Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
0
votes
0answers
87 views

Obfuscated and/or encrypted firmware?

I own 3 samples file of a firmware but I can't determine if it's obfuscated and/or encrypted. Could you give some hint about it? Here is the following samples: Sample 1 Sample 2 Sample 3
0
votes
2answers
195 views

Help in reverse engineering cheap chinese drone wifi camera module

Hello I have an camera module of cheap wifi drone and want to reverse engineer it , but the on searching the ic number on it I couldn't find it.It has an UART and i tried connecting to usb to uart but ...
0
votes
1answer
196 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
0
votes
0answers
64 views

How to dump firmware from an SD card?

I have an SD card that implements some strange Write-Once-Read-Many technology that I want to check the firmware of. I'm not new to reverse-engineering, but I've never dumped firmware from an SD card ...
0
votes
1answer
71 views

Need some help and advices as regards as reverse engineering IoT devices

Hi everyone, I saw this video on youtube as regards as reversing IPTV cameras and finding security vulnerabilities: Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker I ...
0
votes
0answers
43 views

Unknown 160bit challenge-response (36V ebike battery protocol)

I'm currently trying to build a custom battery pack for an electric bike. The bike uses 36V batteries from Panasonic (also sold under OEM brands Victoria, Kalkhoff, Rahleigh, Flyer, Kettler). We'...
2
votes
0answers
201 views

How can I modify files in a jffs2 image

I'm working with the firmware of SIP phone. I extracted the JFFS2 file system image from the firmware and mounted it using modprobe ike this: sudo modprobe mtdram total_size=36360 sudo modprobe ...
0
votes
0answers
135 views

Trying to extract an uncompressed Filesystem uImage

I'm trying to explore the firmware (Huawei LiteOS) of a Hi3518-based IP camera. From my explorations, it seems to be an uncompressed & unencrypted filesystem image but I can't seem to access the ...
4
votes
2answers
503 views

Function prototypes given by Ghidra is not consistent

This is a follow up question to the question I posted over here. According to the answer, I was able to get all the function prototypes from the binary. However, the problem I am having is most of the ...
1
vote
1answer
383 views

Way to get all the function prototype using Ghidra

I have been trying to extract the function prototypes from a binary file using Ghidra. Up till now what I have done was to use Ghidra's included "Decompile" script and filtered out the function ...
0
votes
0answers
172 views

Problem rebuilding firmware

I'm new to reverse engineering. I only want to add an app to my sat receiver. To start I tried to extract my firmware with ./extract-firmware, it's ok, and I have 1 ecos RTOS, and two cramfs in fmk/ ...
3
votes
3answers
671 views

Way to get basic blocks of a binary using Ghidra

I am using ghidra to do some reverse engineering of an ARM binary. I am wondering whether there is a way to get the basic blocks related to all the listing. Is there a function through the IDE or a ...
2
votes
1answer
317 views

Tons of error bookmark on Ghidra

I'm new to Ghidra so go easy on me. Running it on Windows. After successfully extracting a Bluetooth door lock's firmware from a nRF51, I proceeded to decompile it using Ghidra. My aim is to able to ...
1
vote
0answers
154 views

No false positive on binwalk

I have the same problem from my previous post but this time, I don't think it's the same culprit again as I have solved the problems. This time, I'm very sure I had extracted the firmware. On my ...
0
votes
0answers
96 views

Loading garmin Foretrex 601 firmware into IDA Pro

I'm trying to load a Foretrex 601 firmware into IDA pro (fw_all.bin) But I have no idea how to do so since is a ARM architecture and it not drag&drop like x86/x86 arch. The GCD file can be ...
1
vote
2answers
151 views

Intel ME partitions EFFS and FCRS?

What is the purpose of partitions EFFS and FCRS on systems with Intel ME 8.x? Is it currently possible to parse data in EFFS partition on a ME image? I hope anyone can help, there is so little ...
1
vote
1answer
229 views

Can a secondary UART be used to access the MCU?

I have a gamepad with a Chinese ShanWan BM-729 SWQP179 22 MCU which is most likely a clone but i didn't manage to find any info on it. The board is also lacking information like serial pins and the ...
0
votes
0answers
78 views

Approaches to detect (compressed) audio in firmware

Edit: The audio data is on a separate IC There are a few seconds of audio in a toy's 128 kB firmware - somewhere... Here is a downsampled look at the bits (white = 1): My beginner's attempts to ...
1
vote
1answer
43 views

Help with IDA pro please — functions made are not Xref'ing to the caller

I am reversing some Motorola 9s12 (68hc12) code and using IDA pro. I am having the strangest issue. The code makes a call to a function: ROM:B300 call $BFF7, #$FE when I go to ...
0
votes
1answer
83 views

Is it possible to reverse engineer a minelab metal detector? [closed]

Minelab have a metal detector called the equinox, there are 2 models which are essentially the same apart from the price. The minelab equinox 600 is the cheaper model The minelab equinox 800 is the ...
1
vote
0answers
330 views

Analyzing firmware image (eCos with YAFFS)

I'm trying to apply some of the practices I learn in class and online and reverse engineer the firmware of a Chinese dash camera. I've downloaded the firmware from their website (Smart dash camera: ...
1
vote
1answer
518 views

How to make sense of RTOS in firmware?

I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...
5
votes
1answer
555 views

Stuck on XOR decryption of firmware

TL;DR I have an encrypted image and the cleartext version, and I'm almost certain it's an XOR cipher, but I can't figure out how to decrypt it. I have a few clues listed below. Ciphertext excerpt (...
2
votes
2answers
167 views

BIOS first jump leads to empty memory

I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
0
votes
1answer
76 views

Is it possible to read a device's firmware or internal programming in computer's RAM?

Let us say I want to reverse engineer a PCIe-based FPGA device. Can I read or extract the IP core or any firmware in the computer's RAM or by trying to communicate with the device in some way?
2
votes
0answers
674 views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
1
vote
0answers
125 views

Extract files of a SquashFS Filesystem

I already asked a similar question but after a deeper analysis of the filesystem I found out that I misunderstood the problem and that's why I decided to delete the old question and make a new one. I ...
0
votes
1answer
85 views

Is it possible to extract the binary firmware of a feature phone? [closed]

I am new at reverse engineering but very eager to learn. I have a feature phone it5081 and downloaded it's binary firmware. I have googled and came to know about tools like binwalk,firmware mod kit as ...
2
votes
1answer
443 views

Analysis of BusyBox Shell router U-Boot firmware

I am trying to get access to the BusyBox Shell and if possible to get a firmware dump. The "U-Boot" has limited possibilities but what is good is "sf - SPI flash sub-system". Can anyone help me get ...
1
vote
1answer
366 views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
1
vote
0answers
353 views

Dumping firmware from Winbond W25Q64JVSSIQ using BusPirate

I have a Winbond W25Q64JVSSIQ flash chip that supports SPI. I've connected BusPirate through a SOP8 cable to the memory chip. PWR and VREG LEDs are on, so they're connected. BusPirate is connected to ...
3
votes
0answers
81 views

Uniden FW Hacking

I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly. FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
0
votes
0answers
135 views

How can I find loading adress of eCos firmware

From:https://www.tendacn.com/en/download/detail-3482.html Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside ...
3
votes
1answer
138 views

What, tools do I need to break down the N64 console for private study? [closed]

Alright, I need to know this ASAP, I'm breaking down my own n64 console for private study on the n64 firmware and how it does what it does best. So, what tools would I need To break down this console?...
1
vote
0answers
71 views

TMS320VC5416 DSP firmware reversing

I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers: page: 0000 offset: 0080 len: 0149 page: 0000 ...
2
votes
0answers
166 views

Reversing a firmware update for an LG HTS

I'm trying to reverse a firmware update for an LG Home Theater BH7220, and I've hit a brick wall. This HTS has a main chip from LG referred to as "BH7000:1165" in the schematics. The chip has the ...
1
vote
1answer
306 views

Reversing a key-gen firmware for RISC-V

I would like to study this firmware for Sipeed MAix, a RISC-V development board. You can download it here: key_gen_v1.2.zip. As the name suggests, its purpose is to calculate and print a "machine key"...
2
votes
1answer
193 views

Identifying ROM segment in unknown firmware update file

I am working on reversing a firmware update from a FujiFilm FinePix S1800 camera. So far I have managed to identify the instruction set (ARCompact) and dump a few things from the camera using the ...
1
vote
1answer
270 views

Dumping USB firmware [closed]

How do I dump the firmware of a USB stick? What are the steps and what tools do I need? I understand that I may have to take the USB stick apart.
1
vote
2answers
811 views

CSR DFU File Format

I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question ...
1
vote
2answers
348 views

Way to know if firmware is compressed

I dumped a wifi firmware of ps3 console but it seems that this firmware is compressed. Here you can have some informations : https://www.psdevwiki.com/ps3/Wifi_Firmware What can I do to decompress it ...
0
votes
1answer
42 views

Multiple memory regions mapped to same data

I'm analyzing a Seagate HDD that provides a serial boot console that allows reading/writing bytes to memory and setting an address pointer. There's a block of memory from 0x0 to 0x20000 and then it ...
2
votes
1answer
806 views

Problem with analyzing a JFFS2 Filesystem

I extracted the content of a NAND Flash and analyzed it with binwalk. Binwalk showed me that the dump contains a big endian JFFS2 filesystem. My next step was extracting the files into a directory. To ...
0
votes
0answers
365 views

How to repack reverse-engineered router firmware?

I managed to unpack the filesystem contents of a TP-Link router .bin file using binwalk, dd and unsquashfs. The squash FS was at the end of the bin file, the part before having a relatively large lzma ...
1
vote
1answer
134 views

SD card microcontroller

I have an SD card that I want to copy the firmware / memory from, my question is what pinouts do I connect to the SPI programmer and what are the commands to copy all of the firmware /memory. Thank ...
2
votes
1answer
104 views

Odd jsr destination in SuperH disassembly w/ Ghirda

I'm reverse engineering firmware from an old sampler/groovebox that uses a Hitachi SuperH-3 7706 processor, making great progress. Out of the 8M or so of code, everything looks and lines up correctly....
0
votes
1answer
113 views

Found a lot of function names in firmware dump. Is it possible to recreate original code?

I'm using IDA PRO 5.0 Free to analyze firmware from a camcorder (mn103 processor). I'm a complete newbie in reverse engineering so it's hard for me to learn how it works only using assembly code. I ...
0
votes
0answers
350 views

How do I decompile/modify a .dfu file?

I'm trying to get my old 3D printer to work with wifi again. A while ago the company was shut down and the printer relied on their website for print queues and stuff, so now the only way to use the ...
1
vote
1answer
262 views

Loading 8051 binary to IDA with ROM+External RAM configuration

I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses: In this example the ROM size is ...
1
vote
2answers
426 views

Using NAND flash dump with OOB data

I have NAND flash memory dump, as a separate MTD partitions copied from NAND flash chip use built-in nanddump commands. I need to reflash some corrupted MTD partitions. In order to reflash partitions ...

1
2
3 4 5
8