Reverse engineering my router's firmware with binwalk • Hacker News Board

Re: Reverse engineering my router's firmware with binwalk

#41

Post by jschwartzi » Thu, Feb 06, 2020, 5:36 PM UTC

zerocrates wrote: post #29

commandlinefan wrote: post #26

From the output I see: 23296 0x5B00 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 97476 bytes 64968 0xFDC8 XML document, version: "1.0" So it looks like the size of the bootloader should be 64968 - 23296 = 41672. But he extracts 41162: $ dd if=archer-c7.bin of=u-boot.bin.lzma bs=1 skip=23296 count=41162 Curious if anybody knows why 41162; is this a block-size alignment req…

The 41162 bytes comes from the preceding uImage header, you'll see it listed in that big description. I'm not sure what the 510 bytes of padding are, though. Just padding? A checksum?

Maybe bootloader code?

Re: Reverse engineering my router's firmware with binwalk

#42

Post by jschwartzi » Thu, Feb 06, 2020, 5:42 PM UTC

rahuldottech wrote: post #39

prashnts wrote: post #8

Earlier quoted context omitted.

Note that openwrt has a big community of contributors and not all devices/features are supported. In contrast the manufacturer firmware is at least feature complete and easy for regular users to set up.

OpenWrt is also free. Both as free software, and free of cost. When you're paying a manufacturer for a product, surely it's not too much to expect them to ship with functional software that also happens to be up-to-date and secure?

You can get that, but not at consumer-grade router prices. I have a separate router that I put behind my stand-alone cable modem. I paid for that separate router about $200.00. And another $100 for the modem. A wifi access point cost me another $100.

So it's about $400.00 for a router that has updated firmware(pfSense). Or you can cheap out and spend only $100.00. This is what you get by doing that.

Re: Reverse engineering my router's firmware with binwalk

#43

Post by fencepost » Thu, Feb 06, 2020, 5:58 PM UTC

josteink wrote: post #20

Did I read the blog wrong, or was the stock firmware too based on a OpenWRT kernel? That would be pretty hilarious if it was true.

I'm pretty sure a lot of stock firmware is based on OpenWRT or used to be, though I'm pretty sure most of them lag well behind the current version. I haven't paid much attention for a while, but I think a lot were based on Kamikaze which is more than 10 years old now.

For the vendors with access to closed-source drivers and chipset info they can likely support devices not supported on the open source packages.

Edit: Per Wikipedia, "Qualcomm's QCA Software Development Kit (QSDK) which is being used as a development basis by many OEMs is an OpenWrt derivative"

It also notes Ubiquiti's wireless router firmware as being derived from OpenWRT, but I thought I remembered discussion of Ubiquiti being derived from a different open source distribution - unless perhaps the routers and wireless devices don't share a code base.

Re: Reverse engineering my router's firmware with binwalk

#44

Post by dpcx » Thu, Feb 06, 2020, 6:00 PM UTC

leeoniya wrote: post #11

glad i flashed latest dd-wrt beta on my archer-c7 v5 :D. though my wan-facing device runs OPNSense. i actually prefer to run Tomato, but archer c7 is not broadcom :( can anyone offer advice about dd-wrt vs openwrt (considering trying openwrt).

Where can one find the dd-wrt you used for your c7? I have the same device and have been unable to get it to flash anything other than official firmware.

Re: Reverse engineering my router's firmware with binwalk

#45

Post by tenebrisalietum » Thu, Feb 06, 2020, 6:02 PM UTC

ChuckNorris89 wrote: post #5

bluesign wrote: post #4

Earlier quoted context omitted.

It is mostly related to drivers to soc, not about paying devs

So how did OpenWRT manage to build firmware with up to date components for it? The Qualcomm chips inside of it seem fairly modern for such an old kernel.

OpenWRT doesn't guarantee support of all hardware. I have a router flashed to a certain version with a newer kernel, and the Wifi doesn't work because of no driver available.

Re: Reverse engineering my router's firmware with binwalk

#46

Post by bxparks » Thu, Feb 06, 2020, 6:33 PM UTC

leeoniya wrote: post #11

glad i flashed latest dd-wrt beta on my archer-c7 v5 :D. though my wan-facing device runs OPNSense. i actually prefer to run Tomato, but archer c7 is not broadcom :( can anyone offer advice about dd-wrt vs openwrt (considering trying openwrt).

I use Gargoyle on my Archer C7 v2. This thread (https://www.gargoyle-router.com/phpbb/viewtopic.php?t=11896) says that C7 v5 is supported.

Re: Reverse engineering my router's firmware with binwalk

#47

Post by JoeAltmaier » Thu, Feb 06, 2020, 6:35 PM UTC

souprock wrote: post #40

JoeAltmaier wrote: post #35

Earlier quoted context omitted.

