📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Techniques for finding checksums?

Topic created on: September 4, 2008 13:40 CDT by rman .

Followup to my previous post about the cisf images.

Currently in the process of reversing an vxworks (5.5 by the strings) binary (arm processor), and get to the point that I can upload my own firmware.  Trail and error has proved to me that the files have a checksum in them (no surpise) as I cannot change the value of a character without the device rejecting the flash.

After poking around with a hex editor for quite a while I've hit a wall.  A few of the more promising locations havent worked out, and I'd love some advice.

Right not I'm thinking writing up a quick script to iterate through the file setting each 1,2,4 byte combination to x00, running all the common checksum algorithms against it and seeing if I get any matches.

Is this the best method, or are there better/simpler methods that Im overlooking?

  aeppert     September 4, 2008 14:15.33 CDT
If they are in fact custom images, the checksum will almost certainly be located in some kind of header.

Typically, if you have more than one "stock" (aka, OEM) image to compare against, you can fairly quickly ascertain several things from a given header:

1) Payload size - generally sans header

2) Approximate location of checksum - with at least two files, if it is a properly checksum there should be visible differences.  A checksum can be as simple as a straight 16 or 32bit bytewise addition.  Generally, a CRC16 or CRC32 is the most common.

3) Section information - often can find some kind of offset indicating the beginning of some pertinent section that is used by the bootloader.

4) Loading address - the virtual address of the image will execute upon being loaded.

Generally, you can visually identify most of these things inside 30 minutes if they are there.

  rman     September 4, 2008 14:54.07 CDT
Well from what I can tell by looking at a few different versions the 0th word and the 20th word seem to point to the start/end of a header, as they're always 207 bytes apart, so it makes sense that it would be somewhere in that blob.

File sizes are all the same, padded out with 0xFF to get there, so device may require specific size.

  igorsk     September 4, 2008 20:38.57 CDT
Does the image you are reversing itself contain the code which handles fimrware updates? If so, you should be able to find the checking routines in it.

  rman     September 5, 2008 09:33.49 CDT
igorsk:
That I am not sure of, I have no been able to determine the entry point as of yet, was just proving that arbitrary code could be loaded first and that was task #2, I definitely could use some advice, have no done any work with ARM before.

  igorsk     September 5, 2008 10:05.55 CDT
Can you share the file? (publicly or privately)

  rman     September 5, 2008 10:35.59 CDT
sadly I cannot, too many agreements in place stating that, and licensing restrictions on getting it in the first place.

  igorsk     September 5, 2008 11:04.21 CDT
BTW here's a primer on reversing a VxWorks image.
http://www.matasano.com/log/1047/toast-spells-tsaot-in-reverse/

  rman     September 5, 2008 11:06.56 CDT
yeah, have read over that once or twice the last couple days :).

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit