m-1-k-3

#!/usr/bin/env python3
import os, sys
import argparse
import struct
from functools import reduce

"""
QNAP QTS firmware encryptor/decryptor.

Based on https://pastebin.com/KHbX85nG

m-1-k-3

// Original author: Paul Rascagneres <rootbsd@r00ted.com>
// Patched by (GalaxyMaster) [https://github.com/galaxy4public/]
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#define ENCRYPT_SIZE 0x100000

int keybits;
int y, z;

m-1-k-3

Linksys EA4500 Firmware Decryption

I recently pulled a Linksys EA4500 out of storage for evaluation. The first thing I wanted to do was to update the firmware for the device. https://www.linksys.com/us/support-article?articleNum=148385 offers the latest version of the firmware, which is 3.1.7 as of this writing.

However, we can see with the filename that its probably encrypted: FW_EA4500V3_3.1.7.181919_prod.gpg.img

When I run binwalk I don't get any meaningful results, confirming my suspcicions:

m-1-k-3

Decrypting DLINK Proprietary Firmware Images

The DIR-3040 models of DLINK routers feature encrypted firmware images in the most recent versions of the firmware. https://support.dlink.com/ProductInfo.aspx?m=DIR-3040-US details the firmware images available for this product.

• 1.11B02 - ftp://ftp2.dlink.com/PRODUCTS/DIR-3040/REVA/DIR-3040_REVA_FIRMWARE_v1.11B02.zip
• 1.02B03 - ftp://ftp2.dlink.com/PRODUCTS/DIR-3040/REVA/DIR-3040_REVA_FIRMWARE_v1.02B03.zip

Unzipping the first reveals two files:

• DIR-3040_REVA_RELEASE_NOTES_v1.11B02.pdf

m-1-k-3

#!/usr/bin/env python3

import sys

key = b'\xac\x78\x3c\x9e\xcf\x67\xb3\x59'

filename = sys.argv[1]

def decrypter(reference):
    n = len(key)

m-1-k-3

Cortex M CPU searchable IRQ/peripheral list

Goal: Use this when reverse engineering a binary for an unknown Cortex M CPU to help figure out exactly what you're looking at

Simple usage:
Load the binary into IDA/Ghidra
Find the vector table (usually the first 256-ish bytes right at the start of the file), and find some 'interesting' IRQ vectors that point to real code.
(The first 16 vectors are internal Cortex M stuff (reset vector, NMI etc) and will not be useful)
In the IRQ handler code pointed to by the vector, you will very often soon encounter an obvious peripheral address being loaded into a register.