Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Owner: User #524297
Firmware Reverse Engineering
('toc' missing)
Firmware Images
flashrom -V -p buspirate_spi:dev=/dev/ttyUSB0,spispeed=8M,pullups=on -c MX25L25635F -r ./tmp/a1521_timecapsule.bin
a1470-timecapsule-20150225.bin [ md5 = 2b0d2c5657daa8b65ac1141c912beaa3 ]
Firmware Image Parsing
The binwalk command ( http://binwalk.org ) is usually helpful when parsing a known binary file, however, we found that binwalk does not do well against the Apple Airport firmware. Binwalk did identify a few locations to examine further by hand.
User #71383@andromeda:~/tmp$ binwalk -Bv a1470-timecapsule-20150225.bin
Scan Time: 2015-03-24 15:21:11
Target File: /home/User #71383/tmp/a1470-timecapsule-20150225.bin
MD5 Checksum: 2b0d2c5657daa8b65ac1141c912beaa3
Signatures: 328
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
74424 0x122B8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/cfebrcm/iproc/CFE/src/shared/siutils.c
79068 0x134DC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/cfebrcm/iproc/CFE/src/shared/aiutils.c
93208 0x16C18 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/cfebrcm/iproc/CFE/src/shared/load.c
93340 0x16C9C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/cfebrcm/iproc/CFE/src/shared/hndchipc.c
147460 0x24004 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 610436 bytes
1072251 0x105C7B Copyright string: "Copyright 1995-2005 User #71419 "
1072536 0x105D98 CRC32 polynomial table, little endian
1076632 0x106D98 CRC32 polynomial table, big endian
1081700 0x108164 gzip compressed data, maximum compression, has original file name: "netbsd.j28_release.image.bin", from Unix, last modified: 2014-04-14 22:11:40
8214656 0x7D5880 Minix filesystem, V1, little endian, -20629 zones
15752315 0xF05C7B Copyright string: "Copyright 1995-2005 User #71419 "
15752600 0xF05D98 CRC32 polynomial table, little endian
15756696 0xF06D98 CRC32 polynomial table, big endian
15761764 0xF08164 gzip compressed data, maximum compression, has original file name: "netbsd.j28_release.image.bin", from Unix, last modified: 2014-04-14 22:11:40
22894720 0x15D5880 Minix filesystem, V1, little endian, -20629 zones
30584320 0x1D2AE00 OpenSSH RSA1 private key, version "1.1"
30591488 0x1D2CA00 PEMPrivacy Enhanced Mail DSAEncryption algorithm private key
30595072 0x1D2D800 OpenSSH DSAEncryption algorithm public key
30598144 0x1D2E400 PEMPrivacy Enhanced Mail RSAEncryption algorithm private key
30602240 0x1D2F400 OpenSSH RSAEncryption algorithm public key
The "Unix path:" information found by binwalk is simply strings within the Broadcom/Apple CFECommon Firmware Environment bootloader. Analysis of the CFECommon Firmware Environment bootloader is still needed.
The "LZMA compressed data" information found by binwalk is still unknown and analysis is still needed.
