5

There is no problem, the comment is simply informational. The TMS320C6 is a DSP and like many DSPs the architecture is optimized for fast data processing. In particular, it has a very deep pipeline and the branches have not one or two, but up to five delay slots. You can see that after the B .S2X A3 instruction there are five other instructions before the ...


4

Based on a datasheet found on Internet (http://www.lanzhi-tech.com/filedownload/99240) it seems that the ATS2815 is a chip that has everything to manage a Bluetooth speaker and, probably, it is inside a lot of different speakers, all with the same interface. According to the datasheet it has "internal ROM and internal RAM for program and data". So, ...


4

I've figured it out. One of my earlier tests had been done wrong, it turns out it is just a simple case of "add up all the firmware bytes and make sure it equals X".


3

For the ARM946E-S Technical Reference Manual, the exception vectors (including the reset vector) should be located at either 0x00000000 or 0xFFFF0000 in memory, depending on whether the Alternate vectors select bit is set. The layout of these vectors looks like: Exception | Address ----------------------------|-------------...


3

You may be right that the firmware is stored on the xt25f08b chip. It's not uncommon for firmware to be stored on a flash chip like that, and I don't see any other storage. One fairly simple way is to attach an 8-pin SOIC clip to the chip while the device is powered off, and read it over SPI. This can be done with a $5 Raspberry Pi and the open source ...


3

The original answer I posted in 2018 is somewhat out of date now. There are 2 tools that have been released in the meantime that can help with understanding what is in a binary file. One tool, ISAdetect, focuses specifically on identifying the CPU the code in an executable binary targets. It accomplishes this using machine learning. Another tool, Centrifuge, ...


3

It does appear to be MIPS 32-bit little-endian machine code. First, the file was converted from .hex to binary via $ objcopy --input-target=ihex --output-target=binary FORD_P5_STEER_RevA_v1.2.0.hex FORD_P5_STEER_RevA_v1.2.0.bin After looking at a binwalk entropy plot and a hex dump, I sliced out the first 0x00021330 bytes, because nearly everything after ...


2

Some Routers use a NVRAM for storing settings. That would give you exactly this result: No writable partitions but some binary is taking care of reading and writing to that NVRAM (wherever that might be). Check if there's anything called nvread, nvconf or something like that. If that's not successful you can always try to find a binary that uses a ...


2

To add to Igor's excellent reply. Unfortunately IDA Pro up until now does not handle TMS320C6 properly. TI DSP common pattern for the calls is to load up call address into 32 bit register and do the register branching (it has direct branching with immediate offsets as well but compiler seems to use it only for local branches within the function). IDA seems ...


2

There's a few other options can help you narrow down the specific architecture / core / SoC. Identify which combinations of ARM/THUMB16/THUMB32 instructions it contains. Look at disassembly to identify the offsets of key memory regions (code, data, flash etc) Similarly, SoCs tend to have memory mapped peripherals. Identifying what's being accessed here ...


2

This tutorial (NB: in Italian) covers recovering ATA passwords from the drive itself. Not for the faint of heart, and drive controller firmware dependent. You might also post on forum.hddguru.com as they seem like SMEs. Here's another tutorial covering different tools and techniques. There's plenty of additional information about Tandberg RDX here starting ...


2

The first bytes are the exception vectors: CODE:00000000 LDR PC, =0x1000005C CODE:00000004 ; --------------------------------------------------------------------------- CODE:00000004 LDR PC, =0x10000044 CODE:00000008 ; --------------------------------------------------------------------------- CODE:...


2

If you run strings on your firmware file, you can typically get a lot of helpful information. In this case, since I don't know what your device is other than a Harman Kardon "something," I searched through the strings in a text editor until I found the line User-Agent:Harman Kardon AVR151/AVR1510 Just to double-check the firmware does belong to ...


2

Just an idea. If you run a GoFundMe crowdfunding campaign, you can get funding from other musicians interested in seeing this happen, and with the money, pay a few professional developers to work different angles on this. By virtue of your strong opinions that everything "sucks", why don't you be the amazing you that is deep inside you, and build ...


1

There’s no “standard” format for .pkg firmware files. Most likely it’s some custom format used by the vendor, so look for a vendor-specific tutorial or simply analyze it as unknown format (i.e. .bin)


1

PKGs are (usually) installer files for macOS. If this is a normal Mac package, you can use a tool called Pacifist. However, this may not be the case. If you know the router brand, we may be able to help you more if you tell us the name.


1

Seems to be a Cortex-M (ARM Thumb-2 code), load base 0x8000000. My guess it's some STM32 model.


1

In the firmware package, the /etc/int.d/rcS startup script has these lines at the end: #for fs upgrade #/bin/sd_upgrade_fs.sh /bin/sd_upgrade_fs.sh #for factory test #sh /bin/mfg_test.sh #/bin/watchdog.sh& #/lib/modules/usb_mod #exec /usr/etc/nanoX.local And in /bin/sd_upgrade_fs.sh you can see how the initial firmware is written to the device. By ...


1

Looking at the entropy of a file's contents is a good way to understand whether some/all of it is compressed or encrypted. Any good compression or encryption will result in entropy in the region of 95% or higher. For this firmware, binwalk -E shows large areas with entropy in the 70-85% range (probably code), with other much lower (likely data) and only ...


1

I read about similar issue with ZTE modem: ZTE encrypted backup config file It was ZLIB-compressed and encrypted with AES in ECB mode with a 16-byte key. You can read this topic, maybe it can work for your modem too.


1

It is indeed valid MIPS litte-endian code: seg000:1D0121F0 A8 FF BD 27 addiu $sp, -0x58 seg000:1D0121F4 04 00 A1 AF sw $at, 0x58+var_54($sp) seg000:1D0121F8 08 00 A2 AF sw $v0, 0x58+var_50($sp) seg000:1D0121FC 0C 00 A3 AF sw $v1, 0x58+var_4C($sp) seg000:1D012200 10 00 A4 AF ...


1

binwalk easily finds the beginning of the lzma file but not the end. It is necessary to modify the files extracted with a Hexadecimal editor. I don't have the same version as you but for TD-W8961ND_V3_140305.bin: The first extracted file (in 0x14C33) contains from the offset 0x41cf many 0x00, all the following bytes must be deleted. In my version the file ...


1

I figured it out: You reset the checksum to ZEROs then you calculate CRC32 of the u boot header (from first byte to 64th byte) AA XX YY ZZ 00 00 00 00 .... the first 4 bytes are for magic word; the next 4 bytes are the checksum.


1

There can be several reasons for that: Sometimes you want parts of it read/write which squashfs doesn't support. Other parts should always be read-only, so there squashfs would be a great fit. Some vendors allow OEM-partitions that contain changes specific to that OEM, while that doesn't necessarily have to be a different filesystem it's often a filesystem ...


1

Assuming this is a firmware file, a good first step would be to identify where execution starts. You could do this by: finding the type of processor / microcontroller / system-on-chip and checking for the reset vector (try searching for product approvals, e.g. from the FCC, which might contain interior images). scanning the file for known byte sequences ...


1

I did something similar with a WiFi microscope (webcam with a lens on it). I used Ettercap for a unified man-in-the-middle attack with ARP spoofing, so that my phone and the camera communicated through my computer, and Wireshark to log the data. From there it was fairly simple to see what packets the app is sending, and what the camera is sending in response....


1

2012MBP13.smc is an incomplete firmware. If you look at the address ranges in your smc payload, it starts with 00000000 (vectors table) and then jumps to 00006800, meaning ranges 00000800 to 00006000 are missing. These ranges include the bootloader and updater. So when trying to analyze the code, it's likely missing portions. Systems from 2013 Retina to 2017 ...


1

I wanted to do the same thing, and did not get the no space left on device (I read somewhere that that error may be because of an incomplete image...), but I could not figure out how to update the image. md5sum of the original file did not change, and running sync as suggested after googling was unsuccessful as well... I went the way of extracting the jffs2 ...


1

I've found this project https://github.com/lorf/csr-spi-ftdi, along with info: BlueCore 2 chips (such as BC212015) are not supported in BlueSuite 2.4 and above what means they are intentionally try to enforce developers to use more high level tools . Above github tool should help you identify exact chip without disassembling physical device. I've checked ...


1

I was doing a similar research and apparently there's no way to read it. STC says that it's a "feature" of their microcontrollers, the bootloader protects the code. Links related to this question for anyone who might be interested: https://github.com/grigorig/stcgal/issues/7 https://embdev.net/topic/404939 https://github.com/grigorig/stcgal/issues/...


Only top voted, non community-wiki answers of a minimum length are eligible