6
votes
Accepted
Problems with extracting firmware
TL;DR
Yes the file is encrypted, it is a simple XOR cipher with a key length of 0x800 bytes.
Python script for getting decrypted firmware:
import struct
FILENAME = "HW718V40_20171008.firmware"
...
- 76
5
votes
Accepted
BIOS first jump leads to empty memory
You need to load the last 64KB of the ROM at linear address 0xF0000 (0xF000:0000) and create there a 16-bit segment with the base 0xF000. Then all your “low addresses” will line up (they point into ...
- 35.8k
4
votes
Accepted
GDB: Could not load shared library symbols
Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there.
...
- 245
4
votes
Accepted
Dumping a NAND Flash
It seems you have an SPI NAND chip and not a more common SPI NOR on which flashrom specializes. The support for SPI NAND in flashrom is pretty new, covers only Toshiba and Micron for now and is not ...
- 35.8k
4
votes
Accepted
Harman Kardon firmware reverse engineering
If you run strings on your firmware file, you can typically get a lot of helpful information. In this case, since I don't know what your device is other than a Harman Kardon "something," I ...
- 310
3
votes
Accepted
How to make sense of RTOS in firmware?
Most RTOS code is usually a single monolithic binary and is not split into separate binaries like a high-level OS. Usually there is some startup code, some library routines and user-provided code in ...
- 35.8k
3
votes
BIOS first jump leads to empty memory
Your disassembly doesn't show enough memory to know if the target is empty memory, but the x86 segmentation model means that the jump target for 0xF000:E205 is 0xFE205 (i.e. the (0xF000 << 4) + ...
- 4,691
3
votes
Tektronix firmware XOR puzzle
It is just addition/subtraction (mod 256).
#!/usr/bin/python3
# These key bytes are the two's complement of the hex sequence mentioned in the question.
# The string appears twice in the decrypted ...
- 881
2
votes
ECU tune and reverse engineering
It is a difficult question because there is no general answer. The layout of the FW defined by the OEM and the ECU supplier together during design phase and it might be different between ECUs and ...
- 88
2
votes
Open a NEC binary in Ghidra
Is there anything I can do to open the NEC binary dump in Ghidra?
Yes. If Ghidra does not currently support 76F0219F1 NEC processor architecture, Ghidra can be extended using SLEIGH. Here are some ...
- 7,018
2
votes
Is it possible to read a device's firmware or internal programming in computer's RAM?
The firmware for these devices is typically not directly connected to the computer, and the FPGA reads the data itself upon startup through a dedicated connection not accessible to anything else. ...
- 341
2
votes
How to determine ARM architecture from the ELF file extracted from the firmware?
There's a few other options can help you narrow down the specific architecture / core / SoC.
Identify which combinations of ARM/THUMB16/THUMB32 instructions it contains.
Look at disassembly to ...
- 2,504
2
votes
Harman Kardon firmware reverse engineering
Seems to be a Cortex-M (ARM Thumb-2 code), load base 0x8000000. My guess it's some STM32 model.
- 35.8k
2
votes
Disassembling ARM based Camera Firmware
You can try hikpack to unpack the firmwork. The hikpack download link: https://ipcamtalk.com/attachments/hikpack_2-5-zip.45534/.
alastair@PC-I5 ~/montecrypto $ ./hikpack_2.1 -t g0 -x ...
- 21
2
votes
Disassembling ARM based Camera Firmware
It seems the parsing logic is hidden in the U-Boot loader
tftpboot- boot image via network using TFTP protocol
update - update digicap.dav
updateb - update uboot(u-boot.bin) to nor
updatebl- update ...
- 35.8k
2
votes
Accepted
💻 This code does not crash on ARM (qemu). Why?
UPDATE:
Ok, so the older glibc noncompliance I re-discovered was actually fixed back then, and it is a CVE by itself, CVE-2020-6096:
https://github.com/bminor/glibc/commit/...
- 61
1
vote
ARM - Understanding a "base address" when reversing firmware
Any code is mapped or loaded at a specific address, from which it is then executed. This can be called base address, load address, or image base. For firmware which is usually optimized to run from ...
- 35.8k
1
vote
Open a NEC binary in Ghidra
I'm uploaded some scratches to https://github.com/esaulenka/ghidra_v850
Currently it not usable, but any help are welcome!
- 111
1
vote
decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)?
I read about similar issue with ZTE modem: ZTE encrypted backup config file
It was ZLIB-compressed and encrypted with AES in ECB mode with a 16-byte key. You can read this topic, maybe it can work ...
- 91
1
vote
Why do some firmware binaries have more than 1 file system structures
There can be several reasons for that:
Sometimes you want parts of it read/write which squashfs doesn't support. Other parts should always be read-only, so there squashfs would be a great fit.
Some ...
- 169
1
vote
How to dump firmware from ATWINC1510
In the datasheet that you provided are links to more reference documents. One of them is ATWINC1500 Wi-Fi Network Controller Software Design Guide. In chapter 13 is described the WINC Serial Flash ...
- 206
1
vote
I need help reverse engineering my ereader (trying to get into the shell)
The boot log seems similar to the one from this page, so there's a high possibility this device is using an AllWinner SoC. You can try the tools from the linked repository.
Another option could be to ...
- 35.8k
1
vote
Interact with a network-less Chinese MP3 player running a modified version of Linux
I was looking for the same thing and I recently found www.rockbox.org, an open source firmware for audio players. Their idea is the owners would capable to customize that firmware and make it more ...
- 11
1
vote
Extract/Repack EEPROM Dump
There is a cpio archive in the lzma compressed section
Layout of the dump.bin file:
00000000 - 00010000 bootloader, baseaddress = 0x9f000000
0000f120 - 0000f194 "bootargs=flash_part=1 uboot_version=...
- 1,809
1
vote
Analysis of BusyBox Shell router U-Boot firmware
adding single to bootargs should drop you into a root shell, e.g. try:
setenv bootargs ${bootargs_base} single ${mtdparts0}
bootm ${img0_kernel}
- 35.8k
1
vote
Accepted
`qemu-mips-static` chroot causing `Invalid ELF image` error
It seems your binaries are little-endian, so you neeed qemu-mipsel.
- 35.8k
1
vote
Open a NEC binary in Ghidra
No, unfortunately not. Look at this question, among the frequently asked questions.
According to that:
X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro,
68xxx, Java / DEX ...
- 1,707
1
vote
SqashFS 3.0 file system has 40 "random" bytes of 0xFF in it
Do these extra bytes appear at regular intervals? If so, they could be the spare or OOB(out of band) bytes which are present in most NAND chips for error checking or housekeeping (bad block management ...
- 35.8k
1
vote
How to extract DVB firmware bin file?
I am trying to do the same.
It's a gx6605 firmware used in national chipset dvbs2 boxes. I used tuxbox tool to extract the cramfs files, but it only extracts the themes and xml files. Nothing useful.
...
1
vote
Can't decompress firmware
The binary is likely scrambled. At least the one for mine (Eleaf) is. Maybe there is a chance to read the unscrambled image out of the hardware using JTAG (if not disabled)
The Eleaf Controller is ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible