Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
3
votes
1answer
225 views

Netgear n300 auth bypass vulnerability

I was looking at writeup on Netgear N300 authentication bypass vulnerability and I have found some inconsistencies in the article with my understanding of it. I want a second opinion on this because I'...
1
vote
1answer
1k views

Trying to identify a string in a strcmp instruction

Working to debug and analyze a piece of firmware, I've come across a bunch of cgi files which are all symlinked to a central cgi file. The first thing the main function does is run a series of string ...
6
votes
1answer
5k views

lzma: File format not recognized [Details enclosed]

I'm trying to extract LZMA compressed data using binwalk but the fetched file is not being recognized. What am I doing wrong ? First I used binwalk to fetch some details as below : binwalk ...
1
vote
0answers
669 views

ZyXEL P-2812HNU-F1, replacing the U-Boot on the board

I want flash regular(non branded) firmware on ZyXEL P-2812HNU-F1 router, which have branded version of firmware (customized for local MSO provider). To do this, I should first replace the U-Boot image ...
15
votes
2answers
5k views

How does a SIM card work?

I understand that a SIM card has memory, and that some or maybe all of them also include microprocessors. They act as peripherals that are more than just flash memory. I would like to be able to ...
14
votes
1answer
19k views

Approach to extract useful information from binary file

The purpose of this question is to gain an understanding of the concepts behind reverse engineering and to understand what approaches may be taken to extract useful information from a binary file. I'...
1
vote
1answer
1k views

Basic clarifications about .hex and .bin file

I am newcomer to this field. I would like to understand how these things work and what these file contain (and if I'm on the right path). To explain my doubts, I will use the .hex file posted in a ...
7
votes
3answers
7k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
2
votes
2answers
456 views

Anyone recognize this variant of Intel HEX firmware format?

I've got a firmware file for an ARM Cortex-M0+ that is in a format extremely similar to Intel HEX. All data is encapsulated in a 0x3a ... 0xa wrapper. The fields seem to mostly match the 16 bit ...
2
votes
1answer
239 views

DLink LIF firmware: Error reading block 1191378964 from file. (Success)

I'm trying to look inside some D-link modem firmware using a LIF image. I get: v@debian:~/lifutils# src/progs/lifstat /home/v/Downloads/DSL-25 Volume : �SI Tracks: 0 Surfaces: 0 Blocks per Track: 0. ...
0
votes
1answer
1k views

Extract firmware from STM32F030 using ST-Link clone

I have a Finger pulse oximeter and inside I found a STM32F030C8T6 MCU. I'm looking to replace the firmware with one of my own. Is it possible to dump the current firmware and restore it, perhaps even ...
-1
votes
1answer
2k views

How to extract D-Link DCS-4603 camera firmware

I tried extract the firmware image from the binary file available at the D-Link DCS-4603 Vigilance Full HD PoE Dome Network Camera technical support page it by using binwalk but failed. Is there ...
0
votes
1answer
371 views

How to dissassemble Cypress MCU based firmware?

I have a firmware in bin format belongs to Cypress CY7C638xx based gadget. This chip is Low Speed USB Peripheral Controller containing a 8-bit MCU. I would like to analyse that firmware to reverse it....
1
vote
0answers
819 views

Trying to dump firmware from embedded flash

I have an Infineon XC161CJ-16F SoC and Micron/ST M29W320EB parallel nor flash memory that I am trying to dump the firmware from but I'm not sure how to proceed. I found JTAG pads that I soldered pins ...
5
votes
4answers
4k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
1
vote
2answers
1k views

How to determine architecture from firmware file

I have a .bin file from a vendors website that I want to walk through with radare2. I've determined that the device has a DRAM chip, a RTL8304 network controller and a DSPgroup dsp. Here's a link to ...
1
vote
3answers
3k views

How to extract content of NVRAM file?

