Skip to main content
14 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
julian's user avatar
  • 7,158
10 votes
Accepted

Do I have to learn computer architecture for underestanding or doing reverse engineering?

The question is too broad, but I'll try to answer and hope that it will help. It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to. ...
w s's user avatar
  • 8,508
9 votes

Do I have to learn computer architecture for underestanding or doing reverse engineering?

A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer. That said - it depends on your target. If you are reverse engineering a Java application or a ...
h0r53's user avatar
  • 223
8 votes
Accepted

Identify compression of this ZTE ZXV10 H201L V2 backup config file

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
user20993's user avatar
7 votes
Accepted

Understanding branch delay slots for reversing MIPS

The instruction in the branch delay slot is evaluated after the branch (or jump) instruction. The execution of the instruction in the branch delay slot does not impact the evaluation of the branch ...
ChrisG's user avatar
  • 86
6 votes
Accepted

Strange instructions pattern (lw) in MIPS binary

Like many RISC implementations, MIPS instruction set uses fixed-width 32-bit instructions, and instructions have only 16 bits for the offset field, meaning you can use only 16-bit constants, giving ...
Igor Skochinsky's user avatar
  • 36.8k
5 votes

How to find Bootloader Load Address?

Download link: WAG120N Downloads Firmware binary: $ md5sum WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin 52d6fa830e31ff96289f8aa41ac713af WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin Version: Annex B - ...
julian's user avatar
  • 7,158
5 votes

Reverse Engineering ZyXel C1100Z modem firmware

The password seems to be generated dynamically from /etc/profile ... # generate login files echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd echo "root::0:root,...
cimarron's user avatar
  • 1,341
5 votes
Accepted

Any reason why Ghidra is screwing with this byte in this dissassembly?

This has something to do with the way Ghidra handles relocations. Loading the SLUS_204.99 binary with the following processor options and relocations disabled. Processor: MIPS Variant: 64-32addr Size:...
0xec's user avatar
  • 6,090
4 votes
Accepted

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

No, IDA version 6.95 doesn't support it. See hex-rays.com/products/decompiler for more details. Regarding other news and features see decompiler news page. Update (12/3/2020): The original answer was ...
w s's user avatar
  • 8,508
4 votes
Accepted

Reverse engineering TP-Link TD-W8961N

I found the answer. The router runs ZynOS and needed to be extracted using router-tools Once downloaded, I ran the command python zynos.py unpack TDW8961N to unpack the router frimware. All I had ...
Aaron Garton's user avatar
4 votes
Accepted

Help deciphering binary that creates 3 passwords

Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this: char input_file_buffer[...
Guntram Blohm's user avatar
4 votes
Accepted

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

First of all, make sure you run the latest version of radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh If you don’t want to install the ...
Megabeets's user avatar
  • 8,999
4 votes

Are there any 64 bit MIPS decompilers

https://ghidra-sre.org/ Ghidra supports a lot of processors including mips64
mumbel's user avatar
  • 441
3 votes
Accepted

Extracting SquashFS based filesystem

I was able to extract the file system just fine. I used Binwalk v2.1.2b and have sasquatch installed. Extracted file system: _squashfs.tmp.extracted/squashfs-root $ ls bin boot config dev etc ...
julian's user avatar
  • 7,158
3 votes

Mips disassembler

Try capstone. They have a good documentation with samples like the following: # test1.py from capstone import * CODE = b"\x55\x48\x8b\x05\xb8\x13\x00\x00" md = Cs(CS_ARCH_X86, CS_MODE_64) for ...
w s's user avatar
  • 8,508
3 votes

Mips disassembler

If you want to have quick access without installing anything, try The online disassembler.
Guntram Blohm's user avatar
3 votes

Understanding branch delay slots for reversing MIPS

There are variations of conditional branches called "branch [ on condition] likely", e.g. bgezl - Branch on Greater Than or Equal to Zero Likely beql - Branch on Equal Likely These instructions ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

The questions about li instruction

MIPS instructions are 4 bytes (32 bit) in size. Hence it's not possible to load a 32 bit constant using a single instruction. The li $gp, 0x18B00 instruction is indeed a pseudo instruction. It's ...
0xec's user avatar
  • 6,090
3 votes

Are there any 64 bit MIPS decompilers

Mumbel is correct, Ghidra supports decompilation of MIPS64 binaries; see "What Processors are Currently Supported" in their FAQ. Here is a screenshot of decompilation of the main() function ...
julian's user avatar
  • 7,158
3 votes

MIPS assembly to C code

It's not really working, but I'm not sure what is wrong. More information could help give more specific answers like what exactly is the behavior of the original program and what behavior is your ...
Thomas Mouton's user avatar
2 votes

Mips disassembler

you can try radare2 E:\R2>rasm2.exe -a mips -e -d - 25080268 addiu t0, t0, 0x268 40806800 mtc0 zero, t5, 0 use mips.gnu to get the output you queried E:\R2>rasm2.exe -a mips.gnu -e -d - ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

Are there assembly instructions which both read from, and write to, memory?

Your question has been answered in comments for x86 - movsb both reads and writes to memory. On ARM the only instructions that touch memory is "read from memory to a register" and "write a register ...
Vitaly Osipov's user avatar
2 votes
Accepted

Radare2 to show code hints like IDA Pro?

you probably have e asm.esil set to true and e asm.emu set to false try toggling them radare2.exe malloc://0x4f0000 -- Hello Mr. Anderson [0x00000000]> s 0x40abb4 [0x0040abb4]> wx ...
blabb's user avatar
  • 16.4k
2 votes

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

qemu-system-mips full system emulation with Buildroot This method simulate the entire MIPS CPU and can overcome limitations mentioned with userland emulation at: https://reverseengineering....
Ciro Santilli OurBigBook.com's user avatar
2 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

came across these keys and sharing Known AES keys: zxhn h118n ert5 - 'MIK@0STzKpB%qJZe' zxhn h118n V2.1.3_ROSCNT? - 'MIK@0STzKpB%qJZf' zxhn h168n v3 ...
user33502's user avatar
2 votes

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

The firmware itself most likely is not a binary. Also usually when you run file it will tell you something like: file busybox busybox: ELF 32-bit MSB executable, MIPS, MIPS32 version 1. My guess is ...
Brandon Bryant's user avatar
2 votes

SPI Flash, how to find the System memory addresses?

I'm not too familiar with eCos, but my guess is that device address is not a memory address but the address of the hardware device used to access the SPI chip by the OS and bootloader, i.e. something ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

How to interpret disassembled MIPS code?

The columns are like follows: address| bytes | disassembly ---------|-----------|-------------------------- f864:| 30a5ffff | sd ra,-23248(ra) Address usually corresponds to the ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

How to interpret disassembled MIPS code?

The .data section is mapped to the data segment which is not executable. This is because it does not contain executable code; rather, it contains data (hence the name). As a result, when this data is ...
julian's user avatar
  • 7,158

Only top scored, non community-wiki answers of a minimum length are eligible