14
votes
Identify compression of this ZTE ZXV10 H201L V2 backup config file
Hypothesis: the file is encrypted
1. Absence of Compression Signatures
The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
- 7,048
9
votes
Accepted
Thought I found serial port - broke embedded device instead! Help?
Frying your board:
Just touching one single pin of a chip, or connecting it to ground over a reasonably high-resistance voltmeter, will generally not fry a board. However, there are ways to fry a ...
- 12.9k
9
votes
Question about Keeloq - A car remote control standard
To create a full duplicate, able to generate valid transmission packets you'll need the following information:
Serial Number
Button press mapping
32 bit of KeeLoq encrypted data
See attached Figure ...
- 11.7k
8
votes
Accepted
Identify compression of this ZTE ZXV10 H201L V2 backup config file
The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
- 96
8
votes
Thought I found serial port - broke embedded device instead! Help?
I had to add just a few things to have a clear mind (although the other answer is really good and got my up-vote already).
Single pin touching with a probe can blow up your HW.
And I do not mean the ...
- 1,384
7
votes
Unable to extract IP camera firmware
When performing firmware analysis, examination of an entropy plot should always be the first step, since this is the fastest way of determining whether the file is compressed or encrypted.
In this ...
- 7,048
6
votes
Does a Motorola SREC file give me any additional information over a binary ROM image?
Usually you only get addresses and raw bytes, but some tools/compilers may use custom record types or add extra information. For example, Tasking VX toolchain for Tricore uses an S0 record for ...
- 36.2k
5
votes
How to find Bootloader Load Address?
Download link: WAG120N Downloads
Firmware binary:
$ md5sum WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin
52d6fa830e31ff96289f8aa41ac713af WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin
Version: Annex B - ...
- 7,048
5
votes
C-sky CPU reverse-engineering
It seems very likely that this chip is indeed MIPS, so any MIPS disassembler should work. Remember to try both little-endian and big-endian variants. For finding the entrypoint, see here: Reverse ...
- 36.2k
5
votes
Reverse Engineering ZyXel C1100Z modem firmware
The password seems to be generated dynamically from /etc/profile
...
# generate login files
echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd
echo "root::0:root,...
- 1,331
5
votes
Accepted
How does QPST work and how can I make an app like it?
There is an open source project: openpst, which reimplements most functionality of the qpst tool.
Some of the protocols used are:
diag - used to read nv memory, and switch to dload mode using ...
- 1,829
5
votes
Accepted
Binwalk does not show anything when process binary
I tried:
$> binwalk --opcodes Image1.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
348 0x15C ...
- 18.8k
4
votes
C-sky CPU reverse-engineering
To clarify this thread:
C-Sky CPU's are a 16/32 bit variable length instruction set ISA in SoC & PoC packages, that appear to be MIPS-like, that can be switched to execute code in big or little ...
- 41
4
votes
Accepted
Help deciphering binary that creates 3 passwords
Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this:
char input_file_buffer[...
- 12.9k
4
votes
Accepted
Is it possible copy and save bootloader using CLI telnet commands?
The bootloader is in the flash, so you have to dump it first by using:
dd if=/dev/mtd0 of=/tmp/mtd0
or
nandump -of /tmp/mtd0 /dev/mtd0
After it you have to copy to an SD card, USB device or send ...
- 1,759
4
votes
Help mounting jffs2 dumped from NAND flash.
It's hard to say without the image but at a guess, maybe you did not properly strip the OOB bytes from the dump, or the block size is wrong.
Instead of mounting it maybe try just extracting the files ...
- 36.2k
4
votes
Accepted
TP-Link encrypted backup file TX-VG1530
It seems they also added compression there.
This utility seems to decode it: https://www.nirsoft.net/utils/router_password_recovery.html
Also, I'd just written my own decoder and encoder for it:
https:...
- 156
4
votes
Accepted
Extract firmware images from COTS embedded devices
As this question is quite general, it'll be difficult to provide a very technical answer.
You've asked quite a few questions here, so please let me start with a general overview and then proceed to ...
- 11.7k
4
votes
Jump in the middle of an instruction Coldfire firmware
It does look like a size optimization employed in some microcontrollers, although I haven't seen it used around subroutine calls. In particular, CodeWarrior compiler for HC08 and HC12 used it to ...
- 36.2k
4
votes
Accepted
Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message
Binary
MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127.
In a 7-bit binary number:
the bit on the right represents a decimal value of 1.
the next bit to the left ...
- 236
4
votes
Accepted
What could a firmware image be, if not embedded linux?
There are plenty of non-Linux solutions for embedded systems, ranging from an RTOS such as eCos, FreeRTOS, ThreadX, Nucleus and many others to a completely monolithic, custom made firmware without any ...
- 36.2k
3
votes
Limited BusyBox shell
The command you need is chsh (change shell) - this is part of the
shadow or shadow-utils package.
You can also manually edit /etc/password to change the shell from
/bin/ash to something else:
BUT => ...
- 131
3
votes
Locating Memory Allocation Functions from Static Analysis
I'd approach this problem as follows:
Check for logging strings. Probably you'll find there something related to allocations which will solve the problem.
Find all functions with 1 argument (size for ...
- 8,343
3
votes
Adding additional language to Linux based Firmware of Volkswagen Car Radio
As binwalk points out, this file is a compiled executable, and you don't even need binwalk for it:
$ file hmi
hmi: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, ...
- 619
3
votes
How does QPST work and how can I make an app like it?
Use the sniffer for the communication channel it uses (most likely USB) to see which data is sent to your device. Try to search for the constants you see in the sniffer to find which binary may be ...
- 1,830
3
votes
Jump in the middle of an instruction Coldfire firmware
Now that you have shown us bit more of the code, a pattern is starting to emerge.
jsr unk_A75E ; This function does not exist.
...
jsr (loc_576A+2).l ; ...points in the middle of an ...
- 226
3
votes
Accepted
Jump in the middle of an instruction Coldfire firmware
These phenomena may be explained by the technique used to write the code on the flash. The fact that code is structured in two parts would allow the developers to write the code in the flash in two ...
- 335
3
votes
Help needed to extract u-boot kernel & rootfs - nxp lpc 3143 processor
LPC3143 supports secure boot so probably this device has been configured for it. From the datasheet:
Features
– On the LPC3143 only: secure booting using an AES decryption engine from ...
- 36.2k
3
votes
Accepted
How to identify memory access locations
If you have loaded the binary into IDA and the data has no references, I would suggest, you have loaded the binary into the wrong address space.. Or it's referenced in a relative fashion and you have ...
- 932
3
votes
Accepted
Identify unknown Atmel chip
https://www.waveshare.net/datasheet/ATMEL_PDF/AT24C512C.PDF
|---|---|---|---|---|---|---|---|
A T M L H Y W W
|---|---|---|---|---|---|---|---|
2 F C M @
|---|---|...
- 441
Only top scored, non community-wiki answers of a minimum length are eligible