6
votes
Accepted
Problems with extracting firmware
TL;DR
Yes the file is encrypted, it is a simple XOR cipher with a key length of 0x800 bytes.
Python script for getting decrypted firmware:
import struct
FILENAME = "HW718V40_20171008.firmware"
...
- 76
5
votes
Accepted
BIOS first jump leads to empty memory
You need to load the last 64KB of the ROM at linear address 0xF0000 (0xF000:0000) and create there a 16-bit segment with the base 0xF000. Then all your “low addresses” will line up (they point into ...
- 36.4k
4
votes
Accepted
GDB: Could not load shared library symbols
Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there.
...
- 245
4
votes
Accepted
Dumping a NAND Flash
It seems you have an SPI NAND chip and not a more common SPI NOR on which flashrom specializes. The support for SPI NAND in flashrom is pretty new, covers only Toshiba and Micron for now and is not ...
- 36.4k
4
votes
Accepted
Harman Kardon firmware reverse engineering
If you run strings on your firmware file, you can typically get a lot of helpful information. In this case, since I don't know what your device is other than a Harman Kardon "something," I ...
- 310
3
votes
Accepted
How to make sense of RTOS in firmware?
Most RTOS code is usually a single monolithic binary and is not split into separate binaries like a high-level OS. Usually there is some startup code, some library routines and user-provided code in ...
- 36.4k
3
votes
BIOS first jump leads to empty memory
Your disassembly doesn't show enough memory to know if the target is empty memory, but the x86 segmentation model means that the jump target for 0xF000:E205 is 0xFE205 (i.e. the (0xF000 << 4) + ...
- 4,701
3
votes
Tektronix firmware XOR puzzle
It is just addition/subtraction (mod 256).
#!/usr/bin/python3
# These key bytes are the two's complement of the hex sequence mentioned in the question.
# The string appears twice in the decrypted ...
- 911
2
votes
ECU tune and reverse engineering
It is a difficult question because there is no general answer. The layout of the FW defined by the OEM and the ECU supplier together during design phase and it might be different between ECUs and ...
- 98
2
votes
Open a NEC binary in Ghidra
Is there anything I can do to open the NEC binary dump in Ghidra?
Yes. If Ghidra does not currently support 76F0219F1 NEC processor architecture, Ghidra can be extended using SLEIGH. Here are some ...
- 7,078
2
votes
Is it possible to read a device's firmware or internal programming in computer's RAM?
The firmware for these devices is typically not directly connected to the computer, and the FPGA reads the data itself upon startup through a dedicated connection not accessible to anything else. ...
- 343
2
votes
How to determine ARM architecture from the ELF file extracted from the firmware?
There's a few other options can help you narrow down the specific architecture / core / SoC.
Identify which combinations of ARM/THUMB16/THUMB32 instructions it contains.
Look at disassembly to ...
- 2,503
2
votes
Harman Kardon firmware reverse engineering
Seems to be a Cortex-M (ARM Thumb-2 code), load base 0x8000000. My guess it's some STM32 model.
- 36.4k
2
votes
Mitsubishi MAC-577IF2-E WIFI controller Firmware file
Maybe found a better solution, see https://github.com/SwiCago/HeatPump/
Should work on all Mitsubishi devices with a CN105 connector and needs no Melcloud service.
- 21
2
votes
Disassembling ARM based Camera Firmware
You can try hikpack to unpack the firmwork. The hikpack download link: https://ipcamtalk.com/attachments/hikpack_2-5-zip.45534/.
alastair@PC-I5 ~/montecrypto $ ./hikpack_2.1 -t g0 -x ...
- 21
2
votes
Disassembling ARM based Camera Firmware
It seems the parsing logic is hidden in the U-Boot loader
tftpboot- boot image via network using TFTP protocol
update - update digicap.dav
updateb - update uboot(u-boot.bin) to nor
updatebl- update ...
- 36.4k
2
votes
Accepted
💻 This code does not crash on ARM (qemu). Why?
UPDATE:
Ok, so the older glibc noncompliance I re-discovered was actually fixed back then, and it is a CVE by itself, CVE-2020-6096:
https://github.com/bminor/glibc/commit/...
- 61
1
vote
Open a NEC binary in Ghidra
I'm uploaded some scratches to https://github.com/esaulenka/ghidra_v850
Currently it not usable, but any help are welcome!
- 158
1
vote
decryption of firmware file from modem/router Speedport Plus (Sercomm not ZTE)?
I read about similar issue with ZTE modem: ZTE encrypted backup config file
It was ZLIB-compressed and encrypted with AES in ECB mode with a 16-byte key. You can read this topic, maybe it can work ...
- 101
1
vote
Why do some firmware binaries have more than 1 file system structures
There can be several reasons for that:
Sometimes you want parts of it read/write which squashfs doesn't support. Other parts should always be read-only, so there squashfs would be a great fit.
Some ...
- 169
1
vote
Reverse engineering TP-Link TD-W8961N V3
Yes Ghidra is the ticket!
First you might want to re-extract RasCode (it's too small, and probably a text message saying LZMA error) I'm thinking that is now resolved so perhaps download dev-zzo/...
- 11
1
vote
Reverse engineering TP-Link TD-W8961N V3
I think this isn't a filesystem but a memory of compiled functions and resources that are used in the OS. I would suggest you opening up the file in ghidra with MIPS instruction set (either 32bit or ...
1
vote
How to dump firmware from ATWINC1510
In the datasheet that you provided are links to more reference documents. One of them is ATWINC1500 Wi-Fi Network Controller Software Design Guide. In chapter 13 is described the WINC Serial Flash ...
- 216
1
vote
I need help reverse engineering my ereader (trying to get into the shell)
The boot log seems similar to the one from this page, so there's a high possibility this device is using an AllWinner SoC. You can try the tools from the linked repository.
Another option could be to ...
- 36.4k
1
vote
Interact with a network-less Chinese MP3 player running a modified version of Linux
I was looking for the same thing and I recently found www.rockbox.org, an open source firmware for audio players. Their idea is the owners would capable to customize that firmware and make it more ...
- 11
1
vote
Extract/Repack EEPROM Dump
There is a cpio archive in the lzma compressed section
Layout of the dump.bin file:
00000000 - 00010000 bootloader, baseaddress = 0x9f000000
0000f120 - 0000f194 "bootargs=flash_part=1 uboot_version=...
- 1,829
1
vote
Analysis of BusyBox Shell router U-Boot firmware
adding single to bootargs should drop you into a root shell, e.g. try:
setenv bootargs ${bootargs_base} single ${mtdparts0}
bootm ${img0_kernel}
- 36.4k
1
vote
Accepted
`qemu-mips-static` chroot causing `Invalid ELF image` error
It seems your binaries are little-endian, so you neeed qemu-mipsel.
- 36.4k
1
vote
Open a NEC binary in Ghidra
No, unfortunately not. Look at this question, among the frequently asked questions.
According to that:
X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro,
68xxx, Java / DEX ...
- 1,797
1
vote
SqashFS 3.0 file system has 40 "random" bytes of 0xFF in it
Do these extra bytes appear at regular intervals? If so, they could be the spare or OOB(out of band) bytes which are present in most NAND chips for error checking or housekeeping (bad block management ...
- 36.4k
Only top scored, non community-wiki answers of a minimum length are eligible