We examined the Airport firmware at offset 0x1D2AE00 ( OpenSSH RSA1 private key, version "1.1" ), and determined the five keys found by binwalk to be listed sequentially in the firmware. Where the last key ( OpenSSH RSAEncryption algorithm public key ) ended was a guess.
User #71383@andromeda:~/tmp$ dd if=a1470-timecapsule-20150225.bin of=./openssh_rsa1_private_key ibs=1 skip=30584320 count=7168
7168+0 records in
14+0 records out
7168 bytes (7.2 kB) copied, 0.00173387 s, 4.1 MB/s
User #71383@andromeda:~/tmp$ ssh-keygen -e -f openssh_rsa1_private_key
version 1 keys are not supported
User #71383@andromeda:~/tmp$ dd if=a1470-timecapsule-20150225.bin of=./pem_dsa_private_key ibs=1 skip=30591488 count=3584
3584+0 records in
7+0 records out
3584 bytes (3.6 kB) copied, 0.000970766 s, 3.7 MB/s
User #71383@andromeda:~/tmp$ openssl dsa -inform PEMPrivacy Enhanced Mail -text -in pem_dsa_private_key
read DSAEncryption algorithm key
Private-Key: (1024 bit)
priv:
00:96:17:5f:40:3c:2e:0a:50:e1:58:5f:89:eb:25:
61:42:11:04:25:78
pub:
31:4b:4e:ca:45:e7:60:54:a8:a2:64:fc:32:cf:fb:
fd:3e:98:66:ef:7f:9a:a7:a7:2a:d1:99:2e:97:5e:
cf:2a:64:3a:fb:01:c8:fe:b3:1b:bf:ba:e8:4d:f0:
03:dc:ce:52:28:de:8e:a7:b4:9a:a5:33:93:52:09:
f5:06:57:a6:fa:32:74:7a:69:be:9b:20:5e:51:88:
2a:13:81:85:77:f7:fc:f1:ee:1e:db:bb:ca:3a:07:
50:75:29:92:07:4d:e1:87:0a:55:2d:c4:8c:8a:83:
fd:63:bf:d0:6b:e1:a6:eb:a7:64:2c:66:c0:8f:fe:
c0:a9:c0:d3:72:24:95:91
P:
00:e5:9c:e6:b0:cc:d7:a8:20:af:e5:85:04:43:d2:
d2:32:74:03:67:b4:86:3a:96:3c:3a:5b:28:27:c6:
c9:b4:dd:da:a8:12:93:4a:be:bf:bc:da:df:6e:55:
93:a4:cf:74:91:c1:ed:64:a1:9d:69:ff:d5:1d:d0:
f4:60:3f:98:15:1a:fa:54:43:1f:37:49:b4:0c:a8:
ef:8b:cc:27:fe:66:90:78:3d:80:74:25:a3:f7:fa:
0a:65:d6:70:27:5a:f0:34:13:34:ef:0a:7d:d0:40:
3a:cb:6b:ac:87:0d:a4:01:cd:24:8e:6c:32:07:86:
82:d0:6f:38:7e:ea:82:64:a7
Q:
00:ff:bb:d1:e9:a8:b4:da:a9:03:23:84:86:fa:cc:
f2:bc:1d:89:7b:37
G:
00:92:4c:d6:64:1c:4d:c2:a6:f1:20:1e:55:77:27:
e6:32:3a:c1:ef:d1:58:49:8f:d5:1e:4b:18:fa:ad:
5f:87:da:ec:83:69:04:5e:60:64:3b:36:09:c2:11:
33:be:2c:56:1b:52:14:46:27:eb:67:f8:31:3a:85:
c3:6f:7e:cd:f7:0d:b8:6b:7b:6a:d1:1a:96:44:45:
df:3a:89:fd:f1:4b:d6:9c:67:0c:98:cc:95:9c:87:
b5:52:3b:3b:f0:54:ae:be:ab:71:14:10:c5:83:c9:
23:bb:55:db:32:56:0e:48:1c:3c:36:5a:d8:09:42:
05:62:f4:2c:99:0d:c1:44:a0
writing DSAEncryption algorithm key
-----BEGIN DSAEncryption algorithm PRIVATE KEY-----
MIIBvAIBAAKBgQDlnOawzNeoIK/lhQRD0tIydANntIY6ljw6Wygnxsm03dqoEpNK
vr+82t9uVZOkz3SRwe1koZ1p/9Ud0PRgP5gVGvpUQx83SbQMqO+LzCf+ZpB4PYB0
JaP3+gpl1nAnWvA0EzTvCn3QQDrLa6yHDaQBzSSObDIHhoLQbzh+6oJkpwIVAP+7
0emotNqpAyOEhvrM8rwdiXs3AoGBAJJM1mQcTcKm8SAeVXcn5jI6we/RWEmP1R5L
GPqtX4fa7INpBF5gZDs2CcIRM74sVhtSFEYn62f4MTqFw29+zfcNuGt7atEalkRF
3zqJ/fFL1pxnDJjMlZyHtVI7O/BUrr6rcRQQxYPJI7tV2zJWDkgcPDZa2AlCBWL0
LJkNwUSgAoGAMUtOykXnYFSoomT8Ms/7/T6YZu9/mqenKtGZLpdezypkOvsByP6z
