Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #524297
Firmware Reverse Engineering
a1470-timecapsule-20150225.bin [ md5 = 2b0d2c5657daa8b65ac1141c912beaa3 ]
Interesting points of
| Offset | Data | Notes |
|---|---|---|
| 0x0000 - 0x003f | unknown, but repetitive data | inital bootstrap code? |
| 0x03E0 | "ZSIB" | Some kind of section header |
| 0x0400 | "FLSH" |
16 bytes of data, followed by what looks like null-terminated strings for NVRAMNon-volatile Random Access Memory variables. Seems data is repeated at offset 0x80000. |
| 0x1400 | "AMZL" | AMZL == LZMA in reverse? |
| 0x8230 | "SHMOO VEPKID" | wtf? |
| 0xB0008 | "C86439500FNF55QAX" |
serial #? repeated later in variable as "mlbserial" |
| 0xB0050 | "141004141004p" 0x700a 0x07d4 | unknown data |
| 0x108164 | gzip compressed data | filename included: "netbsd.j28_release.image.bin", file repeated again at offset 0xF08164 |
| 0xF08164 | gzip compressed data | filename included: "netbsd.j28_release.image.bin" (repeated) |
My attempt at parsing the firmware for the Time Capsule -
| Start Offset | End Offset | Length (bytes) | Interesting Bytes | Notes |
|---|---|---|---|---|
| 0x00000000 | 0x000003DF | 992 | 0xff 0x04 0x00 0xea ... 0x78 0x56 0x34 0x12 | strange/unknown header with several repeating values |
| 0x000003E0 | 0x000003FF | 32 | ZSIB – what is ZSIB | |
| 0x00000400 | 0x000013FF | 4096 | 0xb9 0xb3 0xac 0xb7 at the end of the section | FLSH – I believe this is NVRAM |
| 0x00001400 | 0x0001FFFF | 125,952 | AMZL – I believe this is Broadcom/Apple CFECommon Firmware Environment Bootloader | |
| 0x00020000 | 0x00023FFF | 16,384 | a simple pattern exists for what reason I don't know | |
| 0x00024000 | 0x0004F87F | 178,304 | binary, compressed, and/or encrypted information | |
| 0x0004F880 | 0x0007FFFF | 198,528 | all 0xff – uninitialized flash memory | |
| 0x00080000 | 0x0008026F | 624 | FLSH – an almost complete copy of previous FLSH | |
| 0x00080270 | 0x0009FFFF | 130,448 | all 0xff – uninitialized flash memory | |
| 0x000A0000 | 0x000A7FFF | 32,768 | mlbserial=C86439500FNF55QAX.apple-sn=C86NH3UGF9H5 | NULL terminated strings – transceiver settings |
| 0x000A8000 | 0x000FFFFF | 360,448 | all 0xff – uninitialized flash memory with two exceptions (see above) | |
| 0x00100000 | gzipped NetBSD for Broadcom BCM5301x |
-- that is what I have so far.