6 votes
Accepted

Problems with extracting firmware

TL;DR Yes the file is encrypted, it is a simple XOR cipher with a key length of 0x800 bytes. Python script for getting decrypted firmware: import struct FILENAME = "HW718V40_20171008.firmware" ...
w4kfu's user avatar
  • 76
5 votes
Accepted

BIOS first jump leads to empty memory

You need to load the last 64KB of the ROM at linear address 0xF0000 (0xF000:0000) and create there a 16-bit segment with the base 0xF000. Then all your “low addresses” will line up (they point into ...
Igor Skochinsky's user avatar
  • 36.2k
4 votes
Accepted

GDB: Could not load shared library symbols

Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there. ...
Chris Stratton's user avatar
4 votes
Accepted

Dumping a NAND Flash

It seems you have an SPI NAND chip and not a more common SPI NOR on which flashrom specializes. The support for SPI NAND in flashrom is pretty new, covers only Toshiba and Micron for now and is not ...
Igor Skochinsky's user avatar
  • 36.2k
4 votes
Accepted

Harman Kardon firmware reverse engineering

If you run strings on your firmware file, you can typically get a lot of helpful information. In this case, since I don't know what your device is other than a Harman Kardon "something," I ...
Cheibriados's user avatar
3 votes
Accepted

How to make sense of RTOS in firmware?

Most RTOS code is usually a single monolithic binary and is not split into separate binaries like a high-level OS. Usually there is some startup code, some library routines and user-provided code in ...
Igor Skochinsky's user avatar
  • 36.2k
3 votes

BIOS first jump leads to empty memory

Your disassembly doesn't show enough memory to know if the target is empty memory, but the x86 segmentation model means that the jump target for 0xF000:E205 is 0xFE205 (i.e. the (0xF000 << 4) + ...
peter ferrie's user avatar
  • 4,701
3 votes

Tektronix firmware XOR puzzle

It is just addition/subtraction (mod 256). #!/usr/bin/python3 # These key bytes are the two's complement of the hex sequence mentioned in the question. # The string appears twice in the decrypted ...
booto's user avatar
  • 901
2 votes

ECU tune and reverse engineering

It is a difficult question because there is no general answer. The layout of the FW defined by the OEM and the ECU supplier together during design phase and it might be different between ECUs and ...
0x6261627564's user avatar
2 votes

Open a NEC binary in Ghidra

Is there anything I can do to open the NEC binary dump in Ghidra? Yes. If Ghidra does not currently support 76F0219F1 NEC processor architecture, Ghidra can be extended using SLEIGH. Here are some ...
julian's user avatar
  • 7,058
2 votes

Is it possible to read a device's firmware or internal programming in computer's RAM?

The firmware for these devices is typically not directly connected to the computer, and the FPGA reads the data itself upon startup through a dedicated connection not accessible to anything else. ...
Malvineous's user avatar
2 votes

How to determine ARM architecture from the ELF file extracted from the firmware?

There's a few other options can help you narrow down the specific architecture / core / SoC. Identify which combinations of ARM/THUMB16/THUMB32 instructions it contains. Look at disassembly to ...
Ian Cook's user avatar
  • 2,503
2 votes

Harman Kardon firmware reverse engineering

Seems to be a Cortex-M (ARM Thumb-2 code), load base 0x8000000. My guess it's some STM32 model.
Igor Skochinsky's user avatar
  • 36.2k
2 votes

Mitsubishi MAC-577IF2-E WIFI controller Firmware file

Maybe found a better solution, see https://github.com/SwiCago/HeatPump/ Should work on all Mitsubishi devices with a CN105 connector and needs no Melcloud service.
Helge's user avatar
  • 21
2 votes

Disassembling ARM based Camera Firmware

You can try hikpack to unpack the firmwork. The hikpack download link: https://ipcamtalk.com/attachments/hikpack_2-5-zip.45534/. alastair@PC-I5 ~/montecrypto $ ./hikpack_2.1 -t g0 -x ...
SkYe231's user avatar
  • 21
2 votes

Disassembling ARM based Camera Firmware

It seems the parsing logic is hidden in the U-Boot loader tftpboot- boot image via network using TFTP protocol update - update digicap.dav updateb - update uboot(u-boot.bin) to nor updatebl- update ...
Igor Skochinsky's user avatar
  • 36.2k
2 votes
Accepted

💻 This code does not crash on ARM (qemu). Why?

UPDATE: Ok, so the older glibc noncompliance I re-discovered was actually fixed back then, and it is a CVE by itself, CVE-2020-6096: https://github.com/bminor/glibc/commit/...
Attila Szász's user avatar
1 vote

Open a NEC binary in Ghidra

I'm uploaded some scratches to https://github.com/esaulenka/ghidra_v850 Currently it not usable, but any help are welcome!
Alexey Esaulenko's user avatar
1 vote

decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)?

I read about similar issue with ZTE modem: ZTE encrypted backup config file It was ZLIB-compressed and encrypted with AES in ECB mode with a 16-byte key. You can read this topic, maybe it can work ...
HE9CbITb's user avatar
  • 101
1 vote

Why do some firmware binaries have more than 1 file system structures

There can be several reasons for that: Sometimes you want parts of it read/write which squashfs doesn't support. Other parts should always be read-only, so there squashfs would be a great fit. Some ...
Richi's user avatar
  • 169
1 vote

Reverse engineering TP-Link TD-W8961N V3

Yes Ghidra is the ticket! First you might want to re-extract RasCode (it's too small, and probably a text message saying LZMA error) I'm thinking that is now resolved so perhaps download dev-zzo/...
drsnooker's user avatar
1 vote

Reverse engineering TP-Link TD-W8961N V3

I think this isn't a filesystem but a memory of compiled functions and resources that are used in the OS. I would suggest you opening up the file in ghidra with MIPS instruction set (either 32bit or ...
Josip Stjepanović's user avatar
1 vote

How to dump firmware from ATWINC1510

In the datasheet that you provided are links to more reference documents. One of them is ATWINC1500 Wi-Fi Network Controller Software Design Guide. In chapter 13 is described the WINC Serial Flash ...
Rok Tavčar's user avatar
1 vote

I need help reverse engineering my ereader (trying to get into the shell)

The boot log seems similar to the one from this page, so there's a high possibility this device is using an AllWinner SoC. You can try the tools from the linked repository. Another option could be to ...
Igor Skochinsky's user avatar
  • 36.2k
1 vote

Interact with a network-less Chinese MP3 player running a modified version of Linux

I was looking for the same thing and I recently found www.rockbox.org, an open source firmware for audio players. Their idea is the owners would capable to customize that firmware and make it more ...
Rdest DJ's user avatar
1 vote

Extract/Repack EEPROM Dump

There is a cpio archive in the lzma compressed section Layout of the dump.bin file: 00000000 - 00010000 bootloader, baseaddress = 0x9f000000 0000f120 - 0000f194 "bootargs=flash_part=1 uboot_version=...
Willem Hengeveld's user avatar
1 vote

Analysis of BusyBox Shell router U-Boot firmware

adding single to bootargs should drop you into a root shell, e.g. try: setenv bootargs ${bootargs_base} single ${mtdparts0} bootm ${img0_kernel}
Igor Skochinsky's user avatar
  • 36.2k
1 vote
Accepted

`qemu-mips-static` chroot causing `Invalid ELF image` error

It seems your binaries are little-endian, so you neeed qemu-mipsel.
Igor Skochinsky's user avatar
  • 36.2k
1 vote

Open a NEC binary in Ghidra

No, unfortunately not. Look at this question, among the frequently asked questions. According to that: X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro, 68xxx, Java / DEX ...
R4444's user avatar
  • 1,767
1 vote

SqashFS 3.0 file system has 40 "random" bytes of 0xFF in it

Do these extra bytes appear at regular intervals? If so, they could be the spare or OOB(out of band) bytes which are present in most NAND chips for error checking or housekeeping (bad block management ...
Igor Skochinsky's user avatar
  • 36.2k

Only top scored, non community-wiki answers of a minimum length are eligible