Hot answers tagged

11

So, I have figured it out myself in the end. I'll try to describe the process. First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a single page at a time but erasing (which turns all bits to 1s (so bytes to FFs)) can be only done one block at a time (writing can only change bits from 1 to 0 but ...


6

I am a developer of the Rockbox open-source project. We figured out the encryption of the firmware upgrade a look time ago by essentially doing the same thing (dumping the chip). upgtool can extract the firmware from UPG tools, those can be extracted from the firmware upgrade installer using cabextract and looking at the file Data/Device/NW_WM_FW.UPG It ...


3

Looks like Wiko use Android as OS [based on http://www.wikogeek.com/], so Android tricks should work here as well. If you need access to SoC on RDA8851CL in more "user-friendly" way, try to connect to it with adb: For Windows: http://kernel.wikomobile.com/WIKO_Android_USB_Driver.zip For Linux: Follow the following manual from XDA: https://forum.xda-...


3

This is likely something specific to the AV. A few possibilities come to mind: an archive member in case the exe has an embedded archive overlay area (data beyond the area covered by sections) PE resources ...something else... 0513 seems to be too small to be an offset so I suspect it's a sequence number. To know more you'll probably need to RE the AV ...


2

You don't have a reliable way of knowing what that naming schema means more than reverse engineering your AV software itself. Some AVs have the option to dump the malware. Maybe yours does, but it is not likely the case because the regular user would never use that feature and it may be risky. You can use a tool like: Virustotal To preprocess your file ...


2

Just a fast answer as future tip for NAND issues. When make reading of NAND flashes (doesn't care if bga, tsop..), not all programmers make clear dump, normally it includes dummy blocks as you mentioned OOB data. As NAND dumps should be multiple of 8, like 64, 128, 256MB...if the file you dump is larger than typical size, e.g. 132MB, then is mandatory to ...


2

I suggest you to look at the USBDM project which claims to support BDM (background debug mode) for the RS08 and HCS08 series, among others, which I think should be compatible with your chip. Even though they talk about Codewarrior, in theory the source code should allow you to implement your own code dumping tool.


2

The magic might be TLS callbacks that run before entry point is reached. This behavior is well documented, see for example the following article: https://isc.sans.edu/diary/How+Malware+Defends+Itself+Using+TLS+Callback+Functions/6655


1

It is a bit of a chicken and egg issue here. While it may be possible that there is some custom USB command to dump the firmware, you’re unlikely to discover it by chance without analyzing actually running firmware. About the only possibility I can think of is DFU (Device Firmware Update) which is a semi-standard protocol for updating firmware of USB ...


1

The value could well be an absolute offset within the file, though it seems unlikely. CIH inserted itself into spaces between the end of the file header and the start of the section, and between the end of one section and the start of the next, etc. It changed the PE entrypoint field to point to itself so that it ran immediately. If you use a disassembler ...


1

If you really want to do the whole thing yourself, you need to use the Debugger Engine APIs, in particular OpenDumpFile and friends. If you only need to automate it but no particular requirements for programming it on your own, I would suggest just using windbg with some scripts (maybe PyKd framework).


1

Sure. The API endpoint is https://api.segment.io/ - it seems to be a REST interface. You can find the software documentation here. Also there seems to be a broad range of integrations to parse and read the data here. Please also know that the system uses a WriteKey and a ReadKey apparently, but I can not deduce which one you have. If you want to write ...


Only top voted, non community-wiki answers of a minimum length are eligible