Flag: Tornado! Hurricane!

Blogs >> apridgen's Blog

Created: Friday, June 6 2008 03:50.21 CDT  
Printer Friendly ...
Reassembling Sniffed Firmware or a Binary With Scapy
Author: apridgen # Views: 11042

So, I got bored one night (or morning depending on your perspective), and I decided to sniff the firmware upgrade process for my network printer, Fun! :)  I used Wireshark (yeah my tcpdump foo is bar) to isolate the TCP stream between the VM upgrading the firmware and the printer and saved the pcap.

I have been meaning to play with Scapy for quite some time, so I fired up ipython and in about 20 minutes I had a quick script to extract the data I needed.  The script is pretty basic and may not work in all cases, but I figured I'd document somewhere just in case or someone else might need it in the future.



# IP Address of the VM sending the upgrade
src="192.168.44.128"
f = "captured_firmware_upgrade.pcap"
pcap = rdpcap(f)


data = ""
for packet in pcap:
  il = packet.getlayer("IP")
  if il.src != src:
    continue
  tl = packet.getlayer("TCP")
  # check for data in the payload, if not skip the packet
  if isinstance(tl.payload,scapy.NoPayload):
    continue
  data += str(tl.payload)
# write our raw data file
f = open("raw_data.dat", 'w')
f.write(data)
f.close()



Hope it helps someone in the future :)





Add New Comment
Comment:









There are 31,326 total registered users.


Recently Created Topics
what\'s the big idea...
Nov/13
Oct/23
Oct/23
Oct/23
Oct/23
Oct/23
Oct/23
Oct/23
Oct/23
Oct/23


Recent Forum Posts
Reverse Engineering ...
bytecod3r
Reverse Engineering ...
bytecod3r
Reverse Engineering ...
bytecod3r
Reverse Engineering ...
bytecod3r
Reverse Engineering ...
bytecod3r
let 'IDAPython' impo...
bytecod3r
Reverse Engineering ...
bytecod3r
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit