devttys0
  • Member for 8 years, 10 months
  • Last seen more than 3 years ago
How do I extract a copy of an unknown firmware from a hardware device?
Accepted answer
21 votes

As you may suspect, it very much depends on the hardware. In general, you are correct, JTAG and/or UARTs can be often be used to get a copy of the firmware (downloading a firmware update from the ...

View answer
Tool or data for analysis of binary code to detect CPU architecture
16 votes

There are some tools that can scan binary files for common opcodes found in various architectures. Binwalk's -A option does this for example (it scans for ARM/MIPS/x86 and several other architectures)....

View answer
How to predict address space layout differences between real and gdb-controlled executions?
Accepted answer
15 votes

There could be other factors involved, but my guess would be that changes in the process environment variables, which are stored on the stack, are what's causing this issue. Running a small program ...

View answer
Identifying an unknown chip on a PCB
Accepted answer
14 votes

The markings look like an Atmel part (it starts with "AT", which is common for Atmel parts). Given the size of the chip and context which you provided, I figured it was probably a serial EEPROM. ...

View answer
RE Compressed backup file,router linux based so is it compresed with zlib?
Accepted answer
10 votes

If you look at offset 0xDF of your backup file you'll see the two bytes: 0x78 0xDA These commonly delimit the beginning of a zlib compressed file. In fact, the original XML config file has been ...

View answer
Is it possible to convert MIPS ASM to code?
Accepted answer
9 votes

IDA's decompiler only supports ARM and x86. With that said, there are a couple you can try: REC - This one has already been mentioned. Last I used it, it would segfault when you issued the 'help' ...

View answer
Reversing DLink DIR100 firmware
Accepted answer
9 votes

The LZMA compression identified by binwalk is correct (or at least most of them are - I didn't check them all). If you actually extract and decompress the LZMA files, you'll find that the first one (...

View answer
Dumping firmware through mtdblock device
Accepted answer
8 votes

As the names in /proc/mtd suggest, mtd0 is probably not a file system, but more likely is the boot loader. Likewise, the name of mtd3 suggests that it contains the saved configuration settings (admin ...

View answer
Paste hex bytes into IDA Pro Hex View
Accepted answer
8 votes

While in IDA's Hex View you can go to Edit->Patch Program->Change Byte, but I think this only lets you patch 16 bytes at a time. If you need to patch more bytes than that you can use IDAPython's idc....

View answer
What is the Ubicom32 toolchain and where can I find it?
Accepted answer
8 votes

Ubicom32 is a proprietary architecture, not at all related to ARM or MIPS (other than the fact that it is RISC...well, kind of). IIRC it was designed specifically for networking and multimedia ...

View answer
Unpack Billion 5102 firmware
Accepted answer
8 votes

The output from the file utility, as you've probably guessed, is a false positive. The beginning of the firmware.bin file contains what looks to be a basic header (note the "SIG" string near the ...

View answer
Potentially non-standard SPI communication
Accepted answer
7 votes

There is no SPI specification that dictates things like read codes or address lengths, AFAIK; these are chip-specific and have been generally standardized by vendors of SPI EEPROMs and flash chips (...

View answer
unpack Clear spot .bin firmware update
7 votes

The CramFS image is a false positive; I doubt there would be over 1 billion files in a 5MB firmware image. It looks like your binwalk signatures are a bit old; here is the output from mine (running ...

View answer
Does a Motorola SREC file give me any additional information over a binary ROM image?
Accepted answer
7 votes

Correct me if I'm wrong, but since SREC is an ASCII representation of the binary data, wouldn't the corresponding binary file also "leak" sections of data that are padded with 0x00/0xFF? With that ...

View answer
How to change a large section of bytes to words in IDA Pro
7 votes

There may be a better way of doing it, but I've always accomplished this with a simple script that lets me just select the range of bytes that I want to convert to dwords. Something like: ea = ...

View answer
How to extract N150R firmware from .img file
Accepted answer
6 votes

The SquashFS image is version 3.0 with LZMA compression; LZMA compression was not officially added to SquashFS until version 4.0, so standard SquashFS tools won't recognize it. However, sasquatch ...

View answer
Unpack & repack a firmware for use as an updated version?
6 votes

It's important to know that not all ZyNOS images are created equal, and the exact steps that worked for piotrbania (as referenced in your question) will likely not work for you. First, ZyNOS is a ...

View answer
Decompiling Modem Firmware (firmware.bin) with unknown results on binwalk
6 votes

Well, the files and archives aren't endless, but there are a lot of them. :) If you run binwalk with just the -e option (no -M), it will only extract files from the firmware.BIN image and not scan ...

View answer
Debugging ARM binary with IDA Pro and Qemu
6 votes

It sounds like you are trying to emulate an ARM ELF binary by running it directly in qemu-system-arm, in which case the reason that syscalls don't work is that there is no Linux kernel to handle these ...

View answer
Base address of shared objects from ldd output
6 votes

Yes, the base address of libc.so.6 should be 0xb7e5c000 for that binary. You can verify this by catting /proc/<pid>/maps while your application is running.

View answer
Can't seem to figure out what this binary is
5 votes

The LZMA results in the Linux kernel are likely false positives. FWIW, the latest version of binwalk (from github repo) does a much better job of filtering out LZMA false positives. Where you go from ...

View answer
How to extract the filesystem from a I240w-A firmware
Accepted answer
4 votes

All the LZMA entries appear to be valid, and decompress to tar archives (-1 is a valid file size, and is used when the compressor doesn't know the size of the original data, such as when the data is ...

View answer
What is "webcomp" and how does it work?
4 votes

Small update to 90h's answer: the key can be calculated dynamically without making assumptions about the size of any specific file. The total of all the file sizes reported in httpd should match the ...

View answer
What's the easiest way to determine the OS contained in a firmware binary?
4 votes

As 0xC0000022L already stated, strings is really the first step. Since this is a dump you obtained directly from the flash chip, there should be some readable strings (such as those from the ...

View answer
Dump Flash Memory with SPI from SPANSION FL016KIF
3 votes

First off, I would suggest ensuring that the HOLD# pin is pulled high. If it is not, the chip is in a "paused" state and you won't be able to read from it. I've dumped several SPI chips ...

View answer
Binwalk showing only the header as the full size of the binary
3 votes

That is correct. Given the size of the firmware image, I'd guess that this is not a Linux based firmware, but probably an RTOS (IIRC, Ubicom had their own RTOS called IPOS). Try doing an entropy ...

View answer
Modifying / Installing stock firmware on ISP Branded WRE2205
3 votes

A cursory examination of the two files suggests that the main difference in upgrade paths between the two binaries is that the branded one calls a function named chkfwid. If I'm reading the code ...

View answer
Windows CE + Itron RTOS image
3 votes

Actually, from the strings, it looks to me like it's using eCos, not Windows CE: $ binwalk FW_ZERO_DES.bin DECIMAL HEXADECIMAL DESCRIPTION ---------------------------------------------------...

View answer
Unsquashfs fails
3 votes

Vendors are notorious for modifying SquashFS. Historically, they have done it to patch in LZMA support, since SquashFS only officially supported gzip compression until version 4.0. Even though ...

View answer
Is possible to translate this MIPS assembly subroutine to C?
3 votes

Here is a C representation of the assembly (assuming I didn't mess anything up of course). Interestingly, the first argument to this function appears to be ignored: int sub_058A5(int unused, void *...

View answer