Questions tagged [firmware-analysis]

The tag has no usage guidance.

161 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
13 votes
0 answers
558 views

Problems calculating checksum for AirConditioner

I am trying to reverse engineer an AC Indoor unit <-> thermostat communication. So far I've succeeded in parsing the bits and bytes. I discovered that the upper and lower nibbles need to be ...
stinger151's user avatar
10 votes
0 answers
3k views

RE Tplink TD-W8960N V7

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite ...
The Humble Rat's user avatar
9 votes
0 answers
1k views

Firmware analysis, can't find file system

I'm TV repair tech and I've found that corrupted firmware is responsible for the failure of a large portion of the TV's I work on. I came up with the idea that if I could reverse engineer the ...
Swappart's user avatar
8 votes
0 answers
707 views

How do I reverse this firmware? 8-bit handheld console

I recently bought this chinese console that supposedly has 328 8-bit games. I want to understand the code and how it works to hack it and maybe load other ROMs. It has a chip covered in black epoxy ...
Lorenzo Ivan's user avatar
6 votes
1 answer
3k views

Huawei HG8245H, can't read some system files

I have modem Echolife HG8245H (V3R016C10S150). I'm using telnet to connect it. I need to read some files from this modem. There's a shell mode I can enter, but it is nerfed badly: SU_WAP>shell ...
HE9CbITb's user avatar
  • 101
5 votes
0 answers
139 views

JTAG Dumped Flash is scrambled

I dumped the flash memory of an old ARM9 Chip running VxWorks using the SEGGER J-Link and the savebin command from J-Link Commander. Here is an example of a line of HTML stored on memory. <!DOC^...
user3547018's user avatar
5 votes
0 answers
5k views

Extracting ARM Boot zImage

I'm trying to analyze the firmware of a system running Linux and connecting various home automation and security devices. Every time it boots, the GM8125 processor running ARMv5TE loads a firmware ...
theTheodidact's user avatar
5 votes
2 answers
734 views

Getting empty files using firmware modification kit

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin ...
tehcereal's user avatar
4 votes
0 answers
208 views

remove the computrace by flashing the bios

Is there a way to remove the computrace by flashing the bios or deleting/altering the contents of it? Someone gave me a laptop and I found out that it was not usable because it was equipped with ...
pao's user avatar
  • 81
4 votes
0 answers
120 views

How to analyze EFI dynamically?

I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver. I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
Raafat's user avatar
  • 163
4 votes
0 answers
854 views

How to extract sound file from a small 1MB binary

I have a bluetooth speaker which announces interface events like "connected", "powering off". I want to silence these announcements. The way I thought of doing this is to get at ...
Capstone's user avatar
  • 143
4 votes
0 answers
220 views

Handling firmware with many copies of the same code/data in different address spaces

When loading the firmware I am working with, it copies multiple regions of code/data to another write-able memory region. I normal load the code/data into the destination location and leave the ...
Simeon Pilgrim's user avatar
4 votes
0 answers
4k views

What is a TROC Filesystem, and how do I mount it?

I decompiled a piece of firmware using binwalk and found an entry for a TROC Filesystem: DECIMAL HEXADECIMAL DESCRIPTION --------------------------------------------------------------------...
Derek Brown's user avatar
4 votes
0 answers
341 views

How to perform manual flashing of a bricked device?

I bought a broken Zoom H4n audio recorder, expecting an easy repair. What I got is a little bit over my head. It isn't booting (beyond a certain point) and I can't enter the firmware update tool. I ...
baltersice's user avatar
3 votes
0 answers
72 views

Reverse engineering LCD memory map

I'm trying to get RAW data from a laser rangefinder device, but it has no PC connection ports. It has a small LCD screen onboard, where all data is displayed: distance, angle, battery level, etc. ...
artsin's user avatar
  • 131
3 votes
0 answers
362 views

Delphi MT05.3 ecu

Hi I have a Honda IGX800 V twin engine with a Delphi MT05.3 ecu The engine has an idle of 1400 rpm I would like to be able to gain access to the ecu and reduce the idle rpm to around 950 /1000 rpm ...
Squrcle's user avatar
  • 31
3 votes
0 answers
122 views

debug stripped file

I've system embedded mips big endian with gdb-server and I want debug stripped file of the target, I can run in target gdb server with stripped file (--attach PID), but when I try to connect with gdb-...
timb55's user avatar
  • 31
3 votes
0 answers
158 views

rooting D-link DIR-x5460 - Weird Firmware

I have a D-link DIR-X5460 and I'm trying to get a shell on it. I connected to the UART interface and tried some default passwords, but none work. I downloaded the FW from D-link's website, decrypted ...
Barakinio's user avatar
3 votes
0 answers
280 views

Reverse engineering firmware to CD/DVD drive to enable scrambled mode support

I am a volunteer of the redump.org project, the goal of our website is to archive game CDs in the best possible quality. Unfortunately, this site requires only DiscImageCreator to be used for CD and ...
MrPepka's user avatar
  • 31
3 votes
0 answers
393 views

Is it possible to dump firmware of a device via USB port?

I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port. lsusb command says that this device has following ...
Simon Rusinov's user avatar
3 votes
0 answers
502 views

Modify bin firmware file of an old phone

I am trying to remove/disable some system apps ( Messages, Games, Radio or Calendar ) and remove/replace the boot screen from samsung E1200y. So i start searching for the way to do that... I used HxH ...
M J's user avatar
  • 53
3 votes
0 answers
345 views

Uniden FW Hacking

I recently purchased a Uniden Radio Scanner (BCD325P2). I looked at the Windows FW Update App in dnSpy, then pulled the FW bin directly. FCC Parts List gets me R5F5631BCDFP#V0, which appears to be a ...
dcypher's user avatar
  • 31
3 votes
0 answers
1k views

When to use qemu user mode versus system mode?

This seems to be a pretty basic question but I can't seem to find a good answer. I am currently just following https://w00tsec.blogspot.ca/2013/09/analyzing-and-running-binaries-from.html to learn ...
HKC's user avatar
  • 101
3 votes
0 answers
644 views

Reverse Engineering SCE .pkg Files

To elaborate, I need help decompressing SCE (Sony Computer Entertainment) .pkg files. I've found several common patterns between multiple versions of the same file (released over the span of two years ...
JRM's user avatar
  • 31
3 votes
0 answers
2k views

Decrypting Firmware File

I am by no means a hardware or software expert. But I've got a bit of a dilemma. I have on my hands an "encrypted" firmware image. I say that with air quotes because I'm not sure if it's encrypted, ...
Patrick's user avatar
  • 141
3 votes
0 answers
389 views

Running vmlinux ELF under QEMU

I have a vmlinux ELF file to run under QEMU. My arguments to qemu-system-arm.exe are: The correct -cpu argument. The versatilepb -machine which I'm not sure if it's the right choose, but can't see ...
Reflection's user avatar
3 votes
0 answers
2k views

Analysing eCos image

I'm working on unpacking a firmware image. I've already uncompressed the original image, but I'm stuck in the current step. This is the current uncompressed image: https://www.dropbox.com/s/...
tnas's user avatar
  • 31
3 votes
0 answers
444 views

How is the tp-link switch firmware obfuscated?

I was curious and wanted to learn a bit about TP-Link's switch firmware (for example: What OS are they using?). Because I have seen the sg3216 in the real world, I thought, I'd start with that one. ...
Elrond's user avatar
  • 131
3 votes
1 answer
852 views

Reversal of unknown obfuscation or encryption with known plaintext

Introduction For academical reasons I am reversing a firmware for an embedded device. I have already created a perl script which is able to parse the firmware structure and extract files from it (its ...
SeWe's user avatar
  • 39
2 votes
0 answers
283 views

ZTE F670 V1.1.10P3T21 encrypted config.bin

I want to decrypt config.bin For this I found in cspd following code undefined4 CspDBInitPdtInterface(undefined4 *param_1) { dbAddCfgItem(0xffff,0,"/userconfig/cfg/db_user_cfg.xml"); ...
Elec Art's user avatar
2 votes
0 answers
67 views

How can I patch out shm in Ghidra?

