Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #524297
Firmware Reverse Engineering
('toc' missing)
Firmware Images
a1470-timecapsule-20150225.bin [ md5 = 2b0d2c5657daa8b65ac1141c912beaa3 ]
Firmware Image Parsing
User #71383@andromeda:~/tmp$ binwalk -Bv a1470-timecapsule-20150225.bin
Scan Time: 2015-03-24 15:21:11
Target File: /home/User #71383/tmp/a1470-timecapsule-20150225.bin
MD5 Checksum: 2b0d2c5657daa8b65ac1141c912beaa3
Signatures: 328
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
74424 0x122B8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/cfebrcm/iproc/CFE/src/shared/siutils.c
79068 0x134DC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/cfebrcm/iproc/CFE/src/shared/aiutils.c
93208 0x16C18 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/cfebrcm/iproc/CFE/src/shared/load.c
93340 0x16C9C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/cfebrcm/iproc/CFE/src/shared/hndchipc.c
147460 0x24004 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 610436 bytes
1072251 0x105C7B Copyright string: "Copyright 1995-2005 User #71419 "
1072536 0x105D98 CRC32 polynomial table, little endian
1076632 0x106D98 CRC32 polynomial table, big endian
1081700 0x108164 gzip compressed data, maximum compression, has original file name: "netbsd.j28_release.image.bin", from Unix, last modified: 2014-04-14 22:11:40
8214656 0x7D5880 Minix filesystem, V1, little endian, -20629 zones
15752315 0xF05C7B Copyright string: "Copyright 1995-2005 User #71419 "
15752600 0xF05D98 CRC32 polynomial table, little endian
15756696 0xF06D98 CRC32 polynomial table, big endian
15761764 0xF08164 gzip compressed data, maximum compression, has original file name: "netbsd.j28_release.image.bin", from Unix, last modified: 2014-04-14 22:11:40
22894720 0x15D5880 Minix filesystem, V1, little endian, -20629 zones
30584320 0x1D2AE00 OpenSSH RSA1 private key, version "1.1"
30591488 0x1D2CA00 PEMPrivacy Enhanced Mail DSAEncryption algorithm private key
30595072 0x1D2D800 OpenSSH DSAEncryption algorithm public key
30598144 0x1D2E400 PEMPrivacy Enhanced Mail RSAEncryption algorithm private key
30602240 0x1D2F400 OpenSSH RSAEncryption algorithm public key
User #71383@andromeda:~/tmp$ openssl rsa -inform PEMPrivacy Enhanced Mail -text -in _a1470-timecapsule-20150225.bin.extracted/1D2E400.key
User #71383@andromeda:~/tmp$ openssl dsa -inform PEMPrivacy Enhanced Mail -text -in _a1470-timecapsule-20150225.bin.extracted/1D2CA00.key
Previous Attempts
Interesting points of
| Offset | Data | Notes |
|---|---|---|
| 0x0000 - 0x003f | unknown, but repetitive data | inital bootstrap code? |
| 0x03E0 | "ZSIB" | Some kind of section header |
| 0x0400 | "FLSH" |
16 bytes of data, followed by what looks like null-terminated strings for NVRAMNon-volatile Random Access Memory variables. Seems data is repeated at offset 0x80000. |
| 0x1400 | "AMZL" | AMZL == LZMA in reverse? |
| 0x8230 | "SHMOO VEPKID" | wtf? |
| 0xB0008 | "C86439500FNF55QAX" |
serial #? repeated later in variable as "mlbserial" |
| 0xB0050 | "141004141004p" 0x700a 0x07d4 | unknown data |
| 0x108164 | gzip compressed data | filename included: "netbsd.j28_release.image.bin", file repeated again at offset 0xF08164 |
| 0xF08164 | gzip compressed data | filename included: "netbsd.j28_release.image.bin" (repeated) |
My attempt at parsing the firmware for the Time Capsule -
| Start Offset | End Offset | Length (bytes) | Interesting Bytes | Notes |
|---|---|---|---|---|
| 0x00000000 | 0x000003DF | 992 | 0xff 0x04 0x00 0xea ... 0x78 0x56 0x34 0x12 | strange/unknown header with several repeating values |
| 0x000003E0 | 0x000003FF | 32 | ZSIB – what is ZSIB | |
| 0x00000400 | 0x000013FF | 4096 | 0xb9 0xb3 0xac 0xb7 at the end of the section | FLSH – I believe this is NVRAM |
| 0x00001400 | 0x0001FFFF | 125,952 | AMZL – I believe this is Broadcom/Apple CFECommon Firmware Environment Bootloader | |
| 0x00020000 | 0x00023FFF | 16,384 | a simple pattern exists for what reason I don't know | |
| 0x00024000 | 0x0004F87F | 178,304 | binary, compressed, and/or encrypted information | |
| 0x0004F880 | 0x0007FFFF | 198,528 | all 0xff – uninitialized flash memory | |
| 0x00080000 | 0x0008026F | 624 | FLSH – an almost complete copy of previous FLSH | |
| 0x00080270 | 0x0009FFFF | 130,448 | all 0xff – uninitialized flash memory | |
| 0x000A0000 | 0x000A7FFF | 32,768 | mlbserial=C86439500FNF55QAX.apple-sn=C86NH3UGF9H5 | NULL terminated strings – transceiver settings |
| 0x000A8000 | 0x000FFFFF | 360,448 | all 0xff – uninitialized flash memory with two exceptions (see above) | |
| 0x00100000 | gzipped NetBSD for Broadcom BCM5301x |
-- that is what I have so far.