When [0xRickSanchez] found some D-Link firmware he couldn’t unpack, he was curious to find out why. The firmware had a new encryption method which was doing its job of preventing tampering and static analysis. Of course, he had to figure out how to get around it and is documenting his work in a series of blog posts.
Looking at the entropy analysis showed the data to be totally random, a good sign it was either encrypted or compressed. The target router cost about $200, but a similar cheaper router used the same encryption and thus this model became the hardware of choice for testing.
A console cable provided access to the router and an executable named imgdecrypt immediately caught his eye. Moving that file to a regular PC allowed the usual attack to see how it does its job.
You can follow along with part 2 which is in 2 different parts. The end result is on GitHub, but — honestly — the real adventure is in the story of how it came together.
We spend a lot of time thinking about reverse engineering things like this. We aren’t always looking at routers, either.
No comments:
Post a Comment