Hot answers tagged

52 votes

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

Get Ready for an Adventure! You need a few things for your quest! Let's start at the beginning. QEMU and GDB QEMU is an emulator for various architectures. Generally, it's used to emulate an ...
user avatar
  • 2,277
14 votes

Identify compression of this ZTE ZXV10 H201L V2 backup config file

Hypothesis: the file is encrypted 1. Absence of Compression Signatures The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
user avatar
  • 6,859
10 votes
Accepted

Do I have to learn computer architecture for underestanding or doing reverse engineering?

The question is too broad, but I'll try to answer and hope that it will help. It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to. ...
user avatar
  • 7,875
9 votes

Do I have to learn computer architecture for underestanding or doing reverse engineering?

A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer. That said - it depends on your target. If you are reverse engineering a Java application or a ...
user avatar
  • 201
8 votes
Accepted

Identify compression of this ZTE ZXV10 H201L V2 backup config file

The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
user avatar
7 votes
Accepted

Understanding branch delay slots for reversing MIPS

The instruction in the branch delay slot is evaluated after the branch (or jump) instruction. The execution of the instruction in the branch delay slot does not impact the evaluation of the branch ...
user avatar
  • 86
6 votes
Accepted

Emulate TP-LINK WR740N with QEMU

I was able to get that firmware to a shell by doing the following: Unpacking the squashfs image Create a filesystem image formatted to ext2 and copying the unpacked squashfs contents into that, and ...
user avatar
  • 403
6 votes
Accepted

Strange instructions pattern (lw) in MIPS binary

Like many RISC implementations, MIPS instruction set uses fixed-width 32-bit instructions, and instructions have only 16 bits for the offset field, meaning you can use only 16-bit constants, giving ...
user avatar
  • 34.9k
5 votes

How to find Bootloader Load Address?

Download link: WAG120N Downloads Firmware binary: $ md5sum WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin 52d6fa830e31ff96289f8aa41ac713af WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin Version: Annex B - ...
user avatar
  • 6,859
5 votes

Reverse Engineering ZyXel C1100Z modem firmware

The password seems to be generated dynamically from /etc/profile ... # generate login files echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd echo "root::0:root,...
user avatar
  • 1,331
5 votes
Accepted

Any reason why Ghidra is screwing with this byte in this dissassembly?

This has something to do with the way Ghidra handles relocations. Loading the SLUS_204.99 binary with the following processor options and relocations disabled. Processor: MIPS Variant: 64-32addr Size:...
user avatar
  • 5,860
4 votes
Accepted

Reverse Engineering MIPS Bootloader

As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try ...
user avatar
  • 1,731
4 votes

Is it possible to run a flash memory dump from a production device inside of an emulator/simulator?

In order to boot from the image you'd need to figure out the hardware configuration of the device. That is what peripherals are mapped where, their operation and registers. Without a specification for ...
user avatar
4 votes
Accepted

Reverse engineering TP-Link TD-W8961N

I found the answer. The router runs ZynOS and needed to be extracted using router-tools Once downloaded, I ran the command python zynos.py unpack TDW8961N to unpack the router frimware. All I had ...
user avatar
4 votes
Accepted

Help deciphering binary that creates 3 passwords

Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this: char input_file_buffer[...
user avatar
4 votes
Accepted

Doesn't IDA Pro 6.95 support decompiling MIPS executable?

No, IDA version 6.95 doesn't support it. See hex-rays.com/products/decompiler for more details. Regarding other news and features see decompiler news page. Update (12/3/2020): The original answer was ...
user avatar
  • 7,875
4 votes
Accepted

Disassembling MIPS 32 version 1 binary with the Radare2 Framework

First of all, make sure you run the latest version of radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $ ./sys/install.sh If you don’t want to install the ...
user avatar
  • 8,649
4 votes

Are there any 64 bit MIPS decompilers

https://ghidra-sre.org/ Ghidra supports a lot of processors including mips64
user avatar
  • 390
3 votes

Mips disassembler

Try capstone. They have a good documentation with samples like the following: # test1.py from capstone import * CODE = b"\x55\x48\x8b\x05\xb8\x13\x00\x00" md = Cs(CS_ARCH_X86, CS_MODE_64) for ...
user avatar
  • 7,875
3 votes

Mips disassembler

If you want to have quick access without installing anything, try The online disassembler.
user avatar
3 votes

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

You can try to connect remote gdbserver using radare2 tool, with a following line: r2 -a mips gdb://[address]
user avatar
3 votes
Accepted

How to disassemble/run mips ELF file ? (with readelf error)

This file is completely valid ELF, but you have a problem with the toolchain. You should check correctness of its setup. In addition if you don't have the hardware you can use qemu to run it. There ...
user avatar
  • 7,875
3 votes
Accepted

Reverse engineering Devolo firmware

Each section in the firmware file has a crc32 over its contents. See this. It should make option 1 more viable. More details: Inside the squashfs image there's whole heap of busybox based tools and ...
user avatar
  • 881
3 votes

Understanding branch delay slots for reversing MIPS

There are variations of conditional branches called "branch [ on condition] likely", e.g. bgezl - Branch on Greater Than or Equal to Zero Likely beql - Branch on Equal Likely These instructions ...
user avatar
  • 34.9k
3 votes

The questions about li instruction

MIPS instructions are 4 bytes (32 bit) in size. Hence it's not possible to load a 32 bit constant using a single instruction. The li $gp, 0x18B00 instruction is indeed a pseudo instruction. It's ...
user avatar
  • 5,860
3 votes

Are there any 64 bit MIPS decompilers

Mumbel is correct, Ghidra supports decompilation of MIPS64 binaries; see "What Processors are Currently Supported" in their FAQ. Here is a screenshot of decompilation of the main() function ...
user avatar
  • 6,859
3 votes

MIPS assembly to C code

It's not really working, but I'm not sure what is wrong. More information could help give more specific answers like what exactly is the behavior of the original program and what behavior is your ...
user avatar
2 votes

Convert C to MIPS assembly code?

It is one of the questions where you'll get much more knowledge if you do it yourself. To do this you have to install and use MIPS compiler and MIPS disassembler. Command line with QNX toolchain: ...
user avatar
  • 7,875
2 votes

Using USB JTAG probe with ARM & MIPS

I have used the following devices successfully with OpenOCD: https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD/ (only ARM) http://amontec.axianet.ch/jtagkey/jtagkey (multi-architecture) The Bus ...
user avatar
2 votes

Using USB JTAG probe with ARM & MIPS

Have you seen the Bus Blaster? It is an FT2232 based board which has both ARM and MIPS eJTAG support. The Bus Pirate (also sold by Dangerous Prototypes) also has the ability to perform JTAG, but it ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible