New answers tagged

0

The boot log seems similar to the one from this page, so there's a high possibility this device is using an AllWinner SoC. You can try the tools from the linked repository. Another option could be to dump the flash and analyze it.


0

I'm not sure how much of a spoiler you want, so I'll keep it fairly short for now. The buffer is too short Your main problem is somewhat a hint towards the solution. The logic is, if your buffer is too small, then make a new one that can fit your entire payload. By this, I mean you need to set up a stack pivot. A stack pivot allows you to move the stack ...


0

A simpler way, since you have the firmware image, is to chroot into the device's root file system (e.g. # chroot path/to/firmware /bin/sh). This will alleviate any dynamic loading issues that may be tedious to fix. The only requirement is that you have the qemu binary installed for the correct architecture.


0

It is possible that the address is relocated. The relocation table, typically named .reloc contains address "translations" for the loader, placing bytes in file offsets in different addresses in runtime.


0

Yes, this is called Position Independent Executable (PIE). It randomizes the base address of the executable. It is enabled by default nowadays in most cases by gcc/the linker. There are several ways to statically determine whether a binary is built with PIE. One method is to use file; a PIE binary reports "shared object" (since that's what it is) compared ...


2

Assuming nothing is cryptographically signed, that should be possible. You simply need to follow your steps in reverse. If you used binwalk's extract option, that made it too easy; you'll want to figure out how to unpack/pack the image manually (maybe the verbose option will provide more info on the steps taken). I realize this is a generic sounding answer, ...


1

I recommend to use IDA for this task but you can try something other. There are dozens of disassemblers. Open your app in the disassebmler, locate something like that: Scroll up and find XRef with 'qt_metacast(char const*)' (in case the binary is not stripped): .rodata:00069B90 aMainwindow_0 db 'MainWindow',0 ; DATA XREF: MainWindow::qt_metacast(...


Top 50 recent answers are included