Skip to main content
14 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
julian's user avatar
  • 7,168
9 votes
Accepted

Thought I found serial port - broke embedded device instead! Help?

Frying your board: Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a ...
Guntram Blohm's user avatar
9 votes

Question about Keeloq - A car remote control standard

To create a full duplicate, able to generate valid transmission packets you'll need the following information: Serial Number Button press mapping 32 bit of KeeLoq encrypted data See attached Figure ...
NirIzr's user avatar
  • 11.8k
8 votes
Accepted

Identify compression of this ZTE ZXV10 H201L V2 backup config file

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
user20993's user avatar
8 votes

Thought I found serial port - broke embedded device instead! Help?

I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already). Single pin touching with a probe can blow up your HW. And I do not mean the ...
Spektre's user avatar
  • 1,384
7 votes

Unable to extract IP camera firmware

When performing firmware analysis, examination of an entropy plot should always be the first step, since this is the fastest way of determining whether the file is compressed or encrypted. In this ...
julian's user avatar
  • 7,168
6 votes

Does a Motorola SREC file give me any additional information over a binary ROM image?

Usually you only get addresses and raw bytes, but some tools/compilers may use custom record types or add extra information. For example, Tasking VX toolchain for Tricore uses an S0 record for ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes

Reverse Engineering ZyXel C1100Z modem firmware

The password seems to be generated dynamically from /etc/profile ... # generate login files echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd echo "root::0:root,...
cimarron's user avatar
  • 1,341
5 votes

How to find Bootloader Load Address?

Download link: WAG120N Downloads Firmware binary: $ md5sum WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin 52d6fa830e31ff96289f8aa41ac713af WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin Version: Annex B - ...
julian's user avatar
  • 7,168
5 votes

C-sky CPU reverse-engineering

It seems very likely that this chip is indeed MIPS, so any MIPS disassembler should work. Remember to try both little-endian and big-endian variants. For finding the entrypoint, see here: Reverse ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes
Accepted

How does QPST work and how can I make an app like it?

There is an open source project: openpst, which reimplements most functionality of the qpst tool. Some of the protocols used are: diag - used to read nv memory, and switch to dload mode using ...
Willem Hengeveld's user avatar
5 votes
Accepted

Binwalk does not show anything when process binary

I tried: $> binwalk --opcodes Image1.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 348 0x15C ...
perror's user avatar
  • 19.1k
4 votes

C-sky CPU reverse-engineering

To clarify this thread: C-Sky CPU's are a 16/32 bit variable length instruction set ISA in SoC & PoC packages, that appear to be MIPS-like, that can be switched to execute code in big or little ...
Paul Wratt's user avatar
4 votes
Accepted

Help deciphering binary that creates 3 passwords

Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this: char input_file_buffer[...
Guntram Blohm's user avatar
4 votes
Accepted

Is it possible copy and save bootloader using CLI telnet commands?

The bootloader is in the flash, so you have to dump it first by using: dd if=/dev/mtd0 of=/tmp/mtd0 or nandump -of /tmp/mtd0 /dev/mtd0 After it you have to copy to an SD card, USB device or send ...
ebux's user avatar
  • 1,759
4 votes

Help mounting jffs2 dumped from NAND flash.

It's hard to say without the image but at a guess, maybe you did not properly strip the OOB bytes from the dump, or the block size is wrong. Instead of mounting it maybe try just extracting the files ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes
Accepted

TP-Link encrypted backup file TX-VG1530

It seems they also added compression there. This utility seems to decode it: https://www.nirsoft.net/utils/router_password_recovery.html Also, I'd just written my own decoder and encoder for it: https:...
Shelwien's user avatar
  • 156
4 votes
Accepted

Extract firmware images from COTS embedded devices

As this question is quite general, it'll be difficult to provide a very technical answer. You've asked quite a few questions here, so please let me start with a general overview and then proceed to ...
NirIzr's user avatar
  • 11.8k
4 votes

Jump in the middle of an instruction Coldfire firmware

It does look like a size optimization employed in some microcontrollers, although I haven't seen it used around subroutine calls. In particular, CodeWarrior compiler for HC08 and HC12 used it to ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes
Accepted

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

Binary MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127. In a 7-bit binary number: the bit on the right represents a decimal value of 1. the next bit to the left ...
Bavi_H's user avatar
  • 306
4 votes
Accepted

What could a firmware image be, if not embedded linux?

There are plenty of non-Linux solutions for embedded systems, ranging from an RTOS such as eCos, FreeRTOS, ThreadX, Nucleus and many others to a completely monolithic, custom made firmware without any ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Limited BusyBox shell

The command you need is chsh (change shell) - this is part of the shadow or shadow-utils package. You can also manually edit /etc/password to change the shell from /bin/ash to something else: BUT => ...
Stuart Cardall's user avatar
3 votes

Adding additional language to Linux based Firmware of Volkswagen Car Radio

As binwalk points out, this file is a compiled executable, and you don't even need binwalk for it: $ file hmi hmi: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, ...
Vladislav Ivanov's user avatar
3 votes

How does QPST work and how can I make an app like it?

Use the sniffer for the communication channel it uses (most likely USB) to see which data is sent to your device. Try to search for the constants you see in the sniffer to find which binary may be ...
Anton Kukoba's user avatar
  • 1,850
3 votes

Jump in the middle of an instruction Coldfire firmware

Now that you have shown us bit more of the code, a pattern is starting to emerge. jsr unk_A75E ; This function does not exist. ... jsr (loc_576A+2).l ; ...points in the middle of an ...
Bruce Abbott's user avatar
3 votes
Accepted

Jump in the middle of an instruction Coldfire firmware

These phenomena may be explained by the technique used to write the code on the flash. The fact that code is structured in two parts would allow the developers to write the code in the flash in two ...
Alessandro's user avatar
3 votes

Help needed to extract u-boot kernel & rootfs - nxp lpc 3143 processor

LPC3143 supports secure boot so probably this device has been configured for it. From the datasheet: Features – On the LPC3143 only: secure booting using an AES decryption engine from ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

How to identify memory access locations

If you have loaded the binary into IDA and the data has no references, I would suggest, you have loaded the binary into the wrong address space.. Or it's referenced in a relative fashion and you have ...
Simeon Pilgrim's user avatar
3 votes
Accepted

Identify unknown Atmel chip

https://www.waveshare.net/datasheet/ATMEL_PDF/AT24C512C.PDF |---|---|---|---|---|---|---|---| A T M L H Y W W |---|---|---|---|---|---|---|---| 2 F C M @ |---|---|...
mumbel's user avatar
  • 441
2 votes

how to bypass CRC checksum in firmware header

You cannot bypass it, you must recalculate all required checksums. Ubiquiti XW firmware is made from parts below: UBNT <version-string> CRC32(header part) <4byte padding> PART u-boot <...
mindc's user avatar
  • 121

Only top scored, non community-wiki answers of a minimum length are eligible