Get Ready for an Adventure!
You need a few things for your quest! Let's start at the beginning.
QEMU and GDB
QEMU is an emulator for various architectures. Generally, it's used to emulate an entire PC (i.e. to run a virtual machine). However, for debugging a single program this is not necessary. On Linux, you can use QEMU User-Space emulation.
$ sudo ...
Hypothesis: the file is encrypted
1. Absence of Compression Signatures
The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib, and LZ4. Since running Binwalk against H201LV2.0_Cur_config.bin returns no results even though Binwalk normally will recognize any of these compression ...
IDA's decompiler only supports ARM and x86. With that said, there are a couple you can try:
REC - This one has already been mentioned. Last I used it, it would segfault when you issued the 'help' command, so YMMV.
Retargetable Decompiler - This is an online decompiler that supports various architectures, including MIPS. It's OK at getting a general idea of ...
Embedded systems are commonly run on bare metal, without any BIOS. Thus the entry point is usually the reset vector which is architecture- and system-specific. You need to consult datasheets for your chip or at least the architecture to see what it says about reset vectors.
For example, on ARM the default reset vector is at address 0 (except for Cortex-M ...
Expanding on my comment:
The Freeware IDA Pro doesn't support MIPS, so you won't be able to use it. If you can't use the paid versions of IDA, there are free alternatives.
As an example, using radare2 as an example, on the Debian MIPS binutils port:
$ file bin/objdump
bin/objdump: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV),
The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is CspDBInitPdtInterface, last snprintf call. The key is zero padded if short of 128 bits.
The key very much might be unique to ISP: yours H201L V2 is Renjx%2$CjM, ...
The output from the file utility, as you've probably guessed, is a false positive. The beginning of the firmware.bin file contains what looks to be a basic header (note the "SIG" string near the beginning of the file), and a bunch of MIPS executable code, which is likely the bootloader:
DECIMAL HEX DESCRIPTION
I was able to get that firmware to a shell by doing the following:
Unpacking the squashfs image
Create a filesystem image formatted to ext2 and copying the unpacked squashfs contents into that, and using that as -hda
Running without -initrd ... and appending init=/bin/sh to the kernel command line
Although you are not fully emulating the WR740N because ...
The instruction in the branch delay slot is evaluated after the branch (or jump) instruction. The execution of the instruction in the branch delay slot does not impact the evaluation of the branch condition.
I have observed the branch delay slot be used for a few things:
Last instruction of basic block leading up to the branch instruction
Branch test will ...
I'd start by plotting the entropy of the file by using for example binwalk which is also part of firmware-mod-kit. This will give you an idea about the layout (bootloader, 2nd stage, main fw etc) of the file and if parts or the whole file is encrypted/compressed.
Next you can use the same tool and let it try to automatically find known file types and/or ...
I would like to second the suggestion of QEMU.
Craig has a post describing how to debug a MIPS binary running in QEMU using IDA:
(you can also use GDB or another debugger speaking the GDB protocol)
The password seems to be generated dynamically from /etc/profile
# generate login files
echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd
echo "root::0:root,supervisor,support,user" > /var/group
You would need to try to crack the DES hash with a program like John the Ripper or replace it with another known ...
This has something to do with the way Ghidra handles relocations. Loading the SLUS_204.99 binary with the following processor options and relocations disabled.
The disassembly is the same as that of IDA.
Using readelf shows that there are relocations of type R_MIPS_26 at the said ...
Are you sure that you need spim ?
I'd suggest to use qemu instead of spim for emulation,
radare2 for disassembly as @jvoisin mentioned and
retargetable decompiler for decompilation if you really need it.
In order to boot from the image you'd need to figure out the hardware configuration of the device. That is what peripherals are mapped where, their operation and registers. Without a specification for both the SOC you're dealing with and the hardware board you're going to have to reverse engineer the firmware of the device. This will allow you to figure out ...
As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try 0x80400000 as the start address.
Although I don't know a simple and exact method to calculate the start address I try to explain a little bit more how can you ...
Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this:
I found the answer.
The router runs ZynOS and needed to be extracted using router-tools
Once downloaded, I ran the command
python zynos.py unpack TDW8961N to unpack the router frimware. All I had to do now was use binwalk -Y file to find out the architecture and then load the files into IDA and disassemble using
No, IDA version 6.95 doesn't support it. See hex-rays.com/products/decompiler for more details.
Regarding other news and features see decompiler news page.
The original answer was written ~2017, and since then IDA added MIPS decompiler support. AFAIK it was added in version 7.5.2.
See here for comparison between decompilation and ...
First of all, make sure you run the latest version of radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
If you don’t want to install the git version or you want the binaries for another machine (Windows, OS X, iOS, etc) check out the download page at the radare2 website.
To open MIPS binary with ...
Like many RISC implementations, MIPS instruction set uses fixed-width 32-bit instructions, and instructions have only 16 bits for the offset field, meaning you can use only 16-bit constants, giving you 64KB of addressing. However, the actual address space of a MIPS CPU is 4GB (32-bit address size), so how can you access all that? Well, there is the option ...
This file is completely valid ELF, but you have a problem with the toolchain.
You should check correctness of its setup.
In addition if you don't have the hardware you can use qemu to run it.
There is also aboriginal toolchain that you can try to use.
Output of the readelf should be as follows:
mips-unknown-nto-qnx6.5.0-readelf -a ~/Downloads/myelf
Each section in the firmware file has a crc32 over its contents.
It should make option 1 more viable.
Inside the squashfs image there's whole heap of busybox based tools and a handful of standalone programs. There's one (/usr/sbin/chunk) that looked likely to have logic concerning the traversal of the firmware files. It contains a ...
I am going to take a stab at answering my own question, and may update the answer in the future with additional details about OpenOCD.
There are some things that I did not understand about the Bus Blaster and there are some things that I did not understand about OpenOCD, and in both cases reading the documentation better would have helped. I ended up ...
They have a good documentation with samples like the following:
from capstone import *
CODE = b"\x55\x48\x8b\x05\xb8\x13\x00\x00"
md = Cs(CS_ARCH_X86, CS_MODE_64)
for i in md.disasm(CODE, 0x1000):
print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str))
$ python test1.py
0x1000: push rbp
0x1001: mov ...