G7+66E3wA9zOUijejqe0mqUzk1IJ9QZXpvoydHppvpsgXlGIKhOBhXf3/PHuHtu7
yjoHUHUpkgdN4YcKVS3EjIqD/WO/0GvhpuunZCxmwI/+wKnA03IklZECFQCWF19A
PC4KUOFYX4nrJWFCEQQleA==
-----END DSAEncryption algorithm PRIVATE KEY-----
User #71383@andromeda:~/tmp$ dd if=a1470-timecapsule-20150225.bin of=./openssh_dsa_public_key ibs=1 skip=30595072 count=3072
3072+0 records in
6+0 records out
3072 bytes (3.1 kB) copied, 0.000795556 s, 3.9 MB/s
User #71383@andromeda:~/tmp$ ssh-keygen -e -f openssh_dsa_public_key
---- BEGIN SSH2 PUBLIC KEY ----
Comment: "1024-bit DSA, converted by User #71383@andromeda from OpenSSH"
AAAAB3NzaC1kc3MAAACBAOWc5rDM16ggr+WFBEPS0jJ0A2e0hjqWPDpbKCfGybTd2qgSk0
q+v7za325Vk6TPdJHB7WShnWn/1R3Q9GA/mBUa+lRDHzdJtAyo74vMJ/5mkHg9gHQlo/f6
CmXWcCda8DQTNO8KfdBAOstrrIcNpAHNJI5sMgeGgtBvOH7qgmSnAAAAFQD/u9HpqLTaqQ
MjhIb6zPK8HYl7NwAAAIEAkkzWZBxNwqbxIB5VdyfmMjrB79FYSY/VHksY+q1fh9rsg2kE
XmBkOzYJwhEzvixWG1IURifrZ/gxOoXDb37N9w24a3tq0RqWREXfOon98UvWnGcMmMyVnI
e1Ujs78FSuvqtxFBDFg8kju1XbMlYOSBw8NlrYCUIFYvQsmQ3BRKAAAACAMUtOykXnYFSo
omT8Ms/7/T6YZu9/mqenKtGZLpdezypkOvsByP6zG7+66E3wA9zOUijejqe0mqUzk1IJ9Q
ZXpvoydHppvpsgXlGIKhOBhXf3/PHuHtu7yjoHUHUpkgdN4YcKVS3EjIqD/WO/0Gvhpuun
ZCxmwI/+wKnA03IklZE=
---- END SSH2 PUBLIC KEY ----
User #71383@andromeda:~/tmp$ dd if=a1470-timecapsule-20150225.bin of=./pem_rsa_private_key ibs=1 skip=30598144 count=4096
4096+0 records in
8+0 records out
4096 bytes (4.1 kB) copied, 0.00101769 s, 4.0 MB/s
User #71383@andromeda:~/tmp$ openssl rsa -inform PEMPrivacy Enhanced Mail -text -in pem_rsa_private_key
Private-Key: (2048 bit)
modulus:
00:e5:9f:ce:d6:ee:d6:85:83:ac:70:15:18:0f:b3:
74:c4:75:4e:bb:7e:1c:51:6d:49:87:8c:46:cc:a5:
df:b7:60:af:ec:2a:2f:6c:41:28:47:74:72:80:36:
0c:ca:ce:8e:fd:d1:d4:28:4e:62:60:30:d8:8c:e5:
ba:b6:79:e4:c8:19:cb:89:c7:9f:71:4e:17:07:fc:
29:4c:16:48:15:7e:c4:dc:e7:18:9c:6e:b9:a5:b2:
3a:75:95:d8:cd:8f:2a:8e:8f:e7:9c:e4:94:fc:93:
9e:a4:71:ad:d6:37:a5:e0:c4:6e:fd:12:93:e2:f6:
82:1c:8d:7a:8b:b9:ca:1b:db:98:64:45:e1:d0:94:
ed:cb:a9:51:e4:c2:cd:be:a0:78:01:76:1e:be:a3:
bb:2e:0a:99:0d:5b:81:6b:c8:40:c1:1a:90:56:35:
a1:ed:e8:b6:fb:69:c5:33:46:a0:c7:9e:9e:f0:01:
95:e8:a9:81:23:03:4d:1f:42:a1:eb:2e:b7:03:4b:
97:21:d6:70:41:96:cc:22:0f:60:9f:2f:58:e2:42:
b7:2c:fb:24:9f:e1:42:c4:88:16:e0:35:f6:a7:e2:
c8:00:14:1c:c6:8c:ff:02:06:ba:69:1c:3b:b4:75:
d4:d0:f3:56:58:b8:f7:1c:60:f3:54:03:66:c7:7e:
03:b5
publicExponent: 65537 (0x10001)
privateExponent:
6c:64:3b:67:09:e7:09:af:56:3e:b2:36:61:72:fc:
b3:a0:0c:42:45:0d:69:02:85:ab:0e:74:7d:35:ef:
9c:c8:6f:42:b3:c7:1e:fa:c2:e0:b7:ff:34:b6:4e:
e3:8d:0d:c2:92:c1:eb:24:d5:1b:42:f3:75:cf:1b:
8b:f7:8e:1f:46:cd:e5:83:ed:a7:b6:8c:f8:9f:f7:
7e:8b:26:0b:bf:83:7e:23:38:62:df:81:92:cd:c6:
fa:aa:79:64:cf:27:ef:93:ce:69:29:1d:8a:fc:c3:
ee:2c:1b:3a:fb:99:b9:b8:00:0c:46:30:b8:fa:54:
00:d6:67:fa:7d:01:02:94:89:0a:51:62:07:d6:8a:
0d:0a:01:13:1a:88:61:d4:6c:3d:fd:a0:72:f3:54:
