Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering my router's firmware with binwalk

embeddedbits.org

Post reply on HN
Print view View original

51–60 of 90 posts

Re: Reverse engineering my router's firmware with binwalk

#51

Post by ggcdn »

A slightly related question for HNers: Is there any easy tool for a non-cs guy to reverse engineer a binary file containing numbers and text in some specific format?

I have to work with some old structural analysis software. The material and element definitions come in an obscure file format ".PF3CMP". I know it contains text like the material names, and numbers/letters for the material properties.

Ultimately its my goal to be able to write these files from matlab or python, instead of using the horribly clunky user interface. But first I need to know the structure of the file, and I'm not even sure how to begin figuring that out.

[0] is what it looks like when opened in a hex editor

[0] https://imgur.com/a/jvqV3k8

Re: Reverse engineering my router's firmware with binwalk

#52

Post by souprock »

JoeAltmaier wrote: post #47
souprock wrote: post #40

Earlier quoted context omitted.

IDA Pro started as a 16-bit MS-DOS program. It's real old. I'm pretty sure I was using it back in 1992, when it was already a well-developed program. Ghidra is old too, although only recently public. It couldn't be older than Java, which is from 1996.

Cool. I did mine in 2006. Hey, those have mostly Intel disassemblers. Mine did any machine code you cared to write a dissector for. Are they iterative? Can you add human clues/cues so they do a better job the next time?

They are not at all mostly Intel disassemblers, though some of them have freeware versions (to suppress competition) or time-limited demo versions that are purposely limited. They are very much designed around humans adding clues: you can declare function parameters, struct types, enumerations, and the meaning of various offsets in code. They are interactive GUI tools, continuously updating automated analysis as the user assists by providing clues to the analysis engine. Ghidra and Binary Ninja can be simultaneously multi-user, storing the database on a server for collaboration.

IDA Pro supports dozens of processor architectures. I count about 70, not including model variations and not including community support. https://www.hex-rays.com/products/ida/processors/

Ghidra supports "X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro, 68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64, CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32, and variants of these processors."

Binary Ninja officially supports x86, x64, ARMv7, Thumb2, ARMv8, PowerPC, MIPS, 6502. Community support adds AVR, MSP430, and VMNDH-2k12.

Hopper Disassembler supports "x86{16,32,64}, Dalvik, avr, ARM, java, PowerPC, Sparc, MIPS"

Re: Reverse engineering my router's firmware with binwalk

#53

Post by Youden »

ggcdn wrote: post #51

A slightly related question for HNers: Is there any easy tool for a non-cs guy to reverse engineer a binary file containing numbers and text in some specific format? I have to work with some old structural analysis software. The material and element definitions come in an obscure file format ".PF3CMP". I know it contains text like the material names, and numbers/letters for the material properties. Ultimately its my…

I don't know of any straightforward tools, most people I've seen reverse engineer a format do it with a hex editor and writing custom scripts. It's not directly relevant but the best I've seen is this presentation about reverse engineering the protocol used to communicate within a car: https://www.youtube.com/watch?v=KkgxFplsTnM

It uses some techniques that might be relevant, like monitoring different parts of a file as you make different changes (like accelerating or decelerating). In your case it might be possible to compare between different material definitions for example.

Re: Reverse engineering my router's firmware with binwalk

#54

Post by 12bits »

leeoniya wrote: post #11

glad i flashed latest dd-wrt beta on my archer-c7 v5 :D. though my wan-facing device runs OPNSense. i actually prefer to run Tomato, but archer c7 is not broadcom :( can anyone offer advice about dd-wrt vs openwrt (considering trying openwrt).

Did you notice your wireless signal strength considerably lower when going to dd-wrt?

I put openwrt on my c7 V5 and could barely get any bars.

Flashed back to the stock and was back in business.

Another thing I've read is the third party firmwares don't get hardware access to NAT resulting in speed hits.

Cheers

Re: Reverse engineering my router's firmware with binwalk

#55

Post by [deleted] »

Youden wrote: post #53
ggcdn wrote: post #51

A slightly related question for HNers: Is there any easy tool for a non-cs guy to reverse engineer a binary file containing numbers and text in some specific format? I have to work with some old structural analysis software. The material and element definitions come in an obscure file format ".PF3CMP". I know it contains text like the material names, and numbers/letters for the material properties. Ultimately its my…

I don't know of any straightforward tools, most people I've seen reverse engineer a format do it with a hex editor and writing custom scripts. It's not directly relevant but the best I've seen is this presentation about reverse engineering the protocol used to communicate within a car: https://www.youtube.com/watch?v=KkgxFplsTnM It uses some techniques that might be relevant, like monitoring different parts of a file…

[deleted]

Re: Reverse engineering my router's firmware with binwalk

#56

Post by thebruce87m »

ggcdn wrote: post #51

A slightly related question for HNers: Is there any easy tool for a non-cs guy to reverse engineer a binary file containing numbers and text in some specific format? I have to work with some old structural analysis software. The material and element definitions come in an obscure file format ".PF3CMP". I know it contains text like the material names, and numbers/letters for the material properties. Ultimately its my…

The Linux tool “od” might help you here. The -c flag will print ASCII characters.

You can get it with WSL on Windows, or even just install git and you’ll get git-bash for another easy option.

Re: Reverse engineering my router's firmware with binwalk

#57

Post by mjevans »

ChuckNorris89 wrote: post #5
bluesign wrote: post #4

Earlier quoted context omitted.

It is mostly related to drivers to soc, not about paying devs

So how did OpenWRT manage to build firmware with up to date components for it? The Qualcomm chips inside of it seem fairly modern for such an old kernel.

Support varies, you should purchase devices that include hardware which is supported by the Open Source drivers (even if you have to compromise and it still uses some small blobs that are free to distribute).

You should also purchase a device that includes enough storage space and RAM to support more than the bare minimum; that will help keep things future proof.

Re: Reverse engineering my router's firmware with binwalk

#58

Post by mjevans »

josteink wrote: post #48
fencepost wrote: post #43

Earlier quoted context omitted.

I'm pretty sure a lot of stock firmware is based on OpenWRT or used to be, though I'm pretty sure most of them lag well behind the current version. I haven't paid much attention for a while, but I think a lot were based on Kamikaze which is more than 10 years old now. For the vendors with access to closed-source drivers and chipset info they can likely support devices not supported on the open source packages. Edit:…

That's pretty cool. I didn't know that. Looking into the equivalent firmware[1] for my Archer C7 v2, I didn't find any OpenWRT bits though. I was honestly a little bit disappointed. I guess the difference between hardware revisions might be more fundamental than I assumed. DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------------------------------- 0 0x0 TP-…

The BOM can vary quite a lot between 'revisions', using your product as an example...

https://openwrt.org/toh/tp-link/archer-c7-1750 (Scroll down to the Info Links table and the Wikidevi Info column)

v1 to v2 upgrades the Flash (8MB to 16MB) and uses a slightly different AN+AC wifi chip. v2 and v3 seem pretty similar at a glance. v4 is rated at 12v 2a rather than 2.5a; using a completely different BGN(2.6ghz) chip and also different ethernet chip/switch. v5 is lower power still at 1.5a, but it's less obvious where that change happened due to lack of pictures. A guess based on the simpler antenna list is that it uses less antenna.

Re: Reverse engineering my router's firmware with binwalk

#59

Post by leeoniya »

12bits wrote: post #54
leeoniya wrote: post #11

glad i flashed latest dd-wrt beta on my archer-c7 v5 :D. though my wan-facing device runs OPNSense. i actually prefer to run Tomato, but archer c7 is not broadcom :( can anyone offer advice about dd-wrt vs openwrt (considering trying openwrt).

Did you notice your wireless signal strength considerably lower when going to dd-wrt? I put openwrt on my c7 V5 and could barely get any bars. Flashed back to the stock and was back in business. Another thing I've read is the third party firmwares don't get hardware access to NAT resulting in speed hits. Cheers

yes, and i had throughput issues when running in full-width G/N mixed mode compared to my previous Tomato/Asus RT-N16 setup. my phone would also drop out and reconnect intermittently with the c7. but in dedicated AC it seems to be doing well thus far. i cannot say for sure whether this was due to DD-WRT or not as i did not do a thorough comparison to stock.

> Another thing I've read is the third party firmwares don't get hardware access to NAT

i read that too :(

Re: Reverse engineering my router's firmware with binwalk

#60

Post by hyper_reality »

It's a good article but there are much easier ways to use binwalk than presented here.

In the first example he uses the "--signature" and "--term" flags, these are unnecessary. Running binwalk with no flags will produce the same output.

To extract part of the file, he also uses dd with the "skip" and "count" options painfully calculated. You can just use:

binwalk --dd='.*' img.bin

and it will extract everything that matches the pattern - the pattern above will extract all found files.

Post reply on HN