Analyze Firmware
Last updated
Last updated
After you successfully obtained a firmware dump, it's time to analyze its content.
binwalk is the goto option for quickly analyzing your firmware
Identify data
binwalk firmware.bin
: will give you an overview which contents are found in the dump
Example Output:
Extract Firmware
binwalk -e firmware.bin
: will try to automatically extract all content => will often give us full root-filesystem.
Example:
Entropy Analyiss
binwalk -E firmware.bin
This will give us the entropy of the firmware
Note: parts of very high entropy can be sign for compression or encryption being used.
Example Output:
The strings
command can be helpful to quickly find sensitive data like passwords or password hashes:
Password Hashes:
Hardcoded Credentials
Private Keys and Certificates
API Keys, Tokens, and Secrets
IP Addresses and URLs
Configuration Files
Encryption Keys and Passwords
Version Information
Debug Information
Email Addresses
Encryption/Decryption Routines
Default and Backup Files
SSH Information
Todo
Resources:
https://fr3ak-hacks.medium.com/analysing-and-extracting-firmware-using-binwalk-982012281ff6 https://sergioprado.blog/reverse-engineering-router-firmware-with-binwalk/ https://github.com/ReFirmLabs/binwalk