Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering my router's firmware with binwalk

embeddedbits.org

Post reply on HN
Print view View original

71–80 of 90 posts

Re: Reverse engineering my router's firmware with binwalk

#71

Post by velosol »

ggcdn wrote: post #63
Youden wrote: post #53

Earlier quoted context omitted.

I don't know of any straightforward tools, most people I've seen reverse engineer a format do it with a hex editor and writing custom scripts. It's not directly relevant but the best I've seen is this presentation about reverse engineering the protocol used to communicate within a car: https://www.youtube.com/watch?v=KkgxFplsTnM It uses some techniques that might be relevant, like monitoring different parts of a file…

Ok thanks, I'll take a look. It's possible for me to generate these files for each of the various material settings so I can manually 'diff' them, simillar to what you're describing

It sounds like you might eventually be able to write a kaitai struct [0] for the resulting format which would make it fairly easy to use the format in your language of choice.

[0]: https://kaitai.io/

Re: Reverse engineering my router's firmware with binwalk

#72

Post by leeoniya »

magduf wrote: post #23
leeoniya wrote: post #11

glad i flashed latest dd-wrt beta on my archer-c7 v5 :D. though my wan-facing device runs OPNSense. i actually prefer to run Tomato, but archer c7 is not broadcom :( can anyone offer advice about dd-wrt vs openwrt (considering trying openwrt).

>i actually prefer to run Tomato, but archer c7 is not broadcom :( Not being Broadcom is a very good thing.

reading more about it, you're right. i always figured that since broadcom was so widely supported by multiple aftermarket firmwares, that it was the most mod-friendly. guess it was just the most throughly reversed :/

Re: Reverse engineering my router's firmware with binwalk

#73

Post by yellowapple »

fencepost wrote: post #43
josteink wrote: post #20

Did I read the blog wrong, or was the stock firmware too based on a OpenWRT kernel? That would be pretty hilarious if it was true.

I'm pretty sure a lot of stock firmware is based on OpenWRT or used to be, though I'm pretty sure most of them lag well behind the current version. I haven't paid much attention for a while, but I think a lot were based on Kamikaze which is more than 10 years old now. For the vendors with access to closed-source drivers and chipset info they can likely support devices not supported on the open source packages. Edit:…

EnGenius access points also ship with (an outdated and modified version of) OpenWRT.

Re: Reverse engineering my router's firmware with binwalk

#74

Post by 0xquad »

Given the TERMS OF USE under TP-Link's privacy policy [ https://www.tp-link.com/us/about-us/privacy/ ] it seems like they consider it illegal to do any of this. Their terms, along with the "we don't even pretend to care about your privacy rights" attitude have made me question any further purchase of TP-Link products.

Relevant quotes: "By using the Products or Services in any way, you agree to the Terms. " "Also, modifying, translating, adapting, or otherwise creating derivative works and improvements, decompiling, decoding, reverse engineering, disassembling, or otherwise reducing the code used in any software in connection with the Services into a readable form in order to examine the source code or construction of such software and/or to copy or create other products based (in whole or in part) on such software, is prohibited."

Re: Reverse engineering my router's firmware with binwalk

#75

Post by rblatz »

0xquad wrote: post #74

Given the TERMS OF USE under TP-Link's privacy policy [ https://www.tp-link.com/us/about-us/privacy/ ] it seems like they consider it illegal to do any of this. Their terms, along with the "we don't even pretend to care about your privacy rights" attitude have made me question any further purchase of TP-Link products. Relevant quotes: "By using the Products or Services in any way, you agree to the Terms. " "Also, mod…

How does that jive with the GPL code they are shipping?

Re: Reverse engineering my router's firmware with binwalk

#76

Post by hnick »

ggcdn wrote: post #51

A slightly related question for HNers: Is there any easy tool for a non-cs guy to reverse engineer a binary file containing numbers and text in some specific format? I have to work with some old structural analysis software. The material and element definitions come in an obscure file format ".PF3CMP". I know it contains text like the material names, and numbers/letters for the material properties. Ultimately its my…

Have you tried the 'file' command on various *nix systems (can download for Windows too)? It mightn't know this format but I think it will tell you if it finds compressed (zipped) data streams in common formats, which will be your first step since many files have some form of compression.

I'll also echo the other comment about reverse engineering the reading functions. Some formats only include certain structures if necessary so even if you have a lot of files you might be missing some example data to complete the picture.

Re: Reverse engineering my router's firmware with binwalk

#77

Post by hnick »

ggcdn wrote: post #63
Youden wrote: post #53

Earlier quoted context omitted.

I don't know of any straightforward tools, most people I've seen reverse engineer a format do it with a hex editor and writing custom scripts. It's not directly relevant but the best I've seen is this presentation about reverse engineering the protocol used to communicate within a car: https://www.youtube.com/watch?v=KkgxFplsTnM It uses some techniques that might be relevant, like monitoring different parts of a file…

Ok thanks, I'll take a look. It's possible for me to generate these files for each of the various material settings so I can manually 'diff' them, simillar to what you're describing

If there are massive differences with minor changes that can be a clue that the data is compressed or encrypted in some manner.

A good test would be if you can name/tag/comment items in the file, you can search for these strings.

Re: Reverse engineering my router's firmware with binwalk

#78

Post by alias_neo »

bradknowles wrote: post #65
fencepost wrote: post #43

Earlier quoted context omitted.

I'm pretty sure a lot of stock firmware is based on OpenWRT or used to be, though I'm pretty sure most of them lag well behind the current version. I haven't paid much attention for a while, but I think a lot were based on Kamikaze which is more than 10 years old now. For the vendors with access to closed-source drivers and chipset info they can likely support devices not supported on the open source packages. Edit:…

Ubiquiti is based on Vyatta.

Which is the predecessor to VyOS: https://www.vyos.io/

It's Open source too for anyone that wants to run it.

Re: Reverse engineering my router's firmware with binwalk

#79

Post by mobilio »

souprock wrote: post #40
JoeAltmaier wrote: post #35

Earlier quoted context omitted.

Um. I think they post-dated me! But I didn't go anywhere with it.

IDA Pro started as a 16-bit MS-DOS program. It's real old. I'm pretty sure I was using it back in 1992, when it was already a well-developed program. Ghidra is old too, although only recently public. It couldn't be older than Java, which is from 1996.

I remember that old times too. First IDA was built on Pascal using Turbo Vision (GUI library).

Then IDA went on Windows and today it's multiplatform.

Re: Reverse engineering my router's firmware with binwalk

#80

Post by magduf »

leeoniya wrote: post #72
magduf wrote: post #23

Earlier quoted context omitted.

>i actually prefer to run Tomato, but archer c7 is not broadcom :( Not being Broadcom is a very good thing.

reading more about it, you're right. i always figured that since broadcom was so widely supported by multiple aftermarket firmwares, that it was the most mod-friendly. guess it was just the most throughly reversed :/

Broadcom is absolutely the worst, because it's the most open-source-unfriendly. It's only had a lot of reverse-engineering attention because it's so ubiquitous (not just for routers, but for laptops too), but it's all no thanks to Broadcom.

Atheros and Intel I believe both have good open-source support.

Post reply on HN