How to extract content from NVRAM file? NVRAM type is SPI Serial NOR Flash. NVRAM has been copied as mtdblock partition. An embedded device that run Linux v2.6.18_pro500. Linux version 2.6.18_pro500 ...
3
votes
1answer
15k views

Decompressing zImage

I have a firmware that I've dumped from a phone. I found a uImage header and a zImage after running binwalk. The header says that the image is uncompressed, however I've read that zImages are usually ...
2
votes
1answer
530 views

How to store files on a router's NAND without writing the whole firmware

I want to modify my ZyXEL P-2812HNU-F1 dsl router by storing some extra files in /etc. However, /etc is mounted as tmpfs so changes are lost on reboot. But there's probably a way around it ;) # cat /...
0
votes
1answer
547 views

Wiring Flash Chip to Raspberry Pi

I'm trying to wire a Winbond W25Q128FV to my Rasberry Pi Model 1B so that I can dump the firmware. I'll be using an SOIC8 clip and probe cables. Here is what I'm thinking: Flash ----- rPi CS ----- ...
2
votes
2answers
9k views

Reverse Engineering a Firmware. Someone can help me?

I am currently trying to reverse-engineer a firmware file to learn the topic but I am a little bit stuck. I tried to use binwalk to get more information about the file but this did not produce ...
1
vote
1answer
1k views

Emulating Non-Linux Firmware Image of Embedded Devices

I've come across multiple questions/tutorials about QEMU emulation of devices running some sort of Linux/Busybox operating system and a file system. However, I'm seeking ways to run ARM-based firmware ...
-2
votes
1answer
138 views

Is it possible to reprogram an android smart phone? [closed]

uhm, I had made a Graphing Calculator program in Python but I wanted to use it in a smartphone so I was wondering is there any way i can reprogram a smartphone, it doesn't matter how hard it will be ...
11
votes
0answers
465 views

Problems calculating checksum for AirConditioner

I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes. I discovered that the upper and lower nibbles need to be ...
0
votes
1answer
183 views

How do I Reverse Firmwares? [closed]

How do I Reverse Firmware? What is firmware binary?
0
votes
1answer
2k views

.bin files Firmware

I'm looking for help in analyzing a few .bin files. I have a program that installs a "firmware" update when I connect my camera through USB. I'm on a Mac Os Sierra. Inside the Applications Folder ...
0
votes
2answers
1k views

Memory dump analysis

I'm trying to learn firmware analysis. The device I chosen was my Motorola SBG901 modem. I managed to dump the memory contents via JTAG using the FlashcatUSB adapter. The memory dump is about 8MB in ...
4
votes
2answers
1k views

Flashing firmware on an embedded device

Anyone want to help out a noob? (excuse my incorrect terminology/ knowledge) I am venturing into unknown territory. The only experience I have is rooting/flashing firmware on my phone and installing ...
2
votes
0answers
613 views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
0
votes
1answer
315 views

Understanding bootlog load address

I was looking at the bootlog for the WAG160N found here: https://wiki.openwrt.org/toh/linksys/wag160n and I wanted to clarify how the booting works. *Boot Address 0xbfc00000 Total memory used by CFE:...
2
votes
1answer
4k views

How to find Bootloader Load Address?

I've followed the tutorial found at: http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/ I've loaded the uboot image into IDA, but I'm not sure how to determine the load ...
1
vote
2answers
3k views

How to extract the OS files from this firmware bin file

I am trying to change settings of one modem we have in work. I tried binwalk and FMK and they cannot extract anything. The output of binwalk seems false positive: binwalk modem.bin DECIMAL HEX ...
1
vote
0answers
636 views

Reverse Engineering Wifi Chip-set Firmware [closed]

I have Sparrow Wireless Adapter which from Qualcomm originally Wilocity that supports Wifi over 60 GHz (802.11ad or WiGiG). I have the firmware files of the wireless chipset (wil6210.fw and wil6210....
6
votes
2answers
5k views

Trying to decompile hex firmware

I managed to get the firmware for my IoT device but the firmware is in HEX. What is the best way to convert it to a binary so I can use binwalk? So far I've tried converting it with srec_cat hex.file -...
2
votes
1answer
655 views

How are the iOS kernel cache and root filesystem decrypted?