9a:b2:13:5f:5a:95:ff:a7:e3:8b:31:01:8c:ef:a6:
f6:d7:37:68:1c:53:3d:ac:35:47:14:6e:18:8c:5c:
2b:7c:5b:49:76:26:20:d9:41:73:b8:e2:a1:43:6e:
89:03:bc:b3:a9:b2:59:72:f2:54:03:c4:0e:d5:c8:
b5:76:50:76:39:5e:f2:4d:04:5c:21:5c:c5:77:b2:
e7:3e:f9:96:8b:d1:f4:84:ad:6a:4e:dc:8b:c5:e4:
94:4e:ac:7f:a0:e7:47:c6:39:19:ac:f8:5d:f2:a1:
21
prime1:
00:fc:c0:3f:70:9c:d7:89:03:4c:fe:32:b9:87:e5:
2e:1c:4d:10:5e:8c:01:92:c1:1d:64:91:0d:3e:79:
fc:f7:fb:b1:24:b0:9c:d8:cd:18:98:90:2a:ea:a1:
82:cb:ad:a6:05:b7:8b:32:48:77:35:15:50:fa:32:
54:1c:d9:a2:20:1d:40:bc:df:c5:6c:7e:57:4f:29:
f1:14:ac:02:09:e7:4d:61:1e:1b:5a:56:6e:62:be:
20:f4:c2:e4:0d:f2:96:94:f1:b8:57:e4:76:7c:76:
75:3e:0d:15:eb:25:22:56:e1:57:fe:9b:a3:55:7e:
7b:10:87:49:e1:07:1e:99:cf
prime2:
00:e8:93:74:6e:be:18:78:8c:15:81:dc:92:e0:53:
ae:38:55:51:2c:d4:43:f5:11:d8:3c:38:22:a8:25:
c7:8c:ee:d0:eb:7f:96:5e:c1:5d:ab:e5:7c:fd:2d:
13:d8:62:61:8c:ff:93:47:b0:ad:1c:46:38:73:70:
47:ac:7b:b7:6f:6c:c7:21:63:36:e6:92:ab:69:9c:
c8:77:fb:77:c8:c4:db:52:a7:ac:b3:36:1a:52:42:
04:70:38:f1:d7:f8:0e:c2:fc:77:f6:c0:cf:67:dd:
01:d0:2d:b6:f2:ed:f9:41:bd:aa:08:60:9f:78:a1:
f4:f8:fa:5a:70:ce:c7:9f:3b
exponent1:
00:ea:22:95:22:16:c8:bb:0d:a9:b7:18:fa:31:5f:
26:55:e5:35:b2:bf:f3:7d:25:13:bb:63:7b:67:52:
cd:fa:52:d8:08:6a:eb:01:13:0d:23:d6:f9:4a:9d:
0f:72:ea:8b:8f:64:35:b8:00:d5:1d:01:80:20:25:
9b:31:96:91:cf:3a:0a:0c:6d:26:8f:98:81:fc:bd:
97:ac:54:a3:16:d5:84:22:e1:26:e9:8a:83:7b:49:
31:72:4b:4f:c3:73:e3:f6:59:ed:30:ce:5c:cc:73:
57:ac:81:a6:ba:4b:8e:01:f9:81:f0:43:f1:0c:73:
bc:40:d5:72:a4:d8:59:8a:95
exponent2:
55:4e:30:78:a6:15:07:b2:29:f9:55:d4:31:9f:bf:
d9:3d:c1:e6:75:7c:ef:98:b9:fd:6c:81:99:b7:31:
b8:49:a8:2b:98:c2:a8:c2:b7:fe:e2:cf:b3:75:23:
40:4c:e5:86:f7:ff:27:5e:70:40:5c:a9:3b:fe:44:
eb:c8:fd:01:4b:9e:c6:6a:43:aa:d2:c5:38:99:9f:
16:13:10:5e:7d:86:0c:8d:1f:d5:23:d5:07:b2:db:
39:e6:49:1e:74:07:c6:11:20:57:4b:65:47:ad:52:
8a:ef:19:99:85:1b:d5:b7:21:74:ad:2c:10:ed:26:
93:64:10:64:2c:14:20:1d
coefficient:
51:f8:15:70:fd:36:b0:84:a5:11:66:ac:e1:53:41:
33:fa:6b:ef:cb:59:60:e6:1a:cb:5c:cc:5a:1e:ed:
f2:cd:1b:84:2e:7a:c1:6d:31:e4:a0:f6:99:d7:80:
d5:21:89:9a:85:f7:7d:4b:1a:48:21:8c:a4:4e:f4:
fe:35:60:0e:b7:87:39:c1:22:fb:1d:ef:69:26:10:
bd:a6:3f:d3:d9:72:ac:e2:50:54:f2:08:98:7e:1c:
aa:35:fc:05:0e:d4:d4:a8:48:e6:15:b3:56:40:3a:
20:45:1e:85:9d:f0:e7:89:08:1e:9e:62:dc:3f:76:
7b:a6:d6:11:a6:15:40:80
writing RSAEncryption algorithm key
-----BEGIN RSAEncryption algorithm PRIVATE KEY-----
MIIEowIBAAKCAQEA5Z/O1u7WhYOscBUYD7N0xHVOu34cUW1Jh4xGzKXft2Cv7Cov
bEEoR3RygDYMys6O/dHUKE5iYDDYjOW6tnnkyBnLicefcU4XB/wpTBZIFX7E3OcY
nG65pbI6dZXYzY8qjo/nnOSU/JOepHGt1jel4MRu/RKT4vaCHI16i7nKG9uYZEXh
0JTty6lR5MLNvqB4AXYevqO7LgqZDVuBa8hAwRqQVjWh7ei2+2nFM0agx56e8AGV
6KmBIwNNH0Kh6y63A0uXIdZwQZbMIg9gny9Y4kK3LPskn+FCxIgW4DX2p+LIABQc
xoz/Aga6aRw7tHXU0PNWWLj3HGDzVANmx34DtQIDAQABAoIBAGxkO2cJ5wmvVj6y
NmFy/LOgDEJFDWkChasOdH0175zIb0Kzxx76wuC3/zS2TuONDcKSwesk1RtC83XP