I've been trying to emulate a Mips binary in qemu, but I kept getting an error for shared memory allocation. I decompiled the function where it happens in Ghidra: local_18 = dm_shmInit(0); if (...
qwfpgjluy's user avatar
2 votes
0 answers
585 views

How to extract the firmware from the flash chip of the router?

Hi, I've been struggling with a subject since 2 weeks. I have MSS5004W model router from RicherLink. The board is RL-S4005ef. This device has OpenWrt installed but it's not normally supported by that ...
SwordLion's user avatar
2 votes
0 answers
190 views

In IDA freeware, how to create a new database in IDC and load a file into it?

I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder. What ...
IDAIDCMalAnalysis's user avatar
2 votes
0 answers
207 views

How to Decompile HP LaserJet Pro M12w firmware in Ghidra

I'm trying to decompile HP LaserJet Pro M12w firmware with Ghidra, after download the HP LaserJet Firmware Update Utility from this link, when I look at this file, I found two file, hpm12a.pkg and ...
A.Motahari's user avatar
2 votes
0 answers
41 views

Is there a way to run arbitrary code on a vtech Nitro Vision?

Note: If this the wrong place to ask the question, please redirect me to the appropriate stack exchange and/or subreddit. I just figured reverse engineering is my best bet since it's kinda what I'm ...
Clement's user avatar
  • 21
2 votes
0 answers
55 views

Access to CPU registers in GMM space

AMD's BIOS and Kernel Developerā€™s Guide (BKDG) documents GMM registers and access to them: GMMxXXXXX: GPU memory mapped registers; XXXXX specifies the hexadecimal byte address offset (this may be 2 ...
Hweaker's user avatar
  • 121
2 votes
0 answers
306 views

.bin firmware Standalone Binwalk returns garbage, Binwalk -I returns something but seems corrupted. Binwalk -X returns hundreds of raw deflate streams

As the title says I have the firmware of the WAX214 wifi access point. The firmware is actively preventing me from using the full available functionality of the device so I am trying to reverse it to ...
Arimodu's user avatar
  • 21
2 votes
0 answers
45 views

LZ4N file format - file decoding

I'm trying to decode a file that is part of device firmware. Unfortunately it comes RIFF<...>WAV format wrapped / packed with strange LZ4-like format. Non of linux available lz4 tools do ...
Krystian's user avatar
2 votes
0 answers
672 views

Firmware Binary Reverse with Ghidra returns only few codelines decompiled with truncated code

I have tried to decompile the firmware binary of a microcontroller that should be an STM32 (but I'm not sure about this). After the analysis I get only few codelines with a lot of similar messages: ...
AndreaF's user avatar
  • 121
2 votes
0 answers
313 views

How to disassemble Renesas RX210 MCU firmware?

I am a beginner in firmware reverse engineering. I have a dump file of Renesas RX210 MCU firmware but, I don't know how to disassemble it. Is any recommended software to disassemble it?
ManJaro's user avatar
  • 55
2 votes
0 answers
203 views

Fix screen resolutions to landscape in bios

I've got an x86 tablet (Dere D10). It works fine, except the screen reports portait resolutions (1200x1920, 768x1024, 600x800, etc.) which causes bootloaders (windows recovery menu, grub, ventoy, etc.)...
REmorin's user avatar
  • 21
2 votes
0 answers
86 views

LG C1 Firmware Flashing/Modifying

I have a new TV that is smart enough to not have options and configuration I can actually use, and worse of all my tv changes all setting like brightness, sharpness, warmth and input setting to what ...
GrandmaNeedsHelp's user avatar
2 votes
0 answers
194 views

Prevention of reverse engineering of a microcontroller's firmware

What steps may I take to make it more expensive to reverse engineer a firmware I want to use on a cheap microcontroller? Options I see so far: Flood it with epoxy with quartz or metal dust to make ...
Surprised Seagull's user avatar
2 votes
0 answers
432 views

Nokia 105(TA-1114) Firmware analysis using Binwalk

First please forgive me if a make any mistake. i am not a primarily English speaker but I will try my best. Few days ago i started to tinkering with Nokia feature phone Nokia 105(TA-1114). I get a ...
muhammad shahzaib's user avatar