nstarke

Reversing Raw Binary Firmware Files in Ghidra

This brief tutorial will show you how to go about analyzing a raw binary firmware image in Ghidra.

Prep work in Binwalk

I was recently interested in reversing some older Cisco IOS images. Those images come in the form of a single binary blob, without any sort of ELF, Mach-o, or PE header to describe the binary.

While I am using Cisco IOS Images in this example, the same process should apply to other Raw Binary Firmware Images.

enricofoltran

package main

import (
	"context"
	"flag"
	"fmt"
	"log"
	"net/http"
	"os"
	"os/signal"

hfreire

# Install QEMU OSX port with ARM support
sudo port install qemu +target_arm
export QEMU=$(which qemu-system-arm)

# Dowload kernel and export location
curl -OL \
https://github.com/dhruvvyas90/qemu-rpi-kernel/blob/master/kernel-qemu-4.1.7-jessie
export RPI_KERNEL=./kernel-qemu-4.1.7-jessie

# Download filesystem and export location