14 votes
Accepted

Identifying an unknown chip on a PCB

The markings look like an Atmel part (it starts with "AT", which is common for Atmel parts). Given the size of the chip and context which you provided, I figured it was probably a serial EEPROM. ...
user avatar
  • 2,654
14 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
user avatar
  • 6,859
13 votes

How do I get the location of the original audio/video file embedded on a webpage?

Another way to find url with audio file is check get requests by Developer Tools in Chrome browser:
user avatar
12 votes

Extract files from a bin firmware

Since version 0.50, binwalk has a -e option to extract files. Unfortunately, the manual doesn't tell you this, but if you invoke binwalk -version, it tells you -e, --extract=[file] ...
user avatar
9 votes
Accepted

Trying to reverse GPS Watch firmware image with binwalk

The Garmin GCD file format is documented here, with some additional information here and here. Furthermore, it looks like somebody already wrote a tool (mirrored here) for handling and manipulating ...
user avatar
9 votes

Question about Keeloq - A car remote control standard

To create a full duplicate, able to generate valid transmission packets you'll need the following information: Serial Number Button press mapping 32 bit of KeeLoq encrypted data See attached Figure ...
user avatar
  • 11.4k
9 votes
Accepted

Thought I found serial port - broke embedded device instead! Help?

Frying your board: Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a ...
user avatar
8 votes
Accepted

Extract files from a bin firmware

You can use the -D option to dd out sections based on signature. For example, to extract out the ELF parts, do: binwalk -D "elf 32-bit lsb shared object":.so image.bin Note the lowercase signature ...
user avatar
  • 96
8 votes
Accepted

Dumping firmware through mtdblock device

As the names in /proc/mtd suggest, mtd0 is probably not a file system, but more likely is the boot loader. Likewise, the name of mtd3 suggests that it contains the saved configuration settings (admin ...
user avatar
  • 2,654
8 votes

Thought I found serial port - broke embedded device instead! Help?

I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already). Single pin touching with a probe can blow up your HW. And I do not mean the ...
user avatar
  • 1,374
8 votes
Accepted

Identify compression of this ZTE ZXV10 H201L V2 backup config file

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
user avatar
7 votes

Unable to extract IP camera firmware

When performing firmware analysis, examination of an entropy plot should always be the first step, since this is the fastest way of determining whether the file is compressed or encrypted. In this ...
user avatar
  • 6,859
6 votes

Does a Motorola SREC file give me any additional information over a binary ROM image?

Usually you only get addresses and raw bytes, but some tools/compilers may use custom record types or add extra information. For example, Tasking VX toolchain for Tricore uses an S0 record for ...
user avatar
  • 34.7k
6 votes
Accepted

Why would copying a micro SD card using dd fail to produce a bootable card?

After some searching, it seems that the boot process on the iMX233 is fairly non-standard. By default it looks for a "Boot Control Block" (BCB) in the last block of the SD card. Examining the ...
user avatar
  • 1,672
5 votes

Why would copying a micro SD card using dd fail to produce a bootable card?

Micro SD cards have a card identification register (CID) that can be read from the card. The CID contains, among other things, the product serial number and manufacturing date, which are different ...
user avatar
5 votes

How to find Bootloader Load Address?

Download link: WAG120N Downloads Firmware binary: $ md5sum WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin 52d6fa830e31ff96289f8aa41ac713af WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin Version: Annex B - ...
user avatar
  • 6,859
5 votes

C-sky CPU reverse-engineering

It seems very likely that this chip is indeed MIPS, so any MIPS disassembler should work. Remember to try both little-endian and big-endian variants. For finding the entrypoint, see here: Reverse ...
user avatar
  • 34.7k
5 votes

Reverse Engineering ZyXel C1100Z modem firmware

The password seems to be generated dynamically from /etc/profile ... # generate login files echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd echo "root::0:root,...
user avatar
  • 1,321
5 votes
Accepted

How does QPST work and how can I make an app like it?

There is an open source project: openpst, which reimplements most functionality of the qpst tool. Some of the protocols used are: diag - used to read nv memory, and switch to dload mode using ...
user avatar
5 votes
Accepted

Binwalk does not show anything when process binary

I tried: $> binwalk --opcodes Image1.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 348 0x15C ...
user avatar
  • 18.1k
4 votes
Accepted

How to start learning reverse engineering to eventually help exploiting of modern consoles like Xbox One, PS4?

Some things you will inevitably have to know at some degree to be able to reverse engineer Game Consoles: Learn a lower level language such as C or C++. Most, if not all, Console games, modern and ...
user avatar
  • 158
4 votes
Accepted

Help deciphering binary that creates 3 passwords

Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this: char input_file_buffer[...
user avatar
4 votes
Accepted

Is it possible copy and save bootloader using CLI telnet commands?

The bootloader is in the flash, so you have to dump it first by using: dd if=/dev/mtd0 of=/tmp/mtd0 or nandump -of /tmp/mtd0 /dev/mtd0 After it you have to copy to an SD card, USB device or send ...
user avatar
  • 1,731
4 votes

Help mounting jffs2 dumped from NAND flash.

It's hard to say without the image but at a guess, maybe you did not properly strip the OOB bytes from the dump, or the block size is wrong. Instead of mounting it maybe try just extracting the files ...
user avatar
  • 34.7k
4 votes

C-sky CPU reverse-engineering

To clarify this thread: C-Sky CPU's are a 16/32 bit variable length instruction set ISA in SoC & PoC packages, that appear to be MIPS-like, that can be switched to execute code in big or little ...
user avatar
4 votes
Accepted

TP-Link encrypted backup file TX-VG1530

It seems they also added compression there. This utility seems to decode it: https://www.nirsoft.net/utils/router_password_recovery.html Also, I'd just written my own decoder and encoder for it: https:...
user avatar
  • 156
4 votes
Accepted

Extract firmware images from COTS embedded devices

As this question is quite general, it'll be difficult to provide a very technical answer. You've asked quite a few questions here, so please let me start with a general overview and then proceed to ...
user avatar
  • 11.4k
4 votes

Jump in the middle of an instruction Coldfire firmware

It does look like a size optimization employed in some microcontrollers, although I haven't seen it used around subroutine calls. In particular, CodeWarrior compiler for HC08 and HC12 used it to ...
user avatar
  • 34.7k
4 votes
Accepted

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

Binary MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127. In a 7-bit binary number: the bit on the right represents a decimal value of 1. the next bit to the left ...
user avatar
  • 156
4 votes
Accepted

What could a firmware image be, if not embedded linux?

There are plenty of non-Linux solutions for embedded systems, ranging from an RTOS such as eCos, FreeRTOS, ThreadX, Nucleus and many others to a completely monolithic, custom made firmware without any ...
user avatar
  • 34.7k

Only top scored, non community-wiki answers of a minimum length are eligible