Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

RISC instruction set architecture (ISA). It is commonly used in embedded devices such as set top boxes and networking gear. Many university-level computer architecture classes use the MIPS ISA due to its relative simplicity.

1
vote
0answers
31 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
0
votes
2answers
86 views

How to interpret disassembled MIPS code?

I have disassembled MIPS binary with raw opcodes. How to interpret, for example, these lines: Disassembly of section .data: 00000000 <.data>: ... ... f864: 30a5ffff sd ra,-23248(...
1
vote
1answer
134 views

*.abs (sfw) emulation in Qemu - MIPS (abs = Amiko,Skybox,OpenBox, Cryptobox,… file firmware)

I have some questions well today I tried to emulate with (Qemu) a STB firmware (.abs extension file) in Qemu. So I tried to unpack the .abs file I got many files. Example for: Amiko HD8150 2.4.43 emu ...
2
votes
1answer
108 views

SPI Flash, how to find the System memory addresses?

How to determine the System memory addresses of SPI Flash used in device running eCos operating system? For example, show flash command returns the following info: Flash Device Information: ...
0
votes
1answer
160 views

Reverse mips binary with radare2

when I try to reverse my mips binary in radare2, I take some instruction invalid. sudo r2 -a mips -b 32 -d 2700 start my binary: sudo chroot . ./qemu-mips-static bin/resident Sorry for this ...
2
votes
1answer
180 views

Strange instructions pattern (lw) in MIPS binary

I'm trying to reverse a binary and I'm having trouble understanding a pattern that keeps showing in almost half of the functions in the binary. This is how one particular function looks like: Why is ...
1
vote
0answers
75 views

reverse engineer BE126 boot-loader

I am trying to reverse engineer the firmware upgrading process of BE126 wifi repeater which has a MIPS CPU. I couldn't find a firmware upgrade image in the manufacturer site. I have the toolchain ...
1
vote
1answer
685 views

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework. Here is the full output of the file command: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
0
votes
1answer
276 views

Reverse engineer the update-binary file in Android recovery update packages

I am trying to understand how to disassemble or at least get a readable copy of the update-binary file located in /META-INF/com/google/android/. It is a modified version for a smartwatch, which ...
1
vote
1answer
91 views

library issue when running mips binary in a chrooted environment

Background In my endeavor to RE my router, I'm trying to emulate a router's firmware inside a QEMU MIPS system. I have debian-mips installed to a virtual disk that runs just fine. Its a MIPS32 Big ...
1
vote
0answers
324 views

Debugging MIPS Binaries on Ubuntu 64-bit (version 14.04)

I have a MIPS 32-bit MSB binary and I can disassemble the code with IDA Pro and decompile it successfully with ReTargetable Decompiler. In order to understand the binary much better, I need to debug ...
8
votes
1answer
2k views

Reverse Engineering ZyXel C1100Z modem firmware

first time post so please bear with me. For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck. I have a Zyxel C1100Z DSL modem that I've purchased from ...
1
vote
1answer
414 views

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

Issuing some commands for the dumped firmware: $ du -h fw.bin 4.0 M $ file fw.bin fw.bin: data $ file -i fw.bin fw.bin: application/octet-stream; charset=binary $ binwalk fw.bin - $ enca -L none ...
4
votes
1answer
131 views

Netgear n300 auth bypass vulnerability

I was looking at writeup on Netgear N300 authentication bypass vulnerability and I have found some inconsistencies in the article with my understanding of it. I want a second opinion on this because I'...
1
vote
0answers
74 views

Is it feasible to try write mips unicode shellcode

I am doing a bit off research on exploiting mips embedded applications and I am in a situation where I am able to trigger a buffer overflow, effectively being able redirect execution to any location ...
1
vote
1answer
802 views

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

I am working on a MIPS binary: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped ....
4
votes
3answers
2k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
0
votes
1answer
208 views

Understanding bootlog load address

I was looking at the bootlog for the WAG160N found here: https://wiki.openwrt.org/toh/linksys/wag160n and I wanted to clarify how the booting works. *Boot Address 0xbfc00000 Total memory used by CFE:...
1
vote
1answer
1k views

How to find Bootloader Load Address?

I've followed the tutorial found at: http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/ I've loaded the uboot image into IDA, but I'm not sure how to determine the load ...
1
vote
0answers
361 views

How can I find loading adress of eCos image

Hey guys Im trying to find loading address (entry point of my program) for this binary, which is part off this firmware. Im trying to load it inside of IDA, how can I correctly load it, how to find ...
3
votes
1answer
3k views

Reverse engineering TP-Link TD-W8961N

After following the tutorial here, I decided I would try and reverse engineer my router's firmware. My router is the TP-Link TD-W8961N and the firmware version is V2. I have been trying to figure ...
0
votes
3answers
1k views

Mips disassembler

So, I am looking for disassembler code for MIPS commands, for example: if the program gets word of command like 3c1d8010, I want to get the name of the command and the registers, which it uses: lui sp,...
2
votes
2answers
803 views

Radare2 to show code hints like IDA Pro?

I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like : Here is what I am doing with Radare2 (with an additional ...
9
votes
1answer
3k views

How i can extract TP-LINK firmware from squashfs?

I have installed FMK and binwalk. FMK have an old binwalk that does not work. So, I ran a fresh binwalk (from git) as follow: $> binwalk -e wr741ndv4_ru_3_13_2_up_boot(140521).bin And in the ...
4
votes
1answer
95 views

Help deciphering binary that creates 3 passwords

I found a binary on a device I've been working on, it's called genrandpass and the only user input is a public key (which is a .bin file) that's stored locally on the device. It also gathers some ...
1
vote
1answer
501 views

Are there assembly instructions which both read from, and write to, memory?

Is it a safe assumption, say for x86, that an instruction either does not access memory, or only reads from memory, or writes to memory? I could not find any instruction but I am not sure if this ...
0
votes
0answers
428 views

Problems about mips disassembling in IDA

I am a freshman of disassembling. Now, when I disassemble the firmware of a router, I encountered a problem that about the understanding of a piece of code. In this piece of code, there exists the ...
6
votes
0answers
634 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: ...
0
votes
0answers
95 views

Hex-editing string in OpenVPN ELF binary breaks its commandline parsing

I'm trying to make OpenVPN (MIPS binary from Entware package repository) to use custom ifconfig instead of hardcoded /sbin/ifconfig. To do this, I've created symlink to custom ifconfig and modified ...
1
vote
1answer
210 views

Patching MIPS binary file on IDA fails at build

I'm working on reverse a binary from a MIPS based router. In order to do it I'm emulating the binary with qemu, but the binary executes some routines before stating with the logic that skips the ...
3
votes
2answers
2k views

Reverse Engineering MIPS Bootloader

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
0
votes
0answers
96 views

Converting data to space?

I made a mistake when trying to import some additional binary data into one of my long-time IDA databases. I unintentionally overwrote some empty RAM space, so I tried reverting it back to "space" by ...
0
votes
1answer
63 views

.data symbols equivalent to .text labels?

It is understood that the labels that come in the .text section of an assembly program are representative of the address of the following instruction. Is it the same idea with the symbols we see in ...
1
vote
1answer
340 views

Renaming subroutines in IDA Pro for MIPS

I am working on a mipsel binary in IDA Pro and I'm having some issues with renaming subroutines. I have the subroutine "system" at 0x739644. I renamed this using the N hotkey. Now if I hit X, some ...
2
votes
1answer
467 views

Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?

I am not sure if this is the right forum, or if it would be better suited in a different SE sub, though I figure this is an appropriate place for it. I am wondering if there are any emulators that ...
0
votes
1answer
588 views

Any tips for analyzing this mips function

These function are used to decrypt with AES and there is Decrypt by CRC and I assume that crc is used for data checksums, I have qemu-mipsel and my question for u is how could I discover from where ...
1
vote
0answers
341 views

Debug function in MIPS .ko file (with IDA and Qemu)

I have a .ko file which I grabbed from a router (MSB MIPS), and I'm trying to debug a specific function inside it with IDA. Since i can't just "run" the ko file with QEmu, I tried to change its ...
1
vote
2answers
219 views

Calling a function in a MIPS library

I have disassembled a MIPS library in the online Retargetable Disassembler, but I don't really understand the code I got (I'm new to reverse engineering). Would it be possible for me to either ...
13
votes
3answers
14k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
2
votes
0answers
363 views

Trying to run MIPS ELF with a cross toolchain but sigbus error

I finally successfuly installed a cross toolchain from this site in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with : ...
4
votes
1answer
3k views

How to disassemble/run mips ELF file ? (with readelf error)

So i want to disassemble and then run a MIPS elf file for the first time. As i don't have MIPS hardware i am using mipsel-unknown-linux-gnu toolchain.Here comes the problem. The output of the command ...
5
votes
1answer
1k views

Reverse engeneering Devolo firmware

I am trying to do some reverse engeneering to a Devolo dlan wifi 500 device (mips arquitecture). My objective is to put there some firmware modified by me. This is where I got so far: Downloaded a ...
1
vote
2answers
2k views

How was Playstation Portable hacked? How is custom firmware developed? [closed]

How was PSP hacked? On first hand, how do people rip the binary out of PSP? I am just curious how all those hardware reverse engineering works. P.S. Is there a PSP Custom firmware developer ...
2
votes
0answers
767 views

Emulate TP-Link WR841N using Qemu

I have downloaded a few different versions of the firmware from the TP-Link website. I've been piecing together details on how to achieve this but I'm missing some key points. Following instructions ...
1
vote
1answer
986 views

Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]

X-POST FROM unix.stackexchange.com I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200. I've decompiled it ...
1
vote
2answers
516 views

Can someone compile a program for me with gcc-mips? [closed]

I am close to having root on my DVR device running busybox. I figured out one of the user login/passwords and am able to telnet in, but that's it. I have a drive that is attached which automatically ...
-7
votes
1answer
6k views

Convert C to MIPS assembly code? [closed]

You could help solve this problem? Best regards! int bonus(int *l, int n){ int i, j, aux; for(i = 0; i < n; i++){ for(j = 0; ...
2
votes
2answers
994 views

Using USB JTAG probe with ARM & MIPS

Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
8
votes
1answer
9k views

Emulate TP-LINK WR740N with QEMU

I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the rootfs.img from the firmware, and downloaded vmlinux-2.6.32-5-4kc-malta from here: http://people.debian.org/~aurel32/qemu/...
4
votes
4answers
7k views

Disassembling MIPS Binaries

I am searching for security vulnerabilities in the firmware of this router, its architecture is mips. I have successfully unpacked the file system. I would like to disassemble the http daemon, located ...