi 500 device (MIPS architecture). My objective is to put there some firmware modified by me. This is where I got so far: Downloaded a ...
7
votes
2answers
6k views

Trying to decompile hex firmware

I managed to get the firmware for my IoT device but the firmware is in HEX. What is the best way to convert it to a binary so I can use binwalk? So far I've tried converting it with srec_cat hex.file -...
7
votes
0answers
433 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
6
votes
1answer
7k views

lzma: File format not recognized [Details enclosed]

I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized. What am I doing wrong ? First I used binwalk to fetch some details as below : binwalk ...
6
votes
3answers
6k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
6
votes
3answers
4k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
6
votes
3answers
1k views

What is the Ubicom32 toolchain and where can I find it?

I am currently reversing firmware for some device. Without any issues I was able to reach deep into its core and extract the file-system. Now I was trying to reverse some of the special applications ...
6
votes
3answers
6k views

Help reversing end-of-life'd Logitech Link. How to get Flash Contents

See Update below. I got an email from Logitech that they are End of Lifing their Harmony Link product (see https://community.logitech.com/s/question/0D55A0000745EkCSAU/harmony-link-eos-or-eol). So I ...
6
votes
1answer
847 views

Work out if a firmware is dumpable/writeable through USB?

I'm looking to find out if a firmware of a device is readable and potentially writeable. The device has a USB port and other devices by this manufacturer have had firmware updates (through USB) so it'...
6
votes
1answer
5k views

Unsquashfs fails

I'm trying to unsquash a file I retrieved with binwalk. DECIMAL HEX DESCRIPTION -----------------------------------------------------------------------------------------------------------...
6
votes
1answer
539 views

Firmware-Mod-Kit Increases Size

I love using firmware-mod-kid to modify SoHo router firmware. The problem I encounter is that it often bloats the size of the image. It appears this happens during the mksquashfs step. If I'm just ...
6
votes
1answer
574 views

Issues with reversing LZSS compression algorithm

I am trying to reverse engineer my HP printer's firmware, so I dumped the SPI chip from the board, and there are a lot of strings, but almost always look something like this: I noticed a pattern that ...
5
votes
4answers
5k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
5
votes
3answers
11k views

Unpack & repack a firmware for use as an updated version?

I am trying to modify a firmware for TD-W8961ND router because there is a vulnerability that could allow an attacker to download the configuration file of the router which exposes the router password &...
5
votes
1answer
692 views

Stuck on XOR decryption of firmware

TL;DR I have an encrypted image and the cleartext version, and I'm almost certain it's an XOR cipher, but I can't figure out how to decrypt it. I have a few clues listed below. Ciphertext excerpt (...
5
votes
1answer
9k views

Decrypting firmware: Is there a true “format” to it, and how does it differ from decryping other files?

I have firmware for a system and I'm trying to decrypt some of it just for the sake of seeing what it all does; nothing illegal or anything like that, such as reproducing copies of it decrypted and ...
5
votes
1answer
521 views

How can the problem posed for disassembly by the mixture of executable code and literal pools in ARM firmware be overcome?

Context and Background Information Part 1: ARM firmware compared to firmware for other architectures I looked at the ARM firmware in these two questions: Running a binary identified as an ARM ...
5
votes
1answer
3k views

Disassembling VxWorks Firmware

I am trying to disassemble the firmware for the Cisco Sx300 switch as found here: https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76 ...
5
votes
1answer
2k views

Format of .chk firmware package on WGR614v7

Note: I'm aware of the technical and legal implications of reverse-enginneering binaries. I have the firmware for a Netgear WGR614v7 router, in the form of a .chk file, coming from Netgear themselves,...
5
votes
1answer
155 views

Would hiring a RE service be worth it?

Before I clarify my question, I will explain the project I'm working on, and what I've done so far so there will be a better understanding of what I'm trying to do. I'm trying to modify the UI of a ...
5
votes
1answer
452 views

Decoding LZSS buffer lookup indices

I'm working on unpacking a camera firmware file which consists of various sections that I am able to correctly split and validate. One section within this file is additionally compressed with a form ...
5
votes
2answers
1k views

Assistance finding CGI files

I'm wondering if anyone can assist me. I'm reverse engineering netgear r6250 firmware just for practice. I've managed to unpack the firmware using binwalk and in the root directory exist the www ...

1
2 3 4 5
8