G4v3jh9GzeWD7ae2jPif936LJgu/g34jOGLfgZLNxvqqeWTPJ++TzmkpHYr8w+4s
Gzr7mbm4AAxGMLj6VADWZ/p9AQKUiQpRYgfWig0KARMaiGHUbD39oHLzVJqyE19a
lf+n44sxAYzvpvbXN2gcUz2sNUcUbhiMXCt8W0l2JiDZQXO44qFDbokDvLOpslly
8lQDxA7VyLV2UHY5XvJNBFwhXMV3suc++ZaL0fSErWpO3IvF5JROrH+g50fGORms
+F3yoSECgYEA/MA/cJzXiQNM/jK5h+UuHE0QXowBksEdZJENPnn89/uxJLCc2M0Y
mJAq6qGCy62mBbeLMkh3NRVQ+jJUHNmiIB1AvN/FbH5XTynxFKwCCedNYR4bWlZu
Yr4g9MLkDfKWlPG4V+R2fHZ1Pg0V6yUiVuFX/pujVX57EIdJ4Qcemc8CgYEA6JN0
br4YeIwVgdyS4FOuOFVRLNRD9RHYPDgiqCXHjO7Q63+WXsFdq+V8/S0T2GJhjP+T
R7CtHEY4c3BHrHu3b2zHIWM25pKraZzId/t3yMTbUqesszYaUkIEcDjx1/gOwvx3
9sDPZ90B0C228u35Qb2qCGCfeKH0+PpacM7HnzsCgYEA6iKVIhbIuw2ptxj6MV8m
VeU1sr/zfSUTu2N7Z1LN+lLYCGrrARMNI9b5Sp0PcuqLj2Q1uADVHQGAICWbMZaR
zzoKDG0mj5iB/L2XrFSjFtWEIuEm6YqDe0kxcktPw3Pj9lntMM5czHNXrIGmukuO
AfmB8EPxDHO8QNVypNhZipUCgYBVTjB4phUHsin5VdQxn7/ZPcHmdXzvmLn9bIGZ
tzG4SagrmMKowrf+4s+zdSNATOWG9/8nXnBAXKk7/kTryP0BS57GakOq0sU4mZ8W
ExBefYYMjR/VI9UHsts55kkedAfGESBXS2VHrVKK7xmZhRvVtyF0rSwQ7SaTZBBk
LBQgHQKBgFH4FXD9NrCEpRFmrOFTQTP6a+/LWWDmGstczFoe7fLNG4QuesFtMeSg
9pnXgNUhiZqF931LGkghjKRO9P41YA63hznBIvsd72kmEL2mP9PZcqziUFTyCJh+
HKo1/AUO1NSoSOYVs1ZAOiBFHoWd8OeJCB6eYtw/dnum1hGmFUCA
-----END RSAEncryption algorithm PRIVATE KEY-----
User #71383@andromeda:~/tmp$ dd if=a1470-timecapsule-20150225.bin of=./openssh_rsa_public_key ibs=1 skip=30602240 count=3071
3071+0 records in
5+1 records out
3071 bytes (3.1 kB) copied, 0.000776856 s, 4.0 MB/s
User #71383@andromeda:~/tmp$ ssh-keygen -e -f openssh_rsa_public_key
---- BEGIN SSH2 PUBLIC KEY ----
Comment: "2048-bit RSA, converted by User #71383@andromeda from OpenSSH"
AAAAB3NzaC1yc2EAAAADAQABAAABAQDln87W7taFg6xwFRgPs3TEdU67fhxRbUmHjEbMpd
+3YK/sKi9sQShHdHKANgzKzo790dQoTmJgMNiM5bq2eeTIGcuJx59xThcH/ClMFkgVfsTc
5xicbrmlsjp1ldjNjyqOj+ec5JT8k56kca3WN6XgxG79EpPi9oIcjXqLucob25hkReHQlO
3LqVHkws2+oHgBdh6+o7suCpkNW4FryEDBGpBWNaHt6Lb7acUzRqDHnp7wAZXoqYEjA00f
QqHrLrcDS5ch1nBBlswiD2CfL1jiQrcs+ySf4ULEiBbgNfan4sgAFBzGjP8CBrppHDu0dd
TQ81ZYuPccYPNUA2bHfgO1
---- END SSH2 PUBLIC KEY ----
Now we want to look by hand at the "netbsd.j28_release.image.bin" offsets ( 0x108164 and 0xf08164 ). We confirmed with NetBSD source code ( src/sys/arch/evbarm/stand/gzboot/gzboot.c ) there is a gzboot header (gzip header) at these offsets. Further review of the NetBSD source code ( src/sys/arch/evbarm/stand/gzboot/srtbegin.S ) indicated that the bytes starting at offsets 0x100000 and 0xf00000 are the beginning of the NetBSD gzboot loader. To confirm our suspicions we copied the first 48 bytes at 0x100000 into the Online Disassembler ( http://www.onlinedisassembler.com ) - the disassembly closely matched the assembly code in srtbegin.S. Further disassembly of the gzboot loader via Ghidra is needed. This review by hand further confirmed that the compressed NetBSD kernel begins at the offsets 0x108164 and 0xf08164.
User #71383@andromeda:~/tmp$ dd if=a1470-timecapsule-20150225.bin of=./gzboot-0x100000 ibs=1 skip=1048576 count=33124
33124+0 records in
64+1 records out
33124 bytes (33 kB) copied, 0.011309 s, 2.9 MB/s
User #71383@andromeda:~/tmp$ dd if=a1470-timecapsule-20150225.bin of=./gzboot-0xf00000 ibs=1 skip=15728640 count=33124
33124+0 records in
64+1 records out
33124 bytes (33 kB) copied, 0.0119577 s, 2.8 MB/s
Additional disassembly of the gzboot code should reveal the size of the compressed NetBSD kernel. But for now we want to look by hand at the "Minix filesystem" offsets ( 0x7d5880 and 0x15d5880 ) found by binwalk. After skipping to offset 0x7d5880, we examined the binary bytes before the offset and found that the first "netbsd.j28_release.image.bin" image ends at 0x7d547b with zeros until 0x7d5880. Therefore, we believe the first compressed NetBSD kernel can be found at 0x108164 - 0x7d5880 ( 7,132,956 bytes ). We followed these same steps with the second "netbsd.j28_release.image.bin" image - the image ends at 0x15d547b with zeros until 0x15d5880. Therefore, we believe the second compressed NetBSD kernel can be found at 0xf08164 - 0x15d5880 ( 7,132,956 bytes ).
When we try to gunzip the extracted, compressed NetBSD kernels with the information above we received the following message - "gzip: compressed_netbsd_kernel-0x108164.gz: unexpected end of file". Therefore, we need to re-examine the compressed kernel's ending offsets until gunzip can properly uncompress the kernel. The first question we have is - why did binwalk identify a "Minix filesystem" at offsets ( 0x7d5880 and 0x15d5880 )? When looking at the firmware in a hex editor, we find all zeros before and after these offsets - no immediate data. Since 0x7d5880 is not the end of the compressed NetBSD kernel, we started scanning the firmware below 0x7d5880 which discovered more binary data. After several trial-and-error attempts, we found the end of the first compressed NetBSD kernel at 0x88494f offset. If the second compressed NetBSD kernel follows the first, then the end of the second compressed NetBSD kernel would be at 0x168494f offset. We were able to confirm our suspicions. We now know that the first compressed NetBSD kernel can be found at 0x108164 - 0x88494f ( 7,849,964 bytes ) while the second compressed NetBSD kernel can be found at 0xf08164 - 0x168494f ( 7,849,964 bytes ).
