Skip to main content
6 votes

Deciphering the format of an unknown file

This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization. Specifically, the FFFF is a 'new class tag' followed by - 0001 a ...
Ian Cook's user avatar
  • 2,558
5 votes
Accepted

Binwalk does not show anything when process binary

I tried: $> binwalk --opcodes Image1.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 348 0x15C ...
perror's user avatar
  • 19.1k
5 votes

CSR DFU File Format

This is a BlueCore02 Device Firmware Upgrade File. I could not find a specification, but the BlueCore01 specification contains more or less the same fields (with a few differences)
Johannes Mittendorfer's user avatar
4 votes
Accepted

Harman Kardon firmware reverse engineering

If you run strings on your firmware file, you can typically get a lot of helpful information. In this case, since I don't know what your device is other than a Harman Kardon "something," I ...
Cheibriados's user avatar
4 votes

Binwalk extracted images corrupt?

Binwalk does carving, it doesn't care if embeedded file maybe cut into pieces, and its the parts are not stored in the container file continuously. It just finds JFIF header and tries to guess the ...
Anton Kukoba's user avatar
  • 1,850
3 votes
Accepted

Mickey Mouse toy bin file analysis

Got the file disassembled into the audio segments. Format is pretty simple. (for further analysis the separated files: https://nplusc.de/mickey.bin-splitted.zip ) File has a index list at 0x6c of 0x29 ...
masterX244's user avatar
3 votes
Accepted

Extracting SquashFS based filesystem

I was able to extract the file system just fine. I used Binwalk v2.1.2b and have sasquatch installed. Extracted file system: _squashfs.tmp.extracted/squashfs-root $ ls bin boot config dev etc ...
julian's user avatar
  • 7,168
2 votes

Reverse Engineering Firmware Aether Cone

as my previous answer was deleted (I'm guessing because it was not an answer per se) I've got more of an answer for you. the firmware does nothing to stop you from using UART to interact with it ...
Fidget's user avatar
  • 21
2 votes
Accepted

Unpacking, modifying, repacking and flashing a firmware

Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used binwalk's extract option, that made it too easy; you'll want to ...
multithr3at3d's user avatar
2 votes

Unable to unsquash from a FW dump

Most likely your dump includes spare (or OOB) bytes while most file formats only consider user-accessible areas. You can either figure out the dump structure and remove OOB chunks or simply re-dump ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Harman Kardon firmware reverse engineering

Seems to be a Cortex-M (ARM Thumb-2 code), load base 0x8000000. My guess it's some STM32 model.
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Disassembling ARM based Camera Firmware

You can try hikpack to unpack the firmwork. The hikpack download link: https://ipcamtalk.com/attachments/hikpack_2-5-zip.45534/. alastair@PC-I5 ~/montecrypto $ ./hikpack_2.1 -t g0 -x ...
SkYe231's user avatar
  • 21
2 votes

Disassembling ARM based Camera Firmware

It seems the parsing logic is hidden in the U-Boot loader tftpboot- boot image via network using TFTP protocol update - update digicap.dav updateb - update uboot(u-boot.bin) to nor updatebl- update ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote

binwalk guess wrong LZ4 compressed data format

I just found out that binwalk report an image size of "8717639 bytes" in uImage header. It brings me at the very end of the file as file size is 8717703 bytes (8717639 which is my uImage ...
Julionabi's user avatar
1 vote
Accepted

Unix system with windows-style registry

This may be related to automotive. I had seen something like this in this repository, strings including /dev/registry/LOCAL_MACHINE/SOFTWARE/BLAUPUNKT are mentioned directly here. Using word "...
w s's user avatar
  • 8,508
1 vote

Decode a Windows CE nand dump

Windows CE runs in memory and isn't designed to be run from storage like normal Windows, the NAND chip only contains the binary to load into memory and sometimes the file to define the binary to load ...
doge guide's user avatar
1 vote

Zlib structure inside a GCC static library

Hard to tell without a look at the library in question, but my guess would be that the contained object files contain zlib-compressed debug information. Have a look here and look for "zlib" ...
0xC0000022L's user avatar
  • 10.9k
1 vote

Trying to reverse a bin file

Looks like it is encrypted. Entropy is to high.
strannyi's user avatar
1 vote

Can an OpenWrt FIT kernel be virtualized in qemu?

I don't know anything about OpenWrt FIT format, but I've built an OpenWRT VM to run on OpenStack in the past, so virtualising your router image might be doable. My first thought was that you build an ...
Mega Tonnage's user avatar
1 vote

how to extract this firmware .img?

I unpacked this stuff with binwalk -e <file_name> and got list of files like: 1A3DF 1CDD4 1F5E6 ... Their content looks like some web-document with images: Static Routes Help Static routes give ...
strannyi's user avatar
1 vote

Grundfos Firmware

Looking at the entropy of a file's contents is a good way to understand whether some/all of it is compressed or encrypted. Any good compression or encryption will result in entropy in the region of ...
Ian Cook's user avatar
  • 2,558
1 vote

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)?

I read about similar issue with ZTE modem: ZTE encrypted backup config file It was ZLIB-compressed and encrypted with AES in ECB mode with a 16-byte key. You can read this topic, maybe it can work ...
HE9CbITb's user avatar
  • 101
1 vote

Unable to unsquash from a FW dump

I think you have a router very similar to mine after analysing your dump. Please check PRV3399BELT for what I've found so far. As noted before, you have dumped raw data with OOB information; that must ...
Jorge's user avatar
  • 11
1 vote

Why do some firmware binaries have more than 1 file system structures

There can be several reasons for that: Sometimes you want parts of it read/write which squashfs doesn't support. Other parts should always be read-only, so there squashfs would be a great fit. Some ...
Richi's user avatar
  • 169
1 vote

Problem with analyzing a JFFS2 Filesystem

you can mount jffs2 file system directly fo rmount jffs2 file system on linux One method of mounting JFFS2 images uses the mtdram module to emulate an MTD device using system RAM. This works well ...
Ali Raza Manzoor's user avatar
1 vote

Binwalk to Extract Firmware is not working for me

A few things: Please include an entropy plot of the file using the -E flag; this will show if any portion of the file is indeed compressed or encrypted. Please include a link to either the firmware ...
julian's user avatar
  • 7,168
1 vote

Recognize binary architecture

Binwalk has this feature but you need to enable it explicitly: -A, --opcodes Scan target file(s) for common executable opcode signatures A project which explicitly tries to determine an ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote

Repacking an embedded initramfs

Thanks for the pointers. At least the xz.txt answers one of my questions, which is why the XZ util won't work to decompress. Although I still don't think what binwalk extracts is the exact XZ file ...
ntlord's user avatar
  • 11
1 vote

CSR DFU File Format

I've found this project https://github.com/lorf/csr-spi-ftdi, along with info: BlueCore 2 chips (such as BC212015) are not supported in BlueSuite 2.4 and above what means they are intentionally try ...
nusch's user avatar
  • 11
1 vote

How to unpack the Fortigate firmware?

Main part of fortigate firmware is a /bin/init executable, most of other files are just symbolic links to it. So, you can obtain this file (or any other file of interest) from device or VM using ...
Igor Matyuh's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible