Reverse Engineering Asked on October 16, 2020
I’ve got a cloud-based battery powered camera which I’m really hoping to get out of the cloud with, in order to enable RTSP or ONVIF (or something local!).
I’ve managed to get a .bin file. Binwalk allowed me to get an .img file, and there are many interesting strings from this file. It appears to at least have a filesystem of sorts:
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
3213849 0x310A19 Certificate in DER format (x509 v3), header length: 4, sequence length: 5380
4199041 0x401281 Certificate in DER format (x509 v3), header length: 4, sequence length: 13692
5097905 0x4DC9B1 Certificate in DER format (x509 v3), header length: 4, sequence length: 5380
5184988 0x4F1DDC Base64 standard index table
5191688 0x4F3808 Unix path: /home/sound/warning.wav
5195472 0x4F46D0 Unix path: /home/sound/login.wav
5196188 0x4F499C Unix path: /home/sound/restart.wav
5213511 0x4F8D47 HTML document header
5213544 0x4F8D68 HTML document footer
5213635 0x4F8DC3 HTML document header
5213676 0x4F8DEC HTML document footer
5213811 0x4F8E73 HTML document header
5213995 0x4F8F2B HTML document footer
5217731 0x4F9DC3 HTML document header
5217938 0x4F9E92 HTML document footer
5218791 0x4FA1E7 HTML document header
5219471 0x4FA48F HTML document footer
5220243 0x4FA793 HTML document header
5220367 0x4FA80F HTML document footer
5221348 0x4FABE4 XML document, version: "1.0"
5242268 0x4FFD9C SHA256 hash constants, little endian
5264636 0x5054FC SHA256 hash constants, little endian
5275136 0x507E00 PEM certificate
5280492 0x5092EC Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/kernel/base/core/los_task.c
5283112 0x509D28 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/kernel/base/mem/mem_bestfit/los_memory.c
5284576 0x50A2E0 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/kernel/base/ipc/los_mux.c
5292128 0x50C060 Unix path: /usr/local/etc/zoneinfo
5292980 0x50C3B4 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/lib/libc/src/time/time64.c
5294084 0x50C804 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/compat/posix/src/pthread_mutex.c
5294948 0x50CB64 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/vfs/inode/fs_inode.c
5295300 0x50CCC4 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/vfs/driver/fs_blockproxy.c
5298224 0x50D830 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/vfs/bch/src/bchlib_sem.c
5482780 0x53A91C Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/fs.c
5483508 0x53ABF4 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/readinode.c
5486632 0x53B828 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/write.c
5487060 0x53B9D4 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/include/debug.h
5487516 0x53BB9C Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/nodelist.c
5489184 0x53C220 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/scan.c
5490792 0x53C868 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/nodemgmt.c
5491300 0x53CA64 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/fs/jffs2/src/gc.c
5505972 0x5403B4 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/platform/bsp/board/hi3518ev300/include/hisoc/i2c.h
5520924 0x543E1C Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/platform/bsp/board/hi3518ev300/include/hisoc/spi.h
5521580 0x5440AC Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/platform/bsp/board/hi3518ev300/include/hisoc/uart.h
5533124 0x546DC4 eCos RTOS string reference: "ECOST CPUUSE CPUUSE10s CPUUSE1s mode"
5617488 0x55B750 Unix path: /home/cfg/random_para.txt
5668808 0x567FC8 CRC32 polynomial table, little endian
6026720 0x5BF5E0 CRC32 polynomial table, little endian
6077286 0x5CBB66 TIFF image data, big-endian, offset of first image directory: 8
6078744 0x5CC118 TIFF image data, big-endian, offset of first image directory: 8
6086620 0x5CDFDC CRC32 polynomial table, little endian
6122272 0x5D6B20 Unix path: /home/nie/pro/v103/trunk/libAACenc/src/aacenc_lib.cpp
6125288 0x5D76E8 Unix path: /home/nie/pro/v103/trunk/libMpegTPEnc/src/tpenc_lib.cpp
6125413 0x5D7765 Copyright string: "copyright law and international treaties."
6136076 0x5DA10C Unix path: /home/nie/pro/v103/trunk/libFDK/include/fixpoint_math.h
6136840 0x5DA408 Unix path: /home/nie/pro/v103/trunk/libAACenc/src/quantize.cpp
6139780 0x5DAF84 Unix path: /home/nie/pro/v103/trunk/libAACenc/src/transform.cpp
6151760 0x5DDE50 Unix path: /home/nie/pro/v103/trunk/libFDK/src/FDK_tools_rom.cpp
6168775 0x5E20C7 Copyright string: "copyright holder(s) nor the"
6169280 0x5E22C0 Copyright string: "copyright"
6169415 0x5E2347 Copyright string: "copyright"
6169908 0x5E2534 Copyright string: "Copyright (c) 2003-2014, Jouni Malinen <[email protected]> and contributors"
6230532 0x5F1204 Neighborly text, "Neighboring BSS: freq=%dd"
6238636 0x5F31AC Neighborly text, "neighboring BSSes ret=%d (%s) - try to scan again (attempt %d)"
6239601 0x5F3571 Neighborly text, "neighboring BSSes prior to enabling 40 MHz channelquest a scan of neighboring BSSes ret=%d (%s) - try to scan again"
6239680 0x5F35C0 Neighborly text, "neighboring BSSes ret=%d (%s) - try to scan againequest a scan of neighboring BSSes ret=%d (%s)"
6239760 0x5F3610 Neighborly text, "neighboring BSSes ret=%d (%s)rdware channel/rate support not supported."
6240780 0x5F3A0C Neighborly text, "Neighboring BSS: %02x:%02x:%02x:%02x:%02x:%02x freq=%d pri=%d sec=%dec=%d"
6287708 0x5FF15C SHA256 hash constants, little endian
6295380 0x600F54 Base64 standard index table
6302508 0x602B2C Unix path: /home/ywx389445/z_ss/a_spc010/c_sdk/source/wifi_project/drv/sdio_hi1131sv100/hi1131_driver/driver/platform/inc/oal/liteos/arch/o
6302796 0x602C4C Unix path: /home/ywx389445/z_ss/a_spc010/c_sdk/source/wifi_project/drv/sdio_hi1131sv100/hi1131_driver/driver/platform/inc/oal/liteos/arch/o
6435024 0x6230D0 CRC32 polynomial table, little endian
6439120 0x6240D0 CRC32 polynomial table, big endian
6448960 0x626740 CRC32 polynomial table, little endian
6450040 0x626B78 Unix path: /home/linux/share/code/meari/liteos/liteos_v1.0.0.5/compat/linux/src/completion.c
Here is the file:
https://drive.google.com/file/d/1mtbAi90BkNAlZ1O501q4dSIY4sRY7xP9/view?usp=sharing
Any ideas?
Really need more info from you to be useful. What's the camera? What's the larger bin file that app.img
came from? How did you extract app.img
from that bin file with binwalk
?
That said, I took a brief look. app.img
is ARM little endian, probably v7, and you can load it into Ghidra. I'm not sure what the base address is. From googling an identifying string in the binary (hi3518ev300
), I came across some links that may prove useful.
Answered by hairlessbear on October 16, 2020
Get help from others!
Recent Answers
Recent Questions
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP