The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
0
votes
2answers
871 views

Memory dump analysis

I'm trying to learn firmware analysis. The device I chosen was my Motorola SBG901 modem. I managed to dump the memory contents via JTAG using the FlashcatUSB adapter. The memory dump is about 8MB in ...
3
votes
2answers
1k views

Flashing firmware on an embedded device

Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge) I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing ...
2
votes
0answers
524 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
0
votes
1answer
269 views

Understanding bootlog load address

I was looking at the bootlog for the WAG160N found here: https://wiki.openwrt.org/toh/linksys/wag160n and I wanted to clarify how the booting works. *Boot Address 0xbfc00000 Total memory used by CFE:...
1
vote
1answer
3k views

How to find Bootloader Load Address?

I've followed the tutorial found at: http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/ I've loaded the uboot image into IDA, but I'm not sure how to determine the load ...
1
vote
2answers
2k views

How to extract the OS files from this firmware bin file

I am trying to change settings of one modem we have in work. I tried binwalk and FMK and they cannot extract anything. The output of binwalk seems false positive: binwalk modem.bin DECIMAL HEX ...
1
vote
0answers
566 views

Reverse Engineering Wifi Chip-set Firmware [closed]

I have Sparrow Wireless Adapter which from Qualcomm originally Wilocity that supports Wifi over 60 GHz (802.11ad or WiGiG). I have the firmware files of the wireless chipset (wil6210.fw and wil6210....
6
votes
2answers
3k views

Trying to decompile hex firmware

I managed to get the firmware for my IoT device but the firmware is in HEX. What is the best way to convert it to a binary so I can use binwalk? So far I've tried converting it with srec_cat hex.file -...
2
votes
1answer
591 views

How are the iOS kernel cache and root filesystem decrypted?

On the iPhone Wiki there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?
1
vote
1answer
2k views

Help mounting jffs2 dumped from NAND flash.

Ok so have been trying to look some settings from a jffs2 partition I extracted from a nand dump I had done previously Here ----> https://forum.openwrt.org/viewtopic.php?id=67564 Steps I have ...
4
votes
1answer
236 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
1
vote
0answers
517 views

How can I find loading adress of eCos image

Hey guys Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside of IDA, how can I correctly load it, how to find ...
3
votes
1answer
4k views

Reverse engineering TP-Link TD-W8961N

After following the tutorial here, I decided I would try and reverse engineer my router's firmware. My router is the TP-Link TD-W8961N and the firmware version is V2. I have been trying to figure ...
1
vote
0answers
236 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
3
votes
2answers
1k views

Technicolor TG799vac Modem/Router Dumping The Nand Flash

Ok, so I have been trying to dump the contents of a Technicolor TG799vac. So far I have removed the flash chip and read out the chip using the DumpFlash.py utility and used binwalk to locate the ...
2
votes
1answer
848 views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
2
votes
1answer
7k views

Extracting firmware BIN file

I'm trying to extract this firmware to check whats inside, but can't find how to tackle this file. I was only able to extract and read PNG image. Binwalk scan: DECIMAL HEX DESCRIPTION ---...
2
votes
0answers
395 views

Reverse Engineering SCE .pkg Files

To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years ...
0
votes
1answer
7k views

Extract firmware of my camera (Lumix MG5)

I bought a Camera (Lumix GM5), but I can't change the language of it. The easy way is to send it back to Amazon, but I want to try to change it by modifying the firmware before. So, I used binwalk ...
0
votes
3answers
3k views

Limited BusyBox shell

I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell. BusyBox v1.19.2 (built-in shell (ash) Enter 'help' for a list of built-in ...
0
votes
1answer
565 views

Fixing weird no-sections embedded ELF binary for decompilation

I recently stumbled upon a weird binary, complied by a "Qualcomm Hexagon" compiler. The ELF binary seems fine, however section tables (section header size and string table index) seem empty. For those ...
0
votes
1answer
1k views

How can I put a Binwalk extracted firmware back into a .bin binary file?

So, I extracted my router's binary file with binwalk and got the filesystem. I made some changes to the WebUI of the router, and now I want to put it back together into a .bin file so that I can flash ...
2
votes
1answer
1k views

Firmware-mod-kit says “No supported filesystem” along with strange and long output

I tried firmware-mod-kit's extract-firmware.sh script and I receive the following output which ends with "No supported filesystem found". The firmware belongs to the TL-WR740Nv5 router. The ...
3
votes
1answer
362 views

SSD firmware reverse engineering materials

Is anybody have materials about SSD firmware reverse engineering? I'm looking for links to suitable forums, papers, presentations etc.
2
votes
0answers
812 views

Ducky Mini Firmware Hacking

This is my first reverse engineering project! I recently bought a Ducky Mini keyboard, which is controlled by an ARM Cortex-M3 SoC (to be specific, a Holtek HT32F1655,) and noticed that other ...
1
vote
2answers
543 views

Dlink DIR 600M firmware decompile issues

How to decompile the CGI & ROM files from the firmware bin? I am able to extract the HTML files using binwalk but the router OS and CGI files are missing. NOTE: Its not the same as DIR 600 ...
1
vote
1answer
879 views

Trying to get shell on embedded device. Analyzed firmware update, listened to Android app, no dice. Suggestions?

I have an ActiveON LX action camera i.e. a GoPro ersatz. It comes with an Android app to control it, and it does so by running its own WiFi AP for the phone to connect. Once the phone connects, it ...
1
vote
1answer
2k views

Reverse Engineer STM32L151's Firmware

I have the STM32L151's firmware that I extracted via JTAG, but I cannot find a start point in IDA. I have tried two methods: 1) I start IDA, drag the binary into the workspace, select ARM Little-...
3
votes
1answer
540 views

Reversal of unknown obfuscation or encryption with known plaintext

Introduction For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
1
vote
0answers
889 views

Decrypting Firmware File

I am by no means a hardware or software expert. But I've got a bit of a dilemma. I have on my hands an "encrypted" firmware image. I say that with air quotes because I'm not sure if it's encrypted, ...
0
votes
1answer
1k views

Extract YAFFS filesystem from binary

Iv got firmware from vivax set-top box backed up on flash drive and I vould like to change splash screen on it. The firmware seem to be yaffs but I cant extract files in order to change something. :~...
2
votes
0answers
1k views

Knockoff CGA/EGA to vga firmware update [closed]

The problem with this, as I know from experience in dealing with this exact same issue is the firmware in the CGA/EGA/VGA converter board. There is an update that needs to be written to the converter ...
2
votes
0answers
709 views

Flash dump with encoded firmware

I downloaded firmware from 4MB spi flash in HDMI extender (more info here). It contains following sections: 0x00000000 – 0x00024e03 – SMEDIA02 …….456789ABCDEF (encoded – some strings suggesting ...
1
vote
0answers
888 views

Modification of existing binary firmware update

I have several IP cameras from china, and I need to add some software to it. I have to ways how to burn my software into camera ROM using hardware programmer and using special binary what I upload ...
8
votes
1answer
5k views

How i can extract TP-LINK firmware from squashfs?

I have installed FMK and binwalk. FMK have an old binwalk that does not work. So, I ran a fresh binwalk (from git) as follow: $> binwalk -e wr741ndv4_ru_3_13_2_up_boot(140521).bin And in the ...
2
votes
1answer
204 views

help getting at encrypted firmware [includes .SMIME and .gz.aes files]

I found firmware for Slingbox 500 by sniffing the outgoing connections it is making. Having trouble making heads or tails of it though. I'd really love to see the filesystem because it's running ...
4
votes
1answer
593 views

Multiple vendors Misfortune Cookie Router Authentication Bypass Exploit

I am working on an exploit over a month now I have a problem and cannot go further. here is the link of the exploit: https://gist.github.com/doorbash/f454c698f192a0e5d1bf4da9c6869b67 https://www....
5
votes
3answers
4k views

QEMU & router firmware

I'm trying to get the router firmware (binary) running on QEMU (if that is possible). All networking is set up fine because I've tested it using the debian_wheezy_mips_standard.qcow2 sudo qemu-...
7
votes
1answer
886 views

Legality of reverse engineering firmware

Not sure if this is the correct place to post this, but I am having some questions regarding the legality of reverse engineering firmware. Specifically, I was looking into the Nintendo 3DS firmware. ...
4
votes
1answer
2k views

Need help extracting YAFFS from firmware .bin file

I've been working on reversing the slingbox firmware. I didn't get anywhere trying to get into a current firmware file (see my other question - appears to be encrypted), so I found a download for an ...
1
vote
1answer
828 views

Where can i download Firmware Reverse Analysis Konsole?

where i can download the latest version of FRAK: firmware reverse analysis konsole; i cannot find the link; is anyhere a good example or tutorial of usage? thanks a lot
2
votes
1answer
2k views

Firmware extraction problems - binwalk is blank

I'm trying to extract the firmware from my set-top box (STB) because I realized its port 22 is open and running dropbear, and I'd like to login to it. Well, because it's there. I've tried binwalk, but ...
2
votes
2answers
4k views

how to bypass CRC checksum in firmware header

I have this Ubiquiti firmware and I successfully extract the firmware and rebuild it, I modify Squashfs filesystem and rebuild it using build-firmware.sh script from firmware-mod-kit, but the problem ...
2
votes
1answer
647 views

Best 3G USB Modem for Reverse Engineering?

My idea is to automate the process of keeping in touch with my server in a portable and internet independent manner. The most optimal solution in my case is an SMS Gateway/Relay because I travel a lot ...
1
vote
0answers
238 views

Unknown firmware header for ARM device [closed]

I've obtained a vendor firmware which I'd like to look at in more detail. It appears to be wrapped in some kind of wrapper that I've never seen before. It's not a DFU footer, or a DfuSe header and I ...
3
votes
0answers
292 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
0
votes
1answer
4k views

binwalk zlib data [closed]

I'm reversing firmware and I get some problem with it. I used binwalk to reversing the firmware, but binwalk produced different result than to my friend. My friend found some zlib data (see 1), but I ...
2
votes
0answers
336 views

Looking to RE a Ducky Shine 5

I know how to program in C++/C# and a few other low level languages. I'm however in the dark about reverse engineering firmware etc. I was wondering if anyone could point me towards some learning ...
3
votes
0answers
981 views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
3
votes
3answers
995 views

Reverse Engineering CD-ROM Firmware

I am trying to write a program for a Mediatek based CD-ROM to write information to CDs in a different manner. I want to be able to control the laser with, or without a CD within. So my question is, ...