On the iPhone Wiki there are decryption keys for several, but not all, of the iPhone firmwares (root filesystems and kernelcache files). How were these keys found?
2
votes
1answer
2k views

Help mounting jffs2 dumped from NAND flash.

Ok so have been trying to look some settings from a jffs2 partition I extracted from a nand dump I had done previously Here ----> https://forum.openwrt.org/viewtopic.php?id=67564 Steps I have ...
4
votes
1answer
262 views

How to make Freescale imx233 mp3 player boot with identical type player firmware.sb?

Goal: 1 - To load a older version of the firmware on the device because it has features the newer version does not. 2 - To set the player up as a multi-boot (U-boot). key press for original OS or my ...
1
vote
0answers
650 views

How can I find loading adress of eCos image

Hey guys Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside of IDA, how can I correctly load it, how to find ...
4
votes
1answer
5k views

Reverse engineering TP-Link TD-W8961N

After following the tutorial here, I decided I would try and reverse engineer my router's firmware. My router is the TP-Link TD-W8961N and the firmware version is V2. I have been trying to figure ...
1
vote
0answers
257 views

All data in IDA Pro turns into zeros when using QEMU

I'm trying to emulate a snippet of ARM assembly I have in IDA pro using QEMU. However I do not understand the output of the program. When I start debugging the firmware, windows pop up for QEMU. ...
3
votes
2answers
1k views

Technicolor TG799vac Modem/Router Dumping The Nand Flash

Ok, so I have been trying to dump the contents of a Technicolor TG799vac. So far I have removed the flash chip and read out the chip using the DumpFlash.py utility and used binwalk to locate the ...
2
votes
1answer
987 views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
2
votes
1answer
8k views

Extracting firmware BIN file

I'm trying to extract this firmware to check whats inside, but can't find how to tackle this file. I was only able to extract and read PNG image. Binwalk scan: DECIMAL HEX DESCRIPTION ---...
3
votes
0answers
481 views

Reverse Engineering SCE .pkg Files

To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years ...
0
votes
1answer
9k views

Extract firmware of my camera (Lumix MG5)

I bought a Camera (Lumix GM5), but I can't change the language of it. The easy way is to send it back to Amazon, but I want to try to change it by modifying the firmware before. So, I used binwalk ...
0
votes
3answers
5k views

Limited BusyBox shell

I'm testing some embedded device, and there is lack of documentation. When I telnet to device, I get only limited shell. BusyBox v1.19.2 (built-in shell (ash) Enter 'help' for a list of built-in ...
0
votes
1answer
923 views

Fixing weird no-sections embedded ELF binary for decompilation

I recently stumbled upon a weird binary, complied by a "Qualcomm Hexagon" compiler. The ELF binary seems fine, however section tables (section header size and string table index) seem empty. For those ...
0
votes
1answer
2k views

How can I put a Binwalk extracted firmware back into a .bin binary file?

So, I extracted my router's binary file with binwalk and got the filesystem. I made some changes to the WebUI of the router, and now I want to put it back together into a .bin file so that I can flash ...
2
votes
1answer
1k views

Firmware-mod-kit says “No supported filesystem” along with strange and long output

I tried firmware-mod-kit's extract-firmware.sh script and I receive the following output which ends with "No supported filesystem found". The firmware belongs to the TL-WR740Nv5 router. The ...
3
votes
1answer
454 views

SSD firmware reverse engineering materials

Is anybody have materials about SSD firmware reverse engineering? I'm looking for links to suitable forums, papers, presentations etc.

1
4
5
6 7 8