Questions tagged [firmware]

Combination of executable code and data used to drive hardware devices and provide a first layer of software services prior to the operating system. Typical examples are BIOS, UEFI, the software running in a DSL router or a mobile phone.

Filter by
Sorted by
Tagged with
5
votes
1answer
1k views

Is there a way to copy a flash drive's firmware?

I'm pretty new to this subject, but I read up on BadUSB and Psychson, and think that they are incredibly cool projects. It got me thinking that I'd like to delve into the depths of USB and see where ...
3
votes
2answers
6k views

How to extract N150R firmware from .img file

I'm trying to mount an img file for my wireless router firmware but I can't seem to do it successfully. When I fun the file command on that .img it returns the following: $ file file.img file.img: ...
1
vote
2answers
1k views

Modifying / Installing stock firmware on ISP Branded WRE2205

Our ISP, MWeb, gave us a free router and Wifi extender (WRE2205v2) as part of a new promotion. Neither of them really work at all (the extender works for about a minute then fails for no apparent ...
0
votes
1answer
2k views

Windows CE + Itron RTOS image

I'm working on unpacking a firmware image, I managed to uncompress the original image but I'm stuck in the current step. First of all this is the current uncompressed image: https://www.dropbox.com/s/...
2
votes
1answer
2k views

Non standard LZ77 compression header

I'm working on reversing the SJ4000 camera firmware but I found a problem unpacking it. This is the header I found on the image: 00000000 42 43 4c 31 81 66 00 09 00 54 68 e0 00 2f 2b bf |BCL1.f......
3
votes
2answers
2k views

Weird binwalk output on GoPro Firmware

I'm trying to extract GoPro hero 3+ camera firmware but I'm getting a weird output from binwalk. This is the binwalk output (Uploaded to pastebin): http://pastebin.com/raw.php?i=yVZFGZT6 As you ...
4
votes
2answers
648 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
1
vote
0answers
332 views

Why the extracted content differs?

I used binwalk to extract firmware.bin image, the extracted content is squashfs-root dir, and a separate dpc.squashfs file. Then I used sasquatch utility to extract content of dpc.squashfs file, and I ...
1
vote
1answer
178 views

Monochrome image replacement within firmware

Hopefully I can find someone who can help me with this. I have become fascinated with electronic cigarettes and one of the more popular regulated chips for sale tout's its ability to change logos. ...
1
vote
1answer
1k views

Firmware encrypted with Openssl [closed]

I managed to copy the Firmware out of a device and tried to extract to content with binwalk but the Signature tells it's encoded with OpenSSL Which are the possible ways to find out which type of ...
14
votes
3answers
32k views

Extracting a firmware image via U-Boot

I have a inexpensive Chinese IP-Camera that runs a linux (busybox, to be precise) off a 8-MB SPI flash IC. I'm trying to get access to the device. It has a hardware serial port, and I've gotten ...
1
vote
0answers
606 views

How to get frame sync signal from a GoPro Dual HERO System sync cable? [closed]

I need to frame sync a GoPro Dual HERO System with an external data logger. So the main problem is to get the HERO frame synchronization signal (I guess there must be one in the cable) from their ...
10
votes
1answer
2k views

Finding the actual Thumb code in firmware

I'm planning to buy my first mechanical keyboard, a KBT Poker II, and apart from the physical characteristics of it, another thing that caught my attention is that it sports reflashable firmware! ...
2
votes
0answers
629 views

Flashing NVRAM with U-Boot 1.2.0

I tried to program SPI Flash NVRAM (S25FL064A) from U-boot, but it not allow to write: tftp 0x80000100 nvram.bin cp.b 0x80000100 0x007b0000 0x00050000 There is no error shown after cp.b command, ...
1
vote
1answer
1k views

Erase the data from the NVRAM

Cable modem SPI Flash memory have the following structure: 7 cmdlinepart partitions found on MTD device spansion partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) } ...
1
vote
1answer
825 views

In-circuit programming of SPI Flash memory

Is it possible to define (using only visual inspection of PCB and multimeter) whether or not SPI Flash memory can be properly programmed keeping the device In-circuit, without desoldering IC from the ...
2
votes
2answers
1k views

USB programmer for SPANSION S25FL064P flash memory

Can someone recommend a handy inexpensive USB programmer for SPANSION S25FL064P flash memory?
3
votes
0answers
393 views

How is the tp-link switch firmware obfuscated?