User #71383@andromeda:~/tmp$ dd if=a1470-timecapsule-20150225.bin of=./compressed_netbsd_kernel-0x108164.gz ibs=1 skip=1081700 count=7849964
7849964+0 records in
15331+1 records out
7849964 bytes (7.8 MB) copied, 2.56776 s, 3.1 MB/s
User #71383@andromeda:~/tmp$ dd if=a1470-timecapsule-20150225.bin of=./compressed_netbsd_kernel-0xf08164.gz ibs=1 skip=15761764 count=7849964
7849964+0 records in
15331+1 records out
7849964 bytes (7.8 MB) copied, 2.28769 s, 3.4 MB/s
User #71383@andromeda:~/tmp$ file compressed_netbsd_kernel-0x*
compressed_netbsd_kernel-0x108164.gz: gzip compressed data, was "netbsd.j28_release.image.bin", from Unix, last modified: Mon Apr 14 18:11:40 2014, max compression
compressed_netbsd_kernel-0xf08164.gz: gzip compressed data, was "netbsd.j28_release.image.bin", from Unix, last modified: Mon Apr 14 18:11:40 2014, max compression
User #71383@andromeda:~/tmp$ gunzip compressed_netbsd_kernel-0x108164.gz
User #71383@andromeda:~/tmp$ gunzip compressed_netbsd_kernel-0xf08164.gz
User #71383@andromeda:~/tmp$ ll
total 125232
drwxr-xr-x 2 User #71383 User #71383 4096 2015-03-26 18:19 ./
drwxr-xr-x 31 User #71383 User #71383 4096 2015-03-24 19:06 ../
-rw-rw-r-- 1 User #71383 User #71383 33558528 2015-02-24 23:37 a1470-timecapsule-20150224.bin
-rw-rw-r-- 1 User #71383 User #71383 33554432 2015-02-25 14:24 a1470-timecapsule-20150225.bin
-rw-rw-r-- 1 User #71383 User #71383 22652736 2015-03-26 18:16 compressed_netbsd_kernel-0x108164
-rw-rw-r-- 1 User #71383 User #71383 7849964 2015-03-26 18:18 compressed_netbsd_kernel-0x108164.gz.orig
-rw-rw-r-- 1 User #71383 User #71383 22652736 2015-03-26 18:17 compressed_netbsd_kernel-0xf08164
-rw-rw-r-- 1 User #71383 User #71383 7849964 2015-03-26 18:18 compressed_netbsd_kernel-0xf08164.gz.orig
-rw-rw-r-- 1 User #71383 User #71383 33124 2015-03-25 15:41 gzboot-0x100000
-rw-rw-r-- 1 User #71383 User #71383 33124 2015-03-25 15:39 gzboot-0xf00000
-rw-rw-r-- 1 User #71383 User #71383 3072 2015-03-25 14:32 openssh_dsa_public_key
-rw-rw-r-- 1 User #71383 User #71383 7168 2015-03-25 14:27 openssh_rsa1_private_key
-rw-rw-r-- 1 User #71383 User #71383 6144 2015-03-25 15:18 openssh_rsa_public_key
-rw-rw-r-- 1 User #71383 User #71383 3584 2015-03-25 14:30 pem_dsa_private_key
-rw-rw-r-- 1 User #71383 User #71383 4096 2015-03-25 14:35 pem_rsa_private_key
Now we needed to binwalk the newly uncompressed file images to learn more about the NetBSD kernel image.
User #71383@andromeda:~/tmp$ binwalk -Bv compressed_netbsd_kernel-0x108164 >> binwalk-0x108164.txt
User #71383@andromeda:~/tmp$ binwalk -Bv compressed_netbsd_kernel-0xf08164 >> binwalk-0xf08164.txt
User #71383@andromeda:~/tmp$ diff binwalk-0x108164.txt binwalk-0xf08164.txt
2,3c2,3
< Scan Time: 2015-03-26 18:25:38
< Target File: /home/User #71383/tmp/compressed_netbsd_kernel-0x108164
---
> Scan Time: 2015-03-26 18:26:08
> Target File: /home/User #71383/tmp/compressed_netbsd_kernel-0xf08164
User #71383@andromeda:~/tmp$ view binwalk-0x108164.txt
Scan Time: 2015-03-26 18:25:38
Target File: /home/User #71383/tmp/compressed_netbsd_kernel-0x108164
MD5 Checksum: db9dfaa6fa24769d094e46c6972a4807
Signatures: 328
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
187493 0x2DC65 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5380
195445 0x2FB75 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1284
335729 0x51F71 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 572
397901 0x6124D Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1280
1188941 0x12244D Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 528
1215657 0x128CA9 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5380
1237057 0x12E041 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1284
1307357 0x13F2DD Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1280
1713685 0x1A2615 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5380
1798453 0x1B7135 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5380
1807285 0x1B93B5 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5376
1851817 0x1C41A9 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5388
1855733 0x1C50F5 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5388
2000373 0x1E85F5 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5376
2060677 0x1F7185 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5396
2540753 0x26C4D1 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5532
2673185 0x28CA21 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5380
2833081 0x2B3AB9 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5484
3153817 0x301F99 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5380
3521341 0x35BB3D Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1388
3547033 0x361F99 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1388
3580093 0x36A0BD Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1388
3582629 0x36AAA5 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1388
3892281 0x3B6439 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1288
4005308 0x3D1DBC VxWorks symbol table, little endian, first entry: [type: initialized data, code address: 0x805641F0, symbol address: 0xFFFF0012]
4006508 0x3D226C CRC32 polynomial table, little endian
4442248 0x43C888 gzip compressed data, from Unix, NULL date (1970-01-01 00:00:00)
4568243 0x45B4B3 Copyright string: "Copyright 1995-2002 Jean-loup Gailly "
4569067 0x45B7EB Copyright string: "Copyright 1995-2002 User #71419 "
4572020 0x45C374 CRC32 polynomial table, little endian
4576116 0x45D374 CRC32 polynomial table, big endian
4581016 0x45E698 SHA256 hash constants, little endian
4581640 0x45E908 XMLExtensible Markup Language document, version: "1.0"
