6
votes
Deciphering the format of an unknown file
This is only a partial answer but the data at offset 0x100 looks very much like that produced by Microsoft's C++ MFC serialization.
Specifically, the FFFF is a 'new class tag' followed by -
0001 a ...
- 2,558
5
votes
Accepted
Binwalk does not show anything when process binary
I tried:
$> binwalk --opcodes Image1.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
348 0x15C ...
- 19.2k
5
votes
CSR DFU File Format
This is a BlueCore02 Device Firmware Upgrade File. I could not find a specification, but the BlueCore01 specification contains more or less the same fields (with a few differences)
4
votes
Accepted
Harman Kardon firmware reverse engineering
If you run strings on your firmware file, you can typically get a lot of helpful information. In this case, since I don't know what your device is other than a Harman Kardon "something," I ...
- 310
4
votes
Binwalk extracted images corrupt?
Binwalk does carving, it doesn't care if embeedded file maybe cut into pieces, and its the parts are not stored in the container file continuously. It just finds JFIF header and tries to guess the ...
- 1,850
3
votes
Accepted
Mickey Mouse toy bin file analysis
Got the file disassembled into the audio segments. Format is pretty simple.
(for further analysis the separated files: https://nplusc.de/mickey.bin-splitted.zip )
File has a index list at 0x6c of 0x29 ...
- 228
3
votes
Accepted
Extracting SquashFS based filesystem
I was able to extract the file system just fine. I used Binwalk v2.1.2b and have sasquatch installed.
Extracted file system:
_squashfs.tmp.extracted/squashfs-root $ ls
bin boot config dev etc ...
- 7,246
2
votes
Reverse Engineering Firmware Aether Cone
as my previous answer was deleted (I'm guessing because it was not an answer per se) I've got more of an answer for you.
the firmware does nothing to stop you from using UART to interact with it ...
- 21
2
votes
Accepted
Unpacking, modifying, repacking and flashing a firmware
Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used binwalk's extract option, that made it too easy; you'll want to ...
- 609
2
votes
Unable to unsquash from a FW dump
Most likely your dump includes spare (or OOB) bytes while most file formats only consider user-accessible areas. You can either figure out the dump structure and remove OOB chunks or simply re-dump ...
- 36.9k
2
votes
Harman Kardon firmware reverse engineering
Seems to be a Cortex-M (ARM Thumb-2 code), load base 0x8000000. My guess it's some STM32 model.
- 36.9k
2
votes
Disassembling ARM based Camera Firmware
You can try hikpack to unpack the firmwork. The hikpack download link: https://ipcamtalk.com/attachments/hikpack_2-5-zip.45534/.
alastair@PC-I5 ~/montecrypto $ ./hikpack_2.1 -t g0 -x ...
- 21
2
votes
Disassembling ARM based Camera Firmware
It seems the parsing logic is hidden in the U-Boot loader
tftpboot- boot image via network using TFTP protocol
update - update digicap.dav
updateb - update uboot(u-boot.bin) to nor
updatebl- update ...
- 36.9k
2
votes
Accepted
Firmware extraction of U-boot : No filesystem found via binwalk + relation between MTD partitionning and NAND subsystem
There's no need for binwalk to be further utilized for JFFS2 extraction.
Since Binwak detect ubi filesystem (and not JFFS2) it is smarter to use tools like ubireader to extract it from the firmware.
...
- 41
1
vote
binwalk guess wrong LZ4 compressed data format
I just found out that binwalk report an image size of "8717639 bytes" in uImage header. It brings me at the very end of the file as file size is 8717703 bytes (8717639 which is my uImage ...
- 35
1
vote
Accepted
Unix system with windows-style registry
This may be related to automotive. I had seen something like this in this repository, strings including /dev/registry/LOCAL_MACHINE/SOFTWARE/BLAUPUNKT are mentioned directly here.
Using word "...
- 8,528
1
vote
Decode a Windows CE nand dump
Windows CE runs in memory and isn't designed to be run from storage like normal Windows, the NAND chip only contains the binary to load into memory and sometimes the file to define the binary to load ...
- 11
1
vote
Zlib structure inside a GCC static library
Hard to tell without a look at the library in question, but my guess would be that the contained object files contain zlib-compressed debug information.
Have a look here and look for "zlib" ...
- 10.9k
1
vote
1
vote
Can an OpenWrt FIT kernel be virtualized in qemu?
I don't know anything about OpenWrt FIT format, but I've built an OpenWRT VM to run on OpenStack in the past, so virtualising your router image might be doable.
My first thought was that you build an ...
- 796
1
vote
how to extract this firmware .img?
I unpacked this stuff with binwalk -e <file_name> and got list of files like:
1A3DF
1CDD4
1F5E6
...
Their content looks like some web-document with images:
Static Routes Help Static routes give ...
- 96
1
vote
Grundfos Firmware
Looking at the entropy of a file's contents is a good way to understand whether some/all of it is compressed or encrypted. Any good compression or encryption will result in entropy in the region of ...
- 2,558
1
vote
decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)?
I read about similar issue with ZTE modem: ZTE encrypted backup config file
It was ZLIB-compressed and encrypted with AES in ECB mode with a 16-byte key. You can read this topic, maybe it can work ...
- 101
1
vote
Unable to unsquash from a FW dump
I think you have a router very similar to mine after analysing your dump. Please check PRV3399BELT for what I've found so far.
As noted before, you have dumped raw data with OOB information; that must ...
- 11
1
vote
Why do some firmware binaries have more than 1 file system structures
There can be several reasons for that:
Sometimes you want parts of it read/write which squashfs doesn't support. Other parts should always be read-only, so there squashfs would be a great fit.
Some ...
- 169
1
vote
Problem with analyzing a JFFS2 Filesystem
you can mount jffs2 file system directly
fo rmount jffs2 file system on linux
One method of mounting JFFS2 images uses the mtdram module to emulate an MTD device using system RAM. This works well ...
1
vote
Binwalk to Extract Firmware is not working for me
A few things:
Please include an entropy plot of the file using the -E flag; this will show if any portion of the file is indeed compressed or encrypted.
Please include a link to either the firmware ...
- 7,246
1
vote
Recognize binary architecture
Binwalk has this feature but you need to enable it explicitly:
-A, --opcodes
Scan target file(s) for common executable opcode signatures
A project which explicitly tries to determine an ...
- 36.9k
1
vote
Repacking an embedded initramfs
Thanks for the pointers. At least the xz.txt answers one of my questions, which is why the XZ util won't work to decompress. Although I still don't think what binwalk extracts is the exact XZ file ...
- 11
1
vote
CSR DFU File Format
I've found this project https://github.com/lorf/csr-spi-ftdi, along with info:
BlueCore 2 chips (such as BC212015) are not supported in BlueSuite 2.4 and above
what means they are intentionally try ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible