11 votes
Accepted

Extracting a NAND flash dump with OOB data

So, I have figured it out myself in the end. I'll try to describe the process. First, a bit of background on NAND: it is organized in pages which are grouped into blocks. You can read or write a ...
Igor Skochinsky's user avatar
  • 36.6k
6 votes

Extracting a NAND flash dump with OOB data

I am a developer of the Rockbox open-source project. We figured out the encryption of the firmware upgrade a look time ago by essentially doing the same thing (dumping the chip). upgtool can extract ...
Amaury Pouly's user avatar
3 votes

How to dump a firmware from an old cell phone with Linux?

Looks like Wiko use Android as OS [based on http://www.wikogeek.com/], so Android tricks should work here as well. If you need access to SoC on RDA8851CL in more "user-friendly" way, try to connect ...
Denis Laskov's user avatar
  • 2,438
3 votes
Accepted

How to get root access on Linux embedded system?

I think the U-Boot console is a good entry point. Some ideas: Add single to the kernel command line to boot in single user mode (no password). The mmc command could allow flash dumping. ext2/ext4 ...
Igor Skochinsky's user avatar
  • 36.6k
3 votes

Finding a malware object inside PE file

This is likely something specific to the AV. A few possibilities come to mind: an archive member in case the exe has an embedded archive overlay area (data beyond the area covered by sections) PE ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

Finding a malware object inside PE file

You don't have a reliable way of knowing what that naming schema means more than reverse engineering your AV software itself. Some AVs have the option to dump the malware. Maybe yours does, but it is ...
0xfede7c8's user avatar
  • 243
2 votes

Extracting a NAND flash dump with OOB data

Just a fast answer as future tip for NAND issues. When make reading of NAND flashes (doesn't care if bga, tsop..), not all programmers make clear dump, normally it includes dummy blocks as you ...
numind's user avatar
  • 153
2 votes

Dump firmware from MC9S08EL32 MCU

I suggest you to look at the USBDM project which claims to support BDM (background debug mode) for the RS08 and HCS08 series, among others, which I think should be compatible with your chip. Even ...
Igor Skochinsky's user avatar
  • 36.6k
2 votes

Certain bytes in the memory (RAM) get changed after the program starts. Why?

The magic might be TLS callbacks that run before entry point is reached. This behavior is well documented, see for example the following article: https://isc.sans.edu/diary/How+Malware+Defends+Itself+...
MazeGen's user avatar
  • 143
1 vote

How to dump firmware from car head-unit (VW Radio)

It is a bit of a chicken and egg issue here. While it may be possible that there is some custom USB command to dump the firmware, you’re unlikely to discover it by chance without analyzing actually ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Finding a malware object inside PE file

The value could well be an absolute offset within the file, though it seems unlikely. CIH inserted itself into spaces between the end of the file header and the start of the section, and between the ...
peter ferrie's user avatar
  • 4,709
1 vote

Need script to analyze process dump file (windows)

If you really want to do the whole thing yourself, you need to use the Debugger Engine APIs, in particular OpenDumpFile and friends. If you only need to automate it but no particular requirements for ...
Igor Skochinsky's user avatar
  • 36.6k
1 vote

Dump data from segments.io /segment.com with apikey

Sure. The API endpoint is https://api.segment.io/ - it seems to be a REST interface. You can find the software documentation here. Also there seems to be a broad range of integrations to parse and ...
Nordwald's user avatar
  • 2,906

Only top scored, non community-wiki answers of a minimum length are eligible