2022-11-12 23:18:06 +01:00
|
|
|
# Reversing Firmware
|
|
|
|
|
|
|
|
|
|
## Tools
|
2022-12-20 01:06:22 +01:00
|
|
|
|
2022-12-22 15:25:05 +01:00
|
|
|
#### Extraction
|
|
|
|
|
|
2022-11-12 23:18:06 +01:00
|
|
|
* binwalk
|
|
|
|
|
* unlzma
|
|
|
|
|
* tar
|
2022-12-22 15:25:05 +01:00
|
|
|
|
2022-11-12 23:18:06 +01:00
|
|
|
* [fat](https://github.com/attify/firmware-analysis-toolkit.git)
|
|
|
|
|
* Create usable environment and start firmware inside it
|
|
|
|
|
```sh
|
|
|
|
|
./fat.py <firmware>
|
|
|
|
|
```
|
2022-12-22 15:25:05 +01:00
|
|
|
* [Firmware-Mod-Kit](https://github.com/rampageX/firmware-mod-kit.git) contains `extract-firmware.sh`
|
2022-11-12 23:18:06 +01:00
|
|
|
* [Jefferson](https://github.com/sviehb/jefferson) or AUR package `jefferson-git`
|
2022-12-22 15:25:05 +01:00
|
|
|
* [squashfs-tools](https://github.com/plougher/squashfs-tools)
|
|
|
|
|
* [squashfs-tools-ng](https://github.com/AgentD/squashfs-tools-ng.git)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### Dynamic Analysis
|
|
|
|
|
|
|
|
|
|
gdb (remote debugging feature) and qemu.
|
|
|
|
|
|
|
|
|
|
### Enumeration
|
|
|
|
|
|
|
|
|
|
* [Firmwalker](https://github.com/craigz28/firmwalker.git)
|
|
|
|
|
* An image may contain files like
|
|
|
|
|
* Usernames and Passwords
|
|
|
|
|
* __Keys__ and __Paraphrase__ for gpg keys. Import them
|
|
|
|
|
```sh
|
|
|
|
|
grep -ir -E "key|paraphrase"
|
|
|
|
|
```
|
|
|
|
|
* URLS
|
|
|
|
|
* Email Addresses
|
2022-11-12 23:18:06 +01:00
|
|
|
|
2022-12-20 01:06:22 +01:00
|
|
|
|
2022-11-12 23:18:06 +01:00
|
|
|
* Check image via `strings`
|
|
|
|
|
* Check CRC via `cksum -a crc <image>`
|
2022-12-22 15:25:05 +01:00
|
|
|
|
|
|
|
|
### Binwalk
|
|
|
|
|
|
|
|
|
|
Use the following for file entropy check. If the image is encrypted it will be stated as "rising entropy edge".
|
|
|
|
|
```sh
|
|
|
|
|
binwalk -E -N <firmware>
|
|
|
|
|
```
|
|
|
|
|
|
2022-11-12 23:18:06 +01:00
|
|
|
* Use `binwalk` to extract. There are to methods
|
|
|
|
|
* `-e` extract by offset
|
|
|
|
|
* `--dd=".*"` by file extension
|
|
|
|
|
|
2022-12-20 01:06:22 +01:00
|
|
|
### Mount Squashfs
|
|
|
|
|
|
|
|
|
|
Extract the filesystem of a firmware image
|
|
|
|
|
|
|
|
|
|
* Use `squashfs-tools`
|
|
|
|
|
* Extract via binwalk and
|
|
|
|
|
```sh
|
|
|
|
|
unsquashfs <SquashFS image>
|
|
|
|
|
mksquashfs squashfs-root filesystem.squashfs
|
|
|
|
|
mount filesystem.squashfs /mtn/squash
|
|
|
|
|
```
|
|
|
|
|
|
2022-11-12 23:18:06 +01:00
|
|
|
### Mount JFFS2 File
|
2022-12-20 01:06:22 +01:00
|
|
|
|
2022-11-12 23:18:06 +01:00
|
|
|
* Use kernel where `CONFIG_MTD_RAM` is set. Using Arch this is any kernel before `5.10`
|
|
|
|
|
```sh
|
|
|
|
|
rm -rf /dev/mtdblock0
|
|
|
|
|
mknod /dev/mtdblock0 b 31 0
|
|
|
|
|
mkdir /mnt/jffs2
|
|
|
|
|
modprobe jffs2
|
|
|
|
|
modprobe mtdram
|
|
|
|
|
modprobe mtdblock
|
|
|
|
|
dd if=<jffs2File> of=/dev/mtdblock0
|
|
|
|
|
mount -t jffs2 /dev/mtdblock0 /mnt/jffs2/
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Tips & Tricks
|
2022-12-20 01:06:22 +01:00
|
|
|
|
2022-11-12 23:18:06 +01:00
|
|
|
* Watch out for `HNAP` and `JNAP` as [an attack vector](https://routersecurity.org/hnap.php)
|
