Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
2
votes
1answer
3k views

Entry point for STM32 firmware

I'm trying to disassemble a firmware for a DIY project, open hardware but closed firmware. My question is how to initialize the disassembler properly (Hopper Disassembler). The values I try to figure ...
1
vote
1answer
818 views

Rebuilding firmware back to binary file

I used Binwalk to extract firmware files, extracted content include 2 folders and one binary file. squashfs-root _351C.extracted 351C Squashfs-root contains file system, '_351C.extracted' folder ...
1
vote
1answer
151 views

How to check proprietary firmware for GPL violation

I have a proprietary binary (firmware), and I'd like to check whether it contains opensource components. I'm thinking about extracting what it contains - probably binaries - and use strings, grep and ...
1
vote
0answers
143 views

Difficulty decrypting nested PKCS #7 / AES router configuration file

I am trying to decrypt a router configuration backup file that appears to be a combination of a 128-byte header, a PKCS #7 encrypted file, and another OpenSSL salted format encrypted file. I think ...
0
votes
1answer
2k views

Unpacking firmware

I have a ROM dump firmware which must be reversed (as a task). Binwalk output: DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------...
0
votes
1answer
476 views

Unpacking ROM dump

I have a ROM dump from an unknown controller, which must be reversed (as a task). It looks like encrypted, packed or obfuscated. Binwalk did not give any information("cisco os experimental microcode ...
4
votes
1answer
343 views

Decoding LZSS buffer lookup indices

I'm working on unpacking a camera firmware file which consists of various sections that I am able to correctly split and validate. One section within this file is additionally compressed with a form ...
5
votes
1answer
2k views

Disassembling VxWorks Firmware

I am trying to disassemble the firmware for the Cisco Sx300 switch as found here: https://software.cisco.com/download/release.html%3Fmdfid%3D283019611%26softwareid%3D282463181%26release%3D1.2.7.76 ...
1
vote
1answer
1k views

How can I convert a .bin file to either assembly or C?

I have a .bin file (It's a firmware belongs to a hardware (Cisco Access-Point) ). All I need to do is modifying that .bin file. As you know, .bin files aren't human readable. I need to convert it to ...
7
votes
2answers
2k views

Are there any project based books that teach reverse engineering?

I want to learn to reverse engineer hardware/firmware as well as software (eventually, i want to focus on hardware/firmware now). I have some experience programming STM32 microcontrollers as well as ...
4
votes
2answers
1k views

Is there a method for “guessing” the addresses for unknown areas in bare metal firmware binaries?

Imagine this: You have a binary for a piece of ARM firmware. You are nearly 100% it is ARM, and that it runs on the bare metal. You obtained this firmware from a manufacturers update page. However, ...
1
vote
1answer
77 views

Redirecting Program Output from /dev/*char_device* to Text File

I am currently trying to reverse an IoT machine running the 2.6 Linux Kernel on which I have root. On this machine, software writes to /dev/some_device to control what I believe to be are GPIO pins ...
6
votes
3answers
6k views

Help reversing end-of-life'd Logitech Link. How to get Flash Contents

See Update below. I got an email from Logitech that they are End of Lifing their Harmony Link product (see https://community.logitech.com/s/question/0D55A0000745EkCSAU/harmony-link-eos-or-eol). So I ...
0
votes
2answers
1k views

binwalk on reversing switch firmware

everyone. I am a green apple in reversing. Recently i wanna reverse a switch but get some problems. i reaaaaaaaaly need your guys help. first i extract the .bin file from the switch and use binwalk ...
2
votes
2answers
1k views

How to unpack the Fortigate firmware?

I want to unpack the fortigate firmware - FGT_110C-v400-build0092-FORTINET.out. binwalk only gives a hint about gzip compressed data. ~/Documents# binwalk -i FGT_110C-v400-build0092-FORTINET.out ...
3
votes
3answers
4k views

Speedport entry 2i zte home router's firmware

I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(it's an ISP's speedport entry 2i router(zte variant)). So long story ...
0
votes
1answer
1k views

Disassembling Hikvision DVR firmware?

The firmware update page on Hikvision provide .dav files. I've been trying to disassemble these files, but to no success. Binwalk isn't helping here as well. This is what it outputs: Here's a link ...
4
votes
0answers
214 views

How to perform manual flashing of a bricked device?

I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
1
vote
1answer
115 views

Strange bytes in interrupt table

I am currently learning ARM assembly by trying to reverse a broken printer. I retrieved the firmware from the on board NAND flash and I am now trying to make some sense of it. However, I get stuck at ...
9
votes
0answers
2k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
1
vote
1answer
854 views

Find changes between two UEFI firmware versions?

I have saved a copy of the UEFI firmware currently running on my motherboard through the built-in flash utility. Now I want to compare the firmware dump with the newest firmware update from the ...
2
votes
1answer
499 views

Dump firmware from MC9S08EL32 MCU

I have a datasheet of the HCS08 micro-controller family from NXP. I have a Raspberry Pi and some time. I admit that this is my first time delving this deep into hardware RE, so be gentle with me. I ...
1
vote
1answer
182 views

library issue when running mips binary in a chrooted environment

Background In my endeavor to RE my router, I'm trying to emulate a router's firmware inside a QEMU MIPS system. I have debian-mips installed to a virtual disk that runs just fine. Its a MIPS32 Big ...
1
vote
1answer
564 views

Network support when emulating firmware with QEMU

Continuing from this question: Firmware analysis and file system extraction? I am trying to run the QNap firmware using QEmu. I have basically the same firmware as is used in the question above. My ...
1
vote
1answer
6k views

Need help extracting JFFS2 filesystem from .img firmware binary

I'm trying to access the filesystem of the EA2750's firmware. Here is a link to download it http://downloads.linksys.com/downloads/firmware/FW_EA2750_1.1.7.172380_prod.img. The problem is it is an img ...
1
vote
1answer
742 views

Help reverse engineering Linksys E1200 router firmware

I was able to download Linksys E1200 router firmware, which I would like to reverse engineer. I believe it is running some sort of Linux/Unix based firmware and may be running on an ARM CPU. I have ...
10
votes
1answer
4k views

Reverse Engineering ZyXel C1100Z modem firmware

first time post so please bear with me. For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck. I have a Zyxel C1100Z DSL modem that I've purchased from ...
0
votes
3answers
727 views

OBD II scanner reverse engineering

Newbie here. I'm working on an OBD II scanner and have made a hardware using STM32. It uses its inbuilt peripherals to communicate with the OBD bus (like CAN, K-Line, etc). Question: Are there any ...
1
vote
1answer
952 views

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

Issuing some commands for the dumped firmware: $ du -h fw.bin 4.0 M $ file fw.bin fw.bin: data $ file -i fw.bin fw.bin: application/octet-stream; charset=binary $ binwalk fw.bin - $ enca -L none ...
4
votes
2answers
1k views

Assistance finding CGI files

I'm wondering if anyone can assist me. I'm reverse engineering netgear r6250 firmware just for practice. I've managed to unpack the firmware using binwalk and in the root directory exist the www ...
4
votes
1answer
412 views

How can the problem posed for disassembly by the admixture of executable code and literal pools in ARM firmware be overcome?

It's probably too soon for me to ask about this since I'm not familiar with ARM but it's been bothering me for a while now so I'm going to ask anyway. Context and Background Information Part 1: ARM ...
5
votes
3answers
3k views

Running a binary identified as an ARM excutable by binwalk --disasm

I have a Philips 10FF2 picture frame I'm trying to reverse engineer. In the firmware download from the Philips website (http://download.p4c.philips.com/files/1/10ff2cme_00/10ff2cme_00_fus_aen.zip) I ...
3
votes
1answer
223 views

Netgear n300 auth bypass vulnerability

I was looking at writeup on Netgear N300 authentication bypass vulnerability and I have found some inconsistencies in the article with my understanding of it. I want a second opinion on this because I'...
1
vote
1answer
991 views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
6
votes
1answer
5k views

lzma: File format not recognized [Details enclosed]

I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized. What am I doing wrong ? First I used binwalk to fetch some details as below : binwalk ...
1
vote
0answers
654 views

ZyXEL P-2812HNU-F1, replacing the U-Boot on the board

I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider). To do this, I should first replace the U-Boot image ...
14
votes
2answers
5k views

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
13
votes
1answer
18k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
1
vote
1answer
1k views

Basic clarifications about .hex and .bin file

I am newcomer to this field. I would like to understand how these things work and what these file contain (and if I'm on the right path). To explain my doubts, I will use the .hex file posted in a ...
7
votes
3answers
6k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
2
votes
2answers
423 views

Anyone recognize this variant of Intel HEX firmware format?

I've got a firmware file for an ARM Cortex-M0+ that is in a format extremely similar to Intel HEX. All data is encapsulated in a 0x3a ... 0xa wrapper. The fields seem to mostly match the 16 bit ...
1
vote
1answer
198 views

DLink LIF firmware: Error reading block 1191378964 from file. (Success)

I'm trying to look inside some D-link modem firmware using a LIF image. I get: v@debian:~/lifutils# src/progs/lifstat /home/v/Downloads/DSL-25 Volume : �SI Tracks: 0 Surfaces: 0 Blocks per Track: 0. ...
0
votes
1answer
987 views

Extract firmware from STM32F030 using ST-Link clone

I have a Finger pulse oximeter and inside I found a STM32F030C8T6 MCU. I'm looking to replace the firmware with one of my own. Is it possible to dump the current firmware and restore it, perhaps even ...
-1
votes
1answer
2k views

How to extract D-Link DCS-4603 camera firmware

I tried extract the firmware image from the binary file available at the D-Link DCS-4603 Vigilance Full HD PoE Dome Network Camera technical support page it by using binwalk but failed. Is there ...
0
votes
1answer
351 views

How to dissassemble Cypress MCU based firmware?

I have a firmware in bin format belongs to Cypress CY7C638xx based gadget. This chip is Low Speed USB Peripheral Controller containing a 8-bit MCU. I would like to analyse that firmware to reverse it....
1
vote
0answers
806 views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
5
votes
4answers
4k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
1
vote
2answers
1k views

How to determine architecture from firmware file

I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp. Here's a link to ...
1
vote
3answers
2k views

How to extract content of NVRAM file?

How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash. NVRAM has been copied as mtdblock partition. An embedded device that run Linux v2.6.18_pro500. Linux version 2.6.18_pro500 ...
3
votes
1answer
14k views

Decompressing zImage

I have a firmware that I've dumped from a phone. I found a uImage header and a zImage after running binwalk. The header says that the image is uncompressed, however I've read that zImages are usually ...

1 2 3
4
5
7