83
edits
Changes
m
→Brief outline -
[[File:VIVERIS BOUNDARY SCANNER.png|thumb|Viveris JTAG Boundary Scanner]]
== Extract Firmware - ==
[[File:DIF AT FLASH SETTINGS.png|thumb|T48 programmer settings and dump - note the very interesting strings!]]
=== Binwalk / Binvis - ===
I slowed down a bit here because I had no idea how to actually load the file I'd dumped to look at it. First I used Binwalk, which I think is more suited to SOC work. Anyway Binwalk was able to provide a nice image showing the entropy of the file - low entropy = low chance of corruption or encryption (or possibly I'm defining that the incorrect way around)
I also had a look at [https://binvis.io/ Binvis]. Binvis makes for a stunning visual representation, regardless of anything else at all. I love it. It was fun to see the strings represented in coloured pixels. Also, very apparent to see in Binvis, are the banks. This firmware is banked and split. This is to facilitate DFU - the device can be firmware updated by the user while still maintaining stable OS. Then switch a flag to change/denote active bank.
This device has two firmware version strings visible in the firmware (at this point the strings are the only thing I've really been able to see)
Appears it was already updated in the field to the last OS version (1.022) from I'm not sure if it then wipes the other bank? Possibly, because the other regions are written with FF. However it was still pretty confusing to navigate around later on; BRA from active code to 0xFF region. I'm still not sure: maybe the Alesis CPLD remaps certain memory addresses at run time?
[[File:Binwalk entropy image.png|left|thumb|Binwalk entropy image looking good - encouraging at least]]
[[File:DIF-AT BINVIS.png|alt=binvis.io|center|thumb|BINVIS The little 'white line defined' area is where the pointer is viewing]]