Reverse Engineering
About
Sometimes, it's important to gain a look inside the software we're running on our devices. Open questions arise, that need to answered.
- What's running inside the firmware?
- What versions are running and is it still secure?
Basic firmware analysis
binwalk
Install binwalk and take a look at the firmware.
1 apt install binwalk
Analyse the firmware file
1 FIRMWARE="firmware.bin"
2 binwalk "$FIRMWARE"
3
4 DECIMAL HEXADECIMAL DESCRIPTION
5 --------------------------------------------------------------------------------
6 64 0x40 uImage header, header size: 64 bytes, header CRC: 0x92C43160, created: 2012-09-06 06:26:24, image size: 1179388 bytes, Data Address: 0x8000, Entry Point: 0x8000, data CRC: 0xDC27C3F1, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-2.6.22.18"
7 128 0x80 Linux kernel ARM boot executable zImage (little-endian)
8 12632 0x3158 gzip compressed data, maximum compression, from Unix, last modified: 2012-09-06 06:26:23
9 1179600 0x11FFD0 Squashfs filesystem, little endian, version 3.1, size: 4845587 bytes, 221 inodes, blocksize: 131072 bytes, created: 2012-09-06 06:30:14
Oh, a Squashfs
Extract everything from the firmware-binary
The squashfs is extracted and may now be inspected. 