Questions tagged [mips]

RISC instruction set architecture (ISA). It is commonly used in embedded devices such as set top boxes and networking gear. Many university-level computer architecture classes use the MIPS ISA due to its relative simplicity.

Filter by
Sorted by
Tagged with
29 votes
4 answers
40k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
11 votes
1 answer
12k views

Emulate TP-LINK WR740N with QEMU

I'm trying to emulate a TP-Link WR740N in Qemu (MIPS). I have extracted the rootfs.img from the firmware, and downloaded vmlinux-2.6.32-5-4kc-malta from here: http://people.debian.org/~aurel32/qemu/...
  • 123
10 votes
1 answer
5k views

Reverse Engineering ZyXel C1100Z modem firmware

first time post so please bear with me. For days I have been trying to bypass a password my ISP has added to their remote CLI with no luck. I have a Zyxel C1100Z DSL modem that I've purchased from ...
8 votes
3 answers
716 views

Extracted router file execution

I am trying to run an executable file that I dug out from an extracted file system of a DSL modem router. So first of all I needed to either have a MIPS Linux box or take the emulation path. After ...
  • 81
8 votes
1 answer
10k views

How i can extract TP-LINK firmware from squashfs?

I have installed FMK and binwalk. FMK have an old binwalk that does not work. So, I ran a fresh binwalk (from git) as follow: $> binwalk -e wr741ndv4_ru_3_13_2_up_boot(140521).bin And in the ...
  • 181
7 votes
1 answer
3k views

Unpack Billion 5102 firmware

I'm trying to unpack this firmware image but I'm getting some issues understanding the structure. First of all I have one image which I called firmware.bin, and the file command shows me that it's a ...
  • 655
7 votes
1 answer
2k views

Reverse engineering Devolo firmware

I am trying to do some reverse engineering to a Devolo dlan wifi 500 device (MIPS architecture). My objective is to put there some firmware modified by me. This is where I got so far: Downloaded a ...
  • 173
7 votes
1 answer
4k views

Using MIPS EJTAG functionality in OpenOCD

I am trying to use the OpenOCD functionality of a BusBlaster to debug a MIPS target. However, it doesn't look as though my target MIPS chip is defined in the list of sample target chip configurations -...
6 votes
4 answers
3k views

Do I have to learn computer architecture for underestanding or doing reverse engineering?

I am completely noob in reverse engineering, and I've just started to learn it. Now I have this question in my mind, that does a reverse engineer use any computer architecture knowledge for doing his/...
6 votes
3 answers
14k views

Is it possible to convert MIPS ASM to code?

IDA can disassemble to assembly. But, reading large assembly blocks with byte shifts, etc, is tedious work. I rather would read pseudo-code. Are there any documents, tutorials or tools for this work ...
6 votes
2 answers
2k views

Understanding branch delay slots for reversing MIPS

I am statically reversing some software compiled for an Atheros AR7161 using radare2. This processor implements MIPS, and I do recall that MIPS has a branch delay slot. This is indeed noticeable in ...
6 votes
1 answer
2k views

Any reason why Ghidra is screwing with this byte in this dissassembly?

I am poking around some PS2 ELFs and I found this weird issue where Ghidra seems to be doubling the value of this byte for some reason. Here's what Ghidra shows: ...
5 votes
4 answers
5k views

Identify compression of this ZTE ZXV10 H201L V2 backup config file

This config.bin file is from a ZTE router. I would like to decompress it but I did not identify the compression used in the file. Maybe someone can. 00000000 99 99 99 99 44 44 44 44 55 55 55 55 aa ...
  • 445
5 votes
1 answer
2k views

IDA Pro for MIPS image

I have this file: [ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data It's image for Cisco Catalyst 3650 ...
  • 151
5 votes
0 answers
1k views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed the tutorial IDA Help: Debugging code snippets with QEMU. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: Should I adjust ...
5 votes
0 answers
1k views

Emulate TP-Link WR841N using Qemu

I have downloaded a few different versions of the firmware from the TP-Link website. I've been piecing together details on how to achieve this but I'm missing some key points. Following instructions ...
4 votes
4 answers
11k views

Disassembling MIPS Binaries

I am searching for security vulnerabilities in the firmware of this router, its architecture is mips. I have successfully unpacked the file system. I would like to disassemble the http daemon, located ...
  • 257
4 votes
1 answer
5k views

How to reverse CGI file for MIPS?

