| #!/usr/bin/env python3 | |
| import sys | |
| key = b'\xac\x78\x3c\x9e\xcf\x67\xb3\x59' | |
| filename = sys.argv[1] | |
| def decrypter(reference): | |
| n = len(key) |
| // Original author: Paul Rascagneres <rootbsd@r00ted.com> | |
| // Patched by (GalaxyMaster) [https://github.com/galaxy4public/] | |
| #include <stdio.h> | |
| #include <string.h> | |
| #include <stdlib.h> | |
| #define ENCRYPT_SIZE 0x100000 | |
| int keybits; | |
| int y, z; |
The DIR-3040 models of DLINK routers feature encrypted firmware images in the most recent versions of the firmware. https://support.dlink.com/ProductInfo.aspx?m=DIR-3040-US details the firmware images available for this product.
1.11B02 - ftp://ftp2.dlink.com/PRODUCTS/DIR-3040/REVA/DIR-3040_REVA_FIRMWARE_v1.11B02.zip1.02B03 - ftp://ftp2.dlink.com/PRODUCTS/DIR-3040/REVA/DIR-3040_REVA_FIRMWARE_v1.02B03.zipUnzipping the first reveals two files:
DIR-3040_REVA_RELEASE_NOTES_v1.11B02.pdf
| Cortex M CPU searchable IRQ/peripheral list | |
| Goal: Use this when reverse engineering a binary for an unknown Cortex M CPU to help figure out exactly what you're looking at | |
| Simple usage: | |
| Load the binary into IDA/Ghidra | |
| Find the vector table (usually the first 256-ish bytes right at the start of the file), and find some 'interesting' IRQ vectors that point to real code. | |
| (The first 16 vectors are internal Cortex M stuff (reset vector, NMI etc) and will not be useful) | |
| In the IRQ handler code pointed to by the vector, you will very often soon encounter an obvious peripheral address being loaded into a register. | |
| Search this file for "[XXXX:YYYYYYYY]" where X = last 4 hex address of the IRQ vector, and YYYYYYYY=hex peripheral address. |
I recently pulled a Linksys EA4500 out of storage for evaluation. The first thing I wanted to do was to update the firmware for the device.
https://www.linksys.com/us/support-article?articleNum=148385 offers the latest version of the firmware, which is 3.1.7 as of this writing.
However, we can see with the filename that its probably encrypted: FW_EA4500V3_3.1.7.181919_prod.gpg.img
When I run binwalk I don't get any meaningful results, confirming my suspcicions:
| #!/usr/bin/env python3 | |
| import os, sys | |
| import argparse | |
| import struct | |
| from functools import reduce | |
| """ | |
| QNAP QTS firmware encryptor/decryptor. | |
| Based on https://pastebin.com/KHbX85nG |