This brief tutorial will show you how to go about analyzing a raw binary firmware image in Ghidra.
I was recently interested in reversing some older Cisco IOS images. Those images come in the form of a single binary blob, without any sort of ELF, Mach-o, or PE header to describe the binary.
While I am using Cisco IOS Images in this example, the same process should apply to other Raw Binary Firmware Images.
These are notes I've taken while rying to get srslte up and running. This is messy, sorry...
Dependencies:
sudo apt install tree vim git g++ make cmake pkg-config libpython-dev python-numpy swig libi2c-dev libusb-1.0-0-dev libfftw3-dev libmbedtls-dev libboost-program-options-dev libconfig++-dev libsctp-dev gnuradio
| #!/bin/bash | |
| set -e | |
| CONTENTS=$(tesseract -c language_model_penalty_non_dict_word=0.8 --tessdata-dir /usr/local/share/tessdata/ "$1" stdout -l eng | xml esc) | |
| hex=$((cat <<EOF | |
| <?xml version="1.0" encoding="UTF-8"?> | |
| <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> | |
| <plist version="1.0"> |
| Hold the reset button for 30 seconds during boot | |
| release and press ESC a few times | |
| format flash: | |
| set ENABLE_BREAK=yes | |
| set IP_ADDR 10.2.7.10 | |
| set NETMASK 255.255.0.0 | |
| tftp_init | |
| ether_init | |
| flash_init |
| # WARNING: Use this at your own risk. It will probably break your other packages and cause other havoc. | |
| # These days you should just upgrade to Ubuntu 18.04. | |
| $ ssh -V | |
| OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g 1 Mar 2016 | |
| wget https://launchpadlibrarian.net/277739251/openssh-client_7.3p1-1_amd64.deb | |
| wget https://launchpadlibrarian.net/298453050/libgssapi-krb5-2_1.14.3+dfsg-2ubuntu1_amd64.deb | |
| wget https://launchpadlibrarian.net/298453058/libkrb5-3_1.14.3+dfsg-2ubuntu1_amd64.deb | |
| wget https://launchpadlibrarian.net/298453060/libkrb5support0_1.14.3+dfsg-2ubuntu1_amd64.deb |
| <# | |
| Set Active Directory Users Terminal Services Profile Path Using PowerShell | |
| There is no remote desktop services profile path attribute, because TerminalServicesProfilePath is saved in the Active Directory user object's UserParameters attribute as a binary blob | |
| This snippet will find ADUsers that match $TSProfilePath_OLD and set their remote desktop services profile path to $TSProfilePath_NEW | |
| #> | |
| # Need Active Directory Cmdlets | |
| Import-Module ActiveDirectory | |
| # Change TerminalServicesProfilePath only on users that are currently pointing to: |
| [Unit] | |
| Description=Keeps a tunnel to 'remote.example.com' open | |
| After=network.target | |
| [Service] | |
| User=autossh | |
| # -p [PORT] | |
| # -l [user] | |
| # -M 0 --> no monitoring | |
| # -N Just open the connection and do nothing (not interactive) |
| #!/bin/sh | |
| # Zenoss JSON API Shell / Bash script | |
| # Link: https://gist.github.com/8399651 | |
| # Resources | |
| # http://wiki.zenoss.org/Working_with_the_JSON_API | |
| # https://gist.github.com/cluther/1901884 | |
| # http://blog.remibergsma.com/2013/04/26/automatically-adding-and-editing-devices-in-zenoss-core-4-using-the-api |
| # example: Set-PowerShellUICulture -Name "en-US" | |
| function Set-PowerShellUICulture { | |
| param([Parameter(Mandatory=$true)] | |
| [string]$Name) | |
| process { | |
| $culture = [System.Globalization.CultureInfo]::CreateSpecificCulture($Name) | |
| $assembly = [System.Reflection.Assembly]::Load("System.Management.Automation") |