I'm trying to load a CGI file to IDA in order to disassemble it and understand it's behaviour but I can't do it. According to the strings command I can see some interesting words like system, sprintf,...
  • 655
4 votes
1 answer
6k views

Reverse engineering TP-Link TD-W8961N

After following the tutorial here, I decided I would try and reverse engineer my router's firmware. My router is the TP-Link TD-W8961N and the firmware version is V2. I have been trying to figure ...
4 votes
1 answer
5k views

How to disassemble/run mips ELF file ? (with readelf error)

So i want to disassemble and then run a MIPS elf file for the first time. As i don't have MIPS hardware i am using mipsel-unknown-linux-gnu toolchain.Here comes the problem. The output of the command ...
4 votes
3 answers
347 views

Get certain instruction count for multi-architecture binaries

I need to get an ELF binary's total count of Function call instruction conditional jump (branch) instruction The binary could be any CPU architecture, like x64, ARM, MIPS, Motorola 68K, etc. It ...
3 votes
1 answer
3k views

How do I find out entry point in mips or sh4 bin firmware?

Would be great to know where the entry point is after decompress bootloader from a bin firm, mips based or os21.. I mean, is always in same offset or it depends on compilation made? I think is a very ...
  • 145
3 votes
1 answer
717 views

Strange instructions pattern (lw) in MIPS binary

I'm trying to reverse a binary and I'm having trouble understanding a pattern that keeps showing in almost half of the functions in the binary. This is how one particular function looks like: Why is ...
3 votes
2 answers
4k views

Reverse Engineering MIPS Bootloader

I am trying to figure out how the bootloader of a TP-Link wr702n device (based on an AP121 MIPS board) starts the operation system (VxWorks 5.5.1). The bootloader is extracted from a firmware update ...
3 votes
1 answer
4k views

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

I am working on a MIPS binary: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=76438e9ed749bcfc6e191e548da153d0d3b3ee28, not stripped ....
  • 1,281
3 votes
1 answer
137 views

Help deciphering binary that creates 3 passwords

I found a binary on a device I've been working on, it's called genrandpass and the only user input is a public key (which is a .bin file) that's stored locally on the device. It also gathers some ...
  • 455
3 votes
1 answer
799 views

Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?

I am not sure if this is the right forum, or if it would be better suited in a different SE sub, though I figure this is an appropriate place for it. I am wondering if there are any emulators that ...
3 votes
1 answer
264 views

Netgear n300 auth bypass vulnerability

I was looking at writeup on Netgear N300 authentication bypass vulnerability and I have found some inconsistencies in the article with my understanding of it. I want a second opinion on this because I'...
  • 271
3 votes
1 answer
159 views

What is an "mpi register base"?

For the past few months, I have been using my spare time reverse engineering a set top box that will not be named. I am trying to run a media server or use it as a debian desktop. It is rocking a ...
2 votes
2 answers
282 views

MIPS assembly to C code

I think I'm really brain-dead and am not really sure what to do next, but I am trying to manually convert assembly code to a C program. It's not really working, but I'm not sure what is wrong. I would ...
2 votes
1 answer
5k views

How to find Bootloader Load Address?

I've followed the tutorial found at: http://www.devttys0.com/2011/05/reverse-engineering-firmware-linksys-wag120n/ I've loaded the uboot image into IDA, but I'm not sure how to determine the load ...
  • 101
2 votes
1 answer
3k views

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

I am trying to disassemble a MIPS 32 version 1 binary with the Radare2 framework. Here is the full output of the file command: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically ...
2 votes
1 answer
98 views

The questions about li instruction

When reversing a MIPS binary using IDA Pro, I have 2 questions. The source code is as follows. int main(int argc, char* argv[]) { int m = 1; int n = 5; printf("sum = %d\n", m+n); } ....
  • 381
2 votes
1 answer
684 views

SPI Flash, how to find the System memory addresses?

How to determine the System memory addresses of SPI Flash used in device running eCos operating system? For example, show flash command returns the following info: Flash Device Information: ...
  • 215
2 votes
2 answers
1k views

Radare2 to show code hints like IDA Pro?

I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like : Here is what I am doing with Radare2 (with an additional ...
  • 23
2 votes
1 answer
1k views

`qemu-mips-static` chroot causing `Invalid ELF image` error

I'm trying to emulate a MIPS binary on my Ubuntu 16.04 x86 system, but I'm not able to. I chroot into the squashfs-root filesystem that I got from binwalking the firmware image. kan3k1@kaido:~/...
2 votes
0 answers
398 views

How to perform full MIPS system emulation with QEMU, using the squashfs image and uBoot kernel image?

TL;DR: Need tips on emulation of MIPS-BE system using QEMU with the help of squashfs image file and uBoot Kernel image file extracted from the firmware file. Long Version: - What I have: A cheap ...
2 votes
2 answers
523 views

Can't trace MIPS embedded device remotely

I'm trying to debug a remote device using gdbserver and IDA Pro. I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
2 votes
0 answers
565 views

Trying to run MIPS ELF with a cross toolchain but sigbus error

I finally successfuly installed a cross toolchain from this site in order to run and debug a mips elf on my x86-64 . I only have the elf file. I can disassemble it but when i try to run it with : ...
1 vote
4 answers
427 views

Are there any 64 bit MIPS decompilers

I’ve found many mips 32 bit decompilers. I’m trying to decompile a simple 64bit elf from mips to c. Ida doesn’t seem to have much of a problem with disassembly. After some fixings I tried the ...
1 vote
3 answers
3k views

Mips disassembler

So, I am looking for disassembler code for MIPS commands, for example: if the program gets word of command like 3c1d8010, I want to get the name of the command and the registers, which it uses: lui sp,...
1 vote
2 answers
1k views

Using USB JTAG probe with ARM & MIPS

Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
  • 203
1 vote
3 answers
2k views

Generate a sig file from ELF executable

I have a mipsel executable (DvdPlayer from a RTD1283 firmware). I know that IDA is able to identify many functions. Then, I would like to generate a .sig file with signatures of these functions for ...
1 vote
1 answer
300 views

IDA Pro, How to forcefully disassemble "mips 32" instead of "mips 16"?

While disassembling a mips binary, IDA Pro attempts to disassemble into mips 16 mode, even though It's mips 32 ISA. Below is that code snippet. .text:XXXXXXXX .set nomips16 # <= ?? .text:...
  • 123
1 vote
1 answer
4k views

Extracting SquashFS based filesystem

I'm trying to use binwalk to extract the firmware for the Ubiquiti Networks ER-X. Currently I've downloaded a copy of the firmware and uncompressed it. I opened the folder with the filesystem contents ...
  • 105
1 vote
1 answer
1k views

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

Issuing some commands for the dumped firmware: $ du -h fw.bin 4.0 M $ file fw.bin fw.bin: data $ file -i fw.bin fw.bin: application/octet-stream; charset=binary $ binwalk fw.bin - $ enca -L none ...
  • 131
1 vote
1 answer
1k views

Are there assembly instructions which both read from, and write to, memory?

Is it a safe assumption, say for x86, that an instruction either does not access memory, or only reads from memory, or writes to memory? I could not find any instruction but I am not sure if this ...
  • 1,456
1 vote
1 answer
587 views

Renaming subroutines in IDA Pro for MIPS

I am working on a mipsel binary in IDA Pro and I'm having some issues with renaming subroutines. I have the subroutine "system" at 0x739644. I renamed this using the N hotkey. Now if I hit X, some ...
  • 1,672
1 vote
2 answers
2k views

How was Playstation Portable hacked? How is custom firmware developed? [closed]

How was PSP hacked? On first hand, how do people rip the binary out of PSP? I am just curious how all those hardware reverse engineering works. P.S. Is there a PSP Custom firmware developer ...
1 vote
1 answer
1k views

Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]

X-POST FROM unix.stackexchange.com I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200. I've decompiled it ...