I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one. ...
1
vote
2answers
583 views

I found the .bin firmware for my Simple.TV device. Binwalk comes up blank. Anything I can do?

While poking around at the headers and such from my new Simple.TV DVR, I found it downloading a file named rssflash_1035_201311211539.update00.bin. I ran binwalk to look for anything obvious, but it ...
4
votes
3answers
9k views

Dumping firmware through mtdblock device

This is my first attempt at doing some reverse engineering. I'm trying to dump the filesystem off a huawei hg523a TalkTalk router. The problem is its quite limited in the amount of programs that are ...
3
votes
2answers
5k views

STM32 DFU tools for Windows

I'm currently investigating an embedded system with a STM32F4-model. I'm able to enter in DFU mode and use the dfu-util. I'd also like to use STM32's original Dfuse tools, just for completeness sake. ...
4
votes
2answers
1k views

Image base of unknown file format?

As a beginner I'm trying to load an unknown format binary file with IDA Pro,but I don't know the Image Base of this file. Are there any methods to get the Image Base. Could you also reference related ...
5
votes
3answers
10k views

Unpack & repack a firmware for use as an updated version?

I am trying to modify a firmware for TD-W8961ND router because there is a vulnerability that could allow an attacker to download the configuration file of the router which exposes the router password &...
5
votes
1answer
2k views

Format of .chk firmware package on WGR614v7

Note: I'm aware of the technical and legal implications of reverse-enginneering binaries. I have the firmware for a Netgear WGR614v7 router, in the form of a .chk file, coming from Netgear themselves,...
2
votes
1answer
258 views

How can I figure where my router stores it's configuration across reboots?

I'm currently researching my home router (D-Link 2760-U) which has a (kind-of) proprietary ISP firmware. What I'm trying to achieve is understanding how the router is persisting it's configuration ...
10
votes
1answer
11k views

Emulate TP-LINK WR740N with QEMU

I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the rootfs.img from the firmware, and downloaded vmlinux-2.6.32-5-4kc-malta from here: http://people.debian.org/~aurel32/qemu/...
4
votes
1answer
856 views

Unpacking a Digi Connect ME bin file

I'm working with a Digi Connect ME serial to Ethernet bridge, which runs a "Plug and Play" firmware by default. The specific product page is here. The part number is DC-ME-01T-S. It appears to be an ...
7
votes
1answer
8k views

Router Decompiling

I am trying to extract the squashfs filesystem of my router. Here is firmware. First, I unzipped the file. Next, I ran binwalk to get some information about the file. DECIMAL HEX ...
1
vote
3answers
2k views

Generate a sig file from ELF executable

I have a mipsel executable (DvdPlayer from a RTD1283 firmware). I know that IDA is able to identify many functions. Then, I would like to generate a .sig file with signatures of these functions for ...
1
vote
1answer
588 views

How to dump the bootloader of NetBSD router?

I recently acquired root access to an Apple Airport Express router (2nd gen), and I would like to dump the current bootloader of the device to a .bin file I suppose. What tools would be necessary for ...
-4
votes
1answer
667 views

what is the best debuger for firmware router ? [closed]

down vote favorite i need debugger for firmware router ,i work in security of firmware so when i have firmware for router or other machines but i need to debug this firmware , so i need firmware ...
2
votes
2answers
1k views

SJ1000 ActionCam firmware

I want to modify the mentioned camera firmware (SJ1000). The binary (.bin) firmware file can be downloaded from archive.org. I used binwalk to scan the binary, but I'm stuck. The binwalk signature ...
24
votes
2answers
56k views

How do I extract a copy of an unknown firmware from a hardware device?

Appreciate it's a broad question, but despite days of Googling I haven't found straight forward explanation of the general principle of how to "capture" or copy an unkown firmware from a piece of ...
3
votes
2answers
3k views

How to determine if binary has symbol table

Is there a practical way to find if the raw binary (firmware image for example) has symbol table ? Finding start or end of it ? And if it exists is it a single block or can it be seperate multiple ...
3
votes
1answer
294 views

Reversing a router, single user mode

I'm trying to reverse engineer a binary running on a zyxel router. My first approach would have been to change the password within the .bin firmware itself, but as seen here, I'm having some trouble ...
5
votes
1answer
4k views

Unsquashfs fails

I'm trying to unsquash a file I retrieved with binwalk. DECIMAL HEX DESCRIPTION -----------------------------------------------------------------------------------------------------------...
1
vote
0answers
369 views

What other public firmware/reverse engineered alternatives are available to replace stock firmware? [closed]

Recently I have taken an interested in learning about Linux and the Unix family of operating systems. In my quest to do so I found that my simple home router contained hardware capable of much more ...
8
votes
3answers
2k views

Reversing Apple Airport Express firmware updates

Apple provides firmware updates for their Airport products through 'Airport Utility'. Firmware files can be downloaded with the help of ~/Library/Application\ Support/Apple/AirPort/Firmware/version....
3
votes
1answer
2k views

How extract this firmware file?

I need extract this firmware file. I tried firmwaremodkit and binwalk. It founds two trx headers, but cannot open it.( delete start in hexedit and untrx throws segfault, fmk found nothing)... ...
4
votes
1answer
777 views

How to unpack a TFTP file with Firmware

I have 2 files but I have no idea, how to unpack them. 239113254011.ldr 239113254012.krn Inside is a Firmware for ADB(iCan)3800TW used in Italy. We need to unpack it and delete the root password. ...
7
votes
1answer
1k views

Reversing DLink DIR100 firmware

I'm trying to extract this firmware but I'm running into some issues. The first lecture of the firmware with binwalk shows this: DECIMAL HEX DESCRIPTION -----------------------------------...
6
votes
3answers
5k views

unpack Clear spot .bin firmware update

I am trying to unpack a clear spot firmware update The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on ...
7
votes
3answers
2k views

Hauwei E586 firmware

I'm working on unpacking Hauwei E586 MiFi firmware. I downloaded firmware update pack which is available as Windows EXE, then used Hauwei Modem Flasher to unpack real firmware from installer. I've ...
6
votes
3answers
1k views

What is the Ubicom32 toolchain and where can I find it?

I am currently reversing firmware for some device. Without any issues I was able to reach deep into its core and extract the file-system. Now I was trying to reverse some of the special applications ...
20
votes
4answers
17k views

Firmware analysis and file system extraction?

I'm trying to analyse the firmware image of a NAS device. I used various tools to help the analysis (binwalk, deezee, signsrch, firmware-mod-kit which uses binwalk AFAIK), but all of them have been ...
4
votes
1answer
4k views

How to reverse CGI file for MIPS?

I'm trying to load a CGI file to IDA in order to disassemble it and understand it's behaviour but I can't do it. According to the strings command I can see some interesting words like system, sprintf,...
7
votes
1answer
3k views

Unpack Billion 5102 firmware

I'm trying to unpack this firmware image but I'm getting some issues understanding the structure. First of all I have one image which I called firmware.bin, and the file command shows me that it's a ...
13
votes
2answers
16k views

Extract SquashFS filesystem with shsq magic number

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it: DECIMAL HEX DESCRIPTION -----------...
4
votes
1answer
3k views

Find file signatures inside an unknown file

I have a .bin file I would like to analyse. Especially find images embedded in this firmware update. binwalk couldn't find anything. What other tools do you know to search for possible embedded ...
7
votes
2answers
2k views

Does a Motorola SREC file give me any additional information over a binary ROM image?

When working with embedded systems, it is often easiest to use a downloadable firmware file rather than recover the firmware from the device. Mostly these are ROM images in the form of a .bin file. ...

1
4 5 6
7
8