Hot answers tagged

48

Get Ready for an Adventure! You need a few things for your quest! Let's start at the beginning. QEMU and GDB QEMU is an emulator for various architectures. Generally, it's used to emulate an entire PC (i.e. to run a virtual machine). However, for debugging a single program this is not necessary. On Linux, you can use QEMU User-Space emulation. $ sudo ...


14

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib, and LZ4. Since running Binwalk against H201LV2.0_Cur_config.bin returns no results even though Binwalk normally will recognize any of these compression ...


9

IDA's decompiler only supports ARM and x86. With that said, there are a couple you can try: REC - This one has already been mentioned. Last I used it, it would segfault when you issued the 'help' command, so YMMV. Retargetable Decompiler - This is an online decompiler that supports various architectures, including MIPS. It's OK at getting a general idea of ...


9

Embedded systems are commonly run on bare metal, without any BIOS. Thus the entry point is usually the reset vector which is architecture- and system-specific. You need to consult datasheets for your chip or at least the architecture to see what it says about reset vectors. For example, on ARM the default reset vector is at address 0 (except for Cortex-M ...


8

Expanding on my comment: The Freeware IDA Pro doesn't support MIPS, so you won't be able to use it. If you can't use the paid versions of IDA, there are free alternatives. As an example, using radare2 as an example, on the Debian MIPS binutils port: $ file bin/objdump bin/objdump: ELF 32-bit MSB executable, MIPS, MIPS-II version 1 (SYSV), dynamically ...


8

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is CspDBInitPdtInterface, last snprintf call. The key is zero padded if short of 128 bits. The key very much might be unique to ISP: yours H201L V2 is Renjx%2$CjM, ...


7

The output from the file utility, as you've probably guessed, is a false positive. The beginning of the firmware.bin file contains what looks to be a basic header (note the "SIG" string near the beginning of the file), and a bunch of MIPS executable code, which is likely the bootloader: DECIMAL HEX DESCRIPTION ----------------------------...


6

I was able to get that firmware to a shell by doing the following: Unpacking the squashfs image Create a filesystem image formatted to ext2 and copying the unpacked squashfs contents into that, and using that as -hda Running without -initrd ... and appending init=/bin/sh to the kernel command line Although you are not fully emulating the WR740N because ...


6

The instruction in the branch delay slot is evaluated after the branch (or jump) instruction. The execution of the instruction in the branch delay slot does not impact the evaluation of the branch condition. I have observed the branch delay slot be used for a few things: Last instruction of basic block leading up to the branch instruction Branch test will ...


5

You can give a try to radare2. It has a pretty complete support for MIPS, and provides a lot functionalities to help during the reversing process.


5

I'd start by plotting the entropy of the file by using for example binwalk which is also part of firmware-mod-kit. This will give you an idea about the layout (bootloader, 2nd stage, main fw etc) of the file and if parts or the whole file is encrypted/compressed. Next you can use the same tool and let it try to automatically find known file types and/or ...


5

I would like to second the suggestion of QEMU. Craig has a post describing how to debug a MIPS binary running in QEMU using IDA: http://www.devttys0.com/2011/09/exploiting-embedded-systems-part-3/ (you can also use GDB or another debugger speaking the GDB protocol)


5

Download link: WAG120N Downloads Firmware binary: $ md5sum WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin 52d6fa830e31ff96289f8aa41ac713af WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin Version: Annex B - Version: 1.00.19 (ETSI) Latest Date: 11/17/2014 Signature scan output: $ binwalk WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin DECIMAL HEXADECIMAL ...


5

The password seems to be generated dynamically from /etc/profile ... # generate login files echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd echo "root::0:root,supervisor,support,user" > /var/group ... You would need to try to crack the DES hash with a program like John the Ripper or replace it with another known ...


5

This has something to do with the way Ghidra handles relocations. Loading the SLUS_204.99 binary with the following processor options and relocations disabled. Processor: MIPS Variant: 64-32addr Size: 32 Endian: little Compiler: default The disassembly is the same as that of IDA. Using readelf shows that there are relocations of type R_MIPS_26 at the said ...


4

Are you sure that you need spim ? I'd suggest to use qemu instead of spim for emulation, radare2 for disassembly as @jvoisin mentioned and retargetable decompiler for decompilation if you really need it.


4

The only MIPS decompiler I know is REC. There is also this, but I didn't try it myself.


4

In order to boot from the image you'd need to figure out the hardware configuration of the device. That is what peripherals are mapped where, their operation and registers. Without a specification for both the SOC you're dealing with and the hardware board you're going to have to reverse engineer the firmware of the device. This will allow you to figure out ...


4

As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try 0x80400000 as the start address. Although I don't know a simple and exact method to calculate the start address I try to explain a little bit more how can you ...


4

Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this: char input_file_buffer[256]; int finder_id_size=16; char finder_id[16]; int temp_256=256; char finder_public_key[256]; char password[31]; int temp_32=32; char sha_buffer[256]; char ...


4

I found the answer. The router runs ZynOS and needed to be extracted using router-tools Once downloaded, I ran the command python zynos.py unpack TDW8961N to unpack the router frimware. All I had to do now was use binwalk -Y file to find out the architecture and then load the files into IDA and disassemble using https://wiki.openwrt.org/doku.php?id=...


4

First of all, make sure you run the latest version of radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh If you don’t want to install the git version or you want the binaries for another machine (Windows, OS X, iOS, etc) check out the download page at the radare2 website. To open MIPS binary with ...


4

Like many RISC implementations, MIPS instruction set uses fixed-width 32-bit instructions, and instructions have only 16 bits for the offset field, meaning you can use only 16-bit constants, giving you 64KB of addressing. However, the actual address space of a MIPS CPU is 4GB (32-bit address size), so how can you access all that? Well, there is the option ...


3

You can try to connect remote gdbserver using radare2 tool, with a following line: r2 -a mips gdb://[address]


3

This file is completely valid ELF, but you have a problem with the toolchain. You should check correctness of its setup. In addition if you don't have the hardware you can use qemu to run it. There is also aboriginal toolchain that you can try to use. Output of the readelf should be as follows: mips-unknown-nto-qnx6.5.0-readelf -a ~/Downloads/myelf ELF ...


3

I am going to take a stab at answering my own question, and may update the answer in the future with additional details about OpenOCD. There are some things that I did not understand about the Bus Blaster and there are some things that I did not understand about OpenOCD, and in both cases reading the documentation better would have helped. I ended up ...


3

Try capstone. They have a good documentation with samples like the following: # test1.py from capstone import * CODE = b"\x55\x48\x8b\x05\xb8\x13\x00\x00" md = Cs(CS_ARCH_X86, CS_MODE_64) for i in md.disasm(CODE, 0x1000): print("0x%x:\t%s\t%s" %(i.address, i.mnemonic, i.op_str)) Output sample: $ python test1.py 0x1000: push rbp 0x1001: mov ...


3

If you want to have quick access without installing anything, try The online disassembler.


3

No, it doesn't. See hex-rays.com/products/decompiler for more details. Regarding other news and features see decompiler news page.


3

There are variations of conditional branches called "branch [ on condition] likely", e.g. bgezl - Branch on Greater Than or Equal to Zero Likely beql - Branch on Equal Likely These instructions have a delay slot but the instruction in the delay slot is executed only if the branch is taken. If the branch is not taken, the instruction in the delay slot is ...


Only top voted, non community-wiki answers of a minimum length are eligible