14
votes
Identify compression of this ZTE ZXV10 H201L V2 backup config file
Hypothesis: the file is encrypted
1. Absence of Compression Signatures
The relevant compression formats that Binwalk detects are as follows: bzip2, lzop, lzip, lrzip, LZO, 7z, gzip, rzip, LZMA, zlib,...
- 7,078
10
votes
Accepted
Do I have to learn computer architecture for underestanding or doing reverse engineering?
The question is too broad, but I'll try to answer and hope that it will help.
It depends on what exactly do you mean by computer architecture and area you applying your reverse engineering skills to.
...
- 8,408
9
votes
Do I have to learn computer architecture for underestanding or doing reverse engineering?
A solid understanding of the fundamentals of computer architecture is very useful for a Reverse Engineer.
That said - it depends on your target. If you are reverse engineering a Java application or a ...
- 211
8
votes
Accepted
Identify compression of this ZTE ZXV10 H201L V2 backup config file
The encryption for recent ZTE routers' config.bin is AES ECB (Electronic Code Book). The key is stored in the open in /bin/cspd next to string /cfg/db_backup_cfg.xml. The function responsible is ...
- 96
7
votes
Accepted
Understanding branch delay slots for reversing MIPS
The instruction in the branch delay slot is evaluated after the branch (or jump) instruction. The execution of the instruction in the branch delay slot does not impact the evaluation of the branch ...
- 86
6
votes
Accepted
Strange instructions pattern (lw) in MIPS binary
Like many RISC implementations, MIPS instruction set uses fixed-width 32-bit instructions, and instructions have only 16 bits for the offset field, meaning you can use only 16-bit constants, giving ...
- 36.4k
5
votes
How to find Bootloader Load Address?
Download link: WAG120N Downloads
Firmware binary:
$ md5sum WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin
52d6fa830e31ff96289f8aa41ac713af WAG120N-EU-ANNEXB-ETSI-1.00.19-code.bin
Version: Annex B - ...
- 7,078
5
votes
Reverse Engineering ZyXel C1100Z modem firmware
The password seems to be generated dynamically from /etc/profile
...
# generate login files
echo "supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd
echo "root::0:root,...
- 1,331
5
votes
Accepted
Any reason why Ghidra is screwing with this byte in this dissassembly?
This has something to do with the way Ghidra handles relocations. Loading the SLUS_204.99 binary with the following processor options and relocations disabled.
Processor: MIPS
Variant: 64-32addr
Size:...
- 6,040
4
votes
Accepted
Disassembling MIPS 32 version 1 binary with the Radare2 Framework
First of all, make sure you run the latest version of radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh
If you don’t want to install the ...
- 8,919
4
votes
Accepted
Help deciphering binary that creates 3 passwords
Your code has a function at 0x400960 that looks like a main function, and, omitting all initialization (everything gets initialized to 0) and error checking, looks like this:
char input_file_buffer[...
- 12.9k
4
votes
Accepted
Reverse Engineering MIPS Bootloader
As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try ...
- 1,759
4
votes
Accepted
Reverse engineering TP-Link TD-W8961N
I found the answer.
The router runs ZynOS and needed to be extracted using router-tools
Once downloaded, I ran the command
python zynos.py unpack TDW8961N to unpack the router frimware. All I had ...
- 203
4
votes
Accepted
Doesn't IDA Pro 6.95 support decompiling MIPS executable?
No, IDA version 6.95 doesn't support it. See hex-rays.com/products/decompiler for more details.
Regarding other news and features see decompiler news page.
Update (12/3/2020):
The original answer was ...
- 8,408
4
votes
Are there any 64 bit MIPS decompilers
https://ghidra-sre.org/
Ghidra supports a lot of processors including mips64
- 441
3
votes
Mips disassembler
Try capstone.
They have a good documentation with samples like the following:
# test1.py
from capstone import *
CODE = b"\x55\x48\x8b\x05\xb8\x13\x00\x00"
md = Cs(CS_ARCH_X86, CS_MODE_64)
for ...
- 8,408
3
votes
Mips disassembler
If you want to have quick access without installing anything, try The online disassembler.
- 12.9k
3
votes
Understanding branch delay slots for reversing MIPS
There are variations of conditional branches called "branch [ on condition] likely", e.g.
bgezl - Branch on Greater Than or Equal to Zero Likely
beql - Branch on Equal Likely
These instructions ...
- 36.4k
3
votes
The questions about li instruction
MIPS instructions are 4 bytes (32 bit) in size. Hence it's not possible to load a 32 bit constant using a single instruction.
The li $gp, 0x18B00 instruction is indeed a pseudo instruction. It's ...
- 6,040
3
votes
Are there any 64 bit MIPS decompilers
Mumbel is correct, Ghidra supports decompilation of MIPS64 binaries; see "What Processors are Currently Supported" in their FAQ.
Here is a screenshot of decompilation of the main() function ...
- 7,078
3
votes
MIPS assembly to C code
It's not really working, but I'm not sure what is wrong.
More information could help give more specific answers like what exactly is the behavior of the original program and what behavior is your ...
- 176
2
votes
Mips disassembler
you can try radare2
E:\R2>rasm2.exe -a mips -e -d -
25080268
addiu t0, t0, 0x268
40806800
mtc0 zero, t5, 0
use mips.gnu to get the output you queried
E:\R2>rasm2.exe -a mips.gnu -e -d -
...
- 16.3k
2
votes
Reverse Engineering MIPS Bootloader
From http://www.nulltrace.org/2013/04/mips-bootstrapping.html:
MIPS Bootstrapping
Bootstrapping is the process of taking a CPU just out of reset,
fetching and executing instructions serially,...
- 20.7k
2
votes
Accepted
Are there assembly instructions which both read from, and write to, memory?
Your question has been answered in comments for x86 - movsb both reads and writes to memory.
On ARM the only instructions that touch memory is "read from memory to a register" and "write a register ...
- 843
2
votes
Identify compression of this ZTE ZXV10 H201L V2 backup config file
came across these keys and sharing
Known AES keys:
zxhn h118n ert5 - 'MIK@0STzKpB%qJZe'
zxhn h118n V2.1.3_ROSCNT? - 'MIK@0STzKpB%qJZf'
zxhn h168n v3 ...
- 51
2
votes
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
qemu-system-mips full system emulation with Buildroot
This method simulate the entire MIPS CPU and can overcome limitations mentioned with userland emulation at: https://reverseengineering....
2
votes
Accepted
Radare2 to show code hints like IDA Pro?
you probably have e asm.esil set to true and e asm.emu set to false
try toggling them
radare2.exe malloc://0x4f0000
-- Hello Mr. Anderson
[0x00000000]> s 0x40abb4
[0x0040abb4]> wx ...
- 16.3k
2
votes
How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format
The firmware itself most likely is not a binary. Also usually when you run file it will tell you something like:
file busybox
busybox: ELF 32-bit MSB executable, MIPS, MIPS32 version 1. My guess is ...
- 301
2
votes
SPI Flash, how to find the System memory addresses?
I'm not too familiar with eCos, but my guess is that device address is not a memory address but the address of the hardware device used to access the SPI chip by the OS and bootloader, i.e. something ...
- 36.4k
2
votes
How to interpret disassembled MIPS code?
The columns are like follows:
address| bytes | disassembly
---------|-----------|--------------------------
f864:| 30a5ffff | sd ra,-23248(ra)
Address usually corresponds to the ...
- 36.4k
Only top scored, non community-wiki answers of a minimum length are eligible