Um. I think they post-dated me! But I didn't go anywhere with it.

IDA Pro started as a 16-bit MS-DOS program. It's real old. I'm pretty sure I was using it back in 1992, when it was already a well-developed program. Ghidra is old too, although only recently public. It couldn't be older than Java, which is from 1996.

Cool. I did mine in 2006. Hey, those have mostly Intel disassemblers. Mine did any machine code you cared to write a dissector for.

Are they iterative? Can you add human clues/cues so they do a better job the next time?

Re: Reverse engineering my router's firmware with binwalk

#48

Post by josteink » Thu, Feb 06, 2020, 6:49 PM UTC

fencepost wrote: post #43

josteink wrote: post #20

Did I read the blog wrong, or was the stock firmware too based on a OpenWRT kernel? That would be pretty hilarious if it was true.

I'm pretty sure a lot of stock firmware is based on OpenWRT or used to be, though I'm pretty sure most of them lag well behind the current version. I haven't paid much attention for a while, but I think a lot were based on Kamikaze which is more than 10 years old now. For the vendors with access to closed-source drivers and chipset info they can likely support devices not supported on the open source packages. Edit:…

That's pretty cool. I didn't know that.

Looking into the equivalent firmware[1] for my Archer C7 v2, I didn't find any OpenWRT bits though. I was honestly a little bit disappointed.

I guess the difference between hardware revisions might be more fundamental than I assumed.

    DECIMAL       HEXADECIMAL     DESCRIPTION
    --------------------------------------------------------------------------------------------------------
    0             0x0             TP-Link firmware header, firmware version: 1.-15188.3, image version: "",
                                  product ID: 0x0, product version: -956301310, kernel load address: 0x0,
                                  kernel entry point: 0x80002000, kernel offset: 16384512, kernel length:
                                  512, rootfs offset: 855873, rootfs length: 1048576, bootloader offset:
                                  15204352, bootloader length: 0
    71520         0x11760         Certificate in DER format (x509 v3), header length: 4, sequence length: 64
    98560         0x18100         U-Boot version string, "U-Boot 1.1.4 (Mar  5 2018 - 13:57:29)"
    98736         0x181B0         CRC32 polynomial table, big endian
    131584        0x20200         TP-Link firmware header, firmware version: 0.0.3, image version: "",
                                  product ID: 0x0, product version: -956301310, kernel load address: 0x0,
                                  kernel entry point: 0x80002000, kernel offset: 16252928, kernel length:
                                  512, rootfs offset: 855873, rootfs length: 1048576, bootloader offset:
                                  15204352, bootloader length: 0
    132096        0x20400         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes,
                                  uncompressed size: 2451644 bytes
    1180160       0x120200        Squashfs filesystem, little endian, version 4.0, compression:lzma, size:
                                  9878520 bytes, 789 inodes, blocksize: 131072 bytes, created: 2018-03-05
                                  06:16:10

[1] https://static.tp-link.com/2018/201806/20180611/Archer%20C7(...

Re: Reverse engineering my router's firmware with binwalk

#49

Post by RussianCow » Thu, Feb 06, 2020, 6:52 PM UTC

dpcx wrote: post #44

leeoniya wrote: post #11

glad i flashed latest dd-wrt beta on my archer-c7 v5 :D. though my wan-facing device runs OPNSense. i actually prefer to run Tomato, but archer c7 is not broadcom :( can anyone offer advice about dd-wrt vs openwrt (considering trying openwrt).

Where can one find the dd-wrt you used for your c7? I have the same device and have been unable to get it to flash anything other than official firmware.

These are the instructions I successfully followed on my C7 V2: https://wiki.dd-wrt.com/wiki/index.php/TP_Link_Archer_C7#Ins...

Here is the exact `factory-to-ddwrt` image I used (this will depend on which version you have): ftp://ftp.dd-wrt.com/betas/2019/10-15-2019-r41328/tplink_archer-c7-v2/

Re: Reverse engineering my router's firmware with binwalk

#50

Post by dmitrygr » Thu, Feb 06, 2020, 7:19 PM UTC

JoeAltmaier wrote: post #47

souprock wrote: post #40

Earlier quoted context omitted.

IDA Pro started as a 16-bit MS-DOS program. It's real old. I'm pretty sure I was using it back in 1992, when it was already a well-developed program. Ghidra is old too, although only recently public. It couldn't be older than Java, which is from 1996.

Cool. I did mine in 2006. Hey, those have mostly Intel disassemblers. Mine did any machine code you cared to write a dissector for. Are they iterative? Can you add human clues/cues so they do a better job the next time?

ida handles any arch

it is interactive (so by definition iterative)