ebux
  • Member for 6 years, 9 months
  • Last seen more than 1 year ago
Simple carving of zip file using binwalk
Accepted answer
7 votes

Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data. The following steps should be performed to extract the zip files:...

View answer
What is the command to "go to current statement" in IDA debugger?
Accepted answer
7 votes

You can navigate back to the previous position simply by pressing ESC. If you want to back to the current IP address, just press the right mouse button a select Jump to IP . Alternatively you can ...

View answer
decoding blob into original file
Accepted answer
7 votes

The blob file is compressed with zlib, so you have to decompress it first. The first 4 bytes of the blob is the decompressed size and the compressed content start at 6th byte. After the decompression ...

View answer
Zte Reverse engineering config.bin file problem
Accepted answer
6 votes

The second CRC is the CRC of the header started from 0x10 to 0x28. The following script checks the config file based on the dbcCfgFileDecry function, which verify and decompress the config file from ...

View answer
How to change address in the hex view in IDA debugger?
Accepted answer
6 votes

Click on the hex view plane and press G to change the address.

View answer
Unpack IpCam firmware - Binwalk extraction issue
Accepted answer
6 votes

Although my binwalk version extracted the files correctly to the system folder along with the zip files containing only the sysversion.txt, I shortly describe why you see only the sysversion.txt in ...

View answer
binwalk zlib data
5 votes

The differences between the binwalk results may be caused by the different version of the binwalk you use. So, check the version of your binwalk by simply running binwalk without any parameter. ...

View answer
Stepping through ARM firmware image
Accepted answer
5 votes

You can debug and even step the execution with the following ways: Emulating a code snippet. You can find the detailed steps of code snippet emulation with QEMU in hexblog. In this approach you have ...

View answer
idapython: getting a list of all segments
Accepted answer
5 votes

Try to use the Segments() from idautils. from idautils import * from idc import * from idaapi import * for ea in Segments(): print '%x-%x'%(SegStart(ea),SegEnd(ea))

View answer
Reverse engineering a base64 encoded number
5 votes

These are binary representation of double numbers encoded with base64. To understand the encoding lets see an example (I used to convert numbers to binary double representation with this page): 0.03 =...

View answer
binwalk showing "Unix path", how to extract the filesystem?
Accepted answer
4 votes

The abs file seems to contain an RTOS (real-time OS) image. In this case the code and the resources are compiled into a one large image without a real file system. So, you can't unpack or mount any ...

View answer
Is it possible copy and save bootloader using CLI telnet commands?
Accepted answer
4 votes

The bootloader is in the flash, so you have to dump it first by using: dd if=/dev/mtd0 of=/tmp/mtd0 or nandump -of /tmp/mtd0 /dev/mtd0 After it you have to copy to an SD card, USB device or send ...

View answer
Reverse Engineering MIPS Bootloader
Accepted answer
4 votes

As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try ...

View answer
Hash algorithm written in C decompiled with IDA
4 votes

Just a small addition to the previous answers. The following shift construct, asked in 3, is a widely used way to convert a byte stream into a 32-bit integer. (*(_BYTE *)(content + 7) << 24) ...

View answer
How can I extract the complete filesystem (including temp files) from a router's firmware?
4 votes

I checked the newest firmware of WNR1000v3 and I could extract /etc and /www folders without any problem using binwalk v2.0.0. You can get a lot of useful information about the whole system if you ...

View answer
binwalk cannot find gzip sections
Accepted answer
3 votes

Binwalk did not find the zlib blob because it is also encrypted. It uses the following code to decrypt the compressed data. The decryption uses a table stored in the stack, which is filled with ...

View answer
Extracting firmware BIN file
Accepted answer
3 votes

Binwalk performed a good work in this firmware file, but found too much parts. It worth to know, that Binwalk identifies types based on magic IDs and some other properties. In a typical firmware the ...

View answer
Obfuscated AES decryption assembly
3 votes

I think you identified the purpose of the functions and its parameters correctly. So, the function sub_44d84 has four parameters: (<decryptionFunction=0x1>, <IV>, <bytesToDecrypt>, &...

View answer
Is MD5 hashing of files a valid method of creating an anti-virus program?
3 votes

This paper shows why it is not the best choice using MD5 for virus signatures. You should avoid SHA-1 also, because practical collision may be possible within years. So, consider using SHA-256 or SHA-...

View answer
Extract decrypted token from EXE
Accepted answer
3 votes

Since it is a crackme, I don't want to spoiler the solution, although I try to give some hint, which may help you. The hash function may be MD5 using salt, modified IV or the hash function is used in ...

View answer
Trouble understanding this rop chain
Accepted answer
3 votes

The ROP chain uses gadgets, which are short code snippets performing a basic function. The instruction what you see in the Python script in the video are the gadgets names, which were selected in the ...

View answer
Get memory locations using IDAPython
Accepted answer
3 votes

Use GetOperandValue instead of GetOpnd to get the memory location. Python>GetOpnd(0xb77a2d99,0) __Unwind_Resume Python>'%x'%(GetOperandValue(0xb77a2d99,0)) b76fc24e

View answer
How is the IV generated from a timestamp based on this function?
Accepted answer
2 votes

why is it that the first block is successfully partially decrypted even when the IV is not completely correct?" You can understand this, if you have a look at the CBC decryption diagram. In this ...

View answer
Where Is device specific information kept on smart devices
Accepted answer
2 votes

These information pieces are generally stored in the NVRAM (Non-Volatile RAM), which is stored in one of the flash partition. To emulate a device successfully, you generally have to fill up the NVRAM ...

View answer
binwalk on reversing switch firmware
2 votes

The answer is in your binwalk log several times: 16140727 0xF649B7 eCos RTOS string reference: "eCos" This line means that your switch has an eCos RTOS (Real-Time Operating System), in ...

View answer
Invalid ELF image for this architecture
2 votes

You get this error message because the ELF is stripped. See qemu-vs-strip for more information. This problem is fixed in the latest QEMU, so you have to update your QEMU or compile the latest from ...

View answer
Multiple vendors Misfortune Cookie Router Authentication Bypass Exploit
Accepted answer
2 votes

According to TP-LINK the misfortune cookie was fixed only in firmware version TD-W8961ND_V3_150707. So, the TD_W961ND_V3_140305 is also vulnerable. Since it is a binary file you may not analyse the ...

View answer
Editing a string in a native dll
2 votes

You can find the string resources in the mui files under the folder contains resources dedicated to localization (e.g. c:\Windows\System32\en-US). The strings are in Unicode format.

View answer
Static analysis of Windows executable from a Linux platform
2 votes

In case of Windows executables, the exe file has to export only the start entry point. Other entries can be exported also, but the first exported entry will be the starting point of the executable ...

View answer
How extract this firmware file?
Accepted answer
2 votes

It is an encrypted firmware of the GBR2851T Freeview HD Digital Receiver, so you cannot extract it without the proper encryption key. If you are interested in i-CAN (ADB) internals, see the following ...

View answer