whitepoet

How to Use

In Ghidra's Project Tool, Go to Tools -> Import Tool..., select mistyCodeBrowser.tool
Dragging file onto the new CodeBrowser_1 in ToolChest

Decrypting DLINK Proprietary Firmware Images

The DIR-3040 models of DLINK routers feature encrypted firmware images in the most recent versions of the firmware. https://support.dlink.com/ProductInfo.aspx?m=DIR-3040-US details the firmware images available for this product.

1.11B02 - ftp://ftp2.dlink.com/PRODUCTS/DIR-3040/REVA/DIR-3040_REVA_FIRMWARE_v1.11B02.zip
1.02B03 - ftp://ftp2.dlink.com/PRODUCTS/DIR-3040/REVA/DIR-3040_REVA_FIRMWARE_v1.02B03.zip

Unzipping the first reveals two files:

DIR-3040_REVA_RELEASE_NOTES_v1.11B02.pdf

Linksys EA4500 Firmware Decryption

I recently pulled a Linksys EA4500 out of storage for evaluation. The first thing I wanted to do was to update the firmware for the device. https://www.linksys.com/us/support-article?articleNum=148385 offers the latest version of the firmware, which is 3.1.7 as of this writing.

However, we can see with the filename that its probably encrypted: FW_EA4500V3_3.1.7.181919_prod.gpg.img

When I run binwalk I don't get any meaningful results, confirming my suspcicions:

Program Analysis Resources

(draft; work in progress)

	Allow: CONNECT
	Allow: GET
	Allow: HEAD
	Allow: POST
	Allow: TRACE
	Client-IP: 0
	Client-IP: 0177.0000.0000.0001
	Client-IP: 0x7F000001
	Client-IP: 10.0.0.0
	Client-IP: 10.0.0.1

	<script>
	function gc() {
	for (var i = 0; i < 0x80000; ++i) {
	var a = new ArrayBuffer();
	}
	}

	let shellcode = [

	// Move x18 to x28 (TEB)

	#!/bin/bash
	# quick and dirty bash script to extract .gnu_debugdata section
	# from ELF binaries to generate an IDC script that adds these
	# names as symbols
	# --rpw, 2020-06-21

	SYMBOLFILE=debugdata_symbols.elf

	if [ $# -lt 1 ]; then
	echo "you need to supply a path to a binary"