4581980 0x45EA5C Base64 standard index table
4582306 0x45EBA2 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/Firmware/NetBSD/Targets/J28/release/obj/build.kernel-target.conf
4582510 0x45EC6E Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/Firmware/NetBSD/Targets/J28/release/obj/build.kernel-target.conf
4582648 0x45ECF8 Copyright string: "Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,"
4582821 0x45EDA5 Copyright string: "Copyright (c) 1982, 1986, 1989, 1991, 1993"
4624076 0x468ECC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/miscfs/genfs/genfs_io.c
4627036 0x469A5C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/../../../apple_netbsd/fs/hfs/hfs_readwrite.c
4627748 0x469D24 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/../../../apple_netbsd/fs/hfs/hfs_vfsops.c
4629440 0x46A3C0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/../../../apple_netbsd/fs/hfs/hfs_vnops.c
4630684 0x46A89C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netinet6/icmp6.c
4643864 0x46DC18 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netinet6/ip6_input.c
4644160 0x46DD40 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netinet6/ip6_output.c
4644772 0x46DFA4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netinet/ip_input.c
4645168 0x46E130 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netinet/ip_output.c
4645672 0x46E328 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netipsec/ipsec.c
4647780 0x46EB64 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netipsec/ipsec_input.c
4648832 0x46EF80 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netipsec/ipsec_netbsd.c
4649404 0x46F1BC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netipsec/ipsec_output.c
4656092 0x470BDC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/kern/kern_sysctl.c
4659528 0x471948 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netipsec/key.c
4671589 0x474865 Neighborly text, "neighboracket %d)"
4671801 0x474939 Neighborly text, "neighbornput: invalid ND option, ignored"
4692784 0x479B30 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/net/route.c
4712120 0x47E6B8 MPFS filesystem, Microchop, version 44.32, 28020 file entries
4722660 0x480FE4 Neighborly text, "neighbor anon/obj pg=%d/%d, gets(lock/unlock)=%d/%des: anon=%d, anoncow=%d, obj=%d, prcopy=%d, przero=%d"
4728384 0x482640 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/../../../apple_netbsd/fs/vfs/vfs_journal.c
4735308 0x48414C MPFS filesystem, Microchop, version 0.0, 0 file entries
4751560 0x4880C8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netipsec/xform_ah.c
4753176 0x488718 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netipsec/xform_esp.c
4754620 0x488CBC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/netipsec/xform_ipcomp.c
4757148 0x48969C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/lib/libkern/../../../common/lib/libppath/ppath.c
4816540 0x497E9C ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
5161711 0x4EC2EF Neighborly text, "neighbors6_stats"
5218732 0x4FA1AC Neighborly text, "neighbor_count_neighbors"
5218796 0x4FA1EC Neighborly text, "neighbors"
5280947 0x5094B3 Neighborly text, "neighborock"
5809639 0x58A5E7 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
6008126 0x5BAD3E Minix filesystem, V1, big endian, 0 zones
6076128 0x5CB6E0 ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
6084697 0x5CD859 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5376
6770949 0x675105 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1300
7084253 0x6C18DD Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5384
7084301 0x6C190D Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5380
7086957 0x6C236D Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5384
7087005 0x6C239D Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5380
9044757 0x8A0315 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1456
10796513 0xA4BDE1 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5400
11565773 0xB07ACD Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 1280
12098385 0xB89B51 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5384
12098621 0xB89C3D Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 5460
13223435 0xC9C60B mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 4bit
13643589 0xD02F45 Certificate in DERDistinguished Encoding Rules (certificate file format) format (x509 v3), header length: 4, sequence length: 771
14046480 0xD65510 Unix path: /usr/share/misc/more.help
14048508 0xD65CFC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/usr.sbin/services_mkdb/services_mkdb.c
14059692 0xD688AC Neighborly text, "neighbors"
14059718 0xD688C6 Neighborly text, "neighbor countst"
14059739 0xD688DB Neighborly text, "neighbors for %s%s"
14059770 0xD688FA Neighborly text, "neighbor listnnel: %d bssidinfo: %#x"
14059784 0xD68908 Neighborly text, "Neighbor list for %sinfo: %#x"
14072275 0xD6B9D3 VxWorks symbol table, big endian, first entry: [type: initialized data, code address: 0xFF30F47A, symbol address: 0x510000]
14082580 0xD6E214 CRC32 polynomial table, little endian
14090944 0xD702C0 Neighborly text, "Neighbor Report List:02x:%02x "
14112148 0xD75594 Neighborly text, "Neighbor Reporteout Interval"
14143185 0xD7CED1 Unix path: /cr1/cr2/pll/all ]
14189669 0xD88465 Neighborly text, "neighbor report measurement requestd]"
14189744 0xD884B0 Neighborly text, "neighbor report listm 11k neighbor report list"
14189813 0xD884F5 Neighborly text, "neighbor report listnode to 11k neighbor report list"
14189888 0xD88540 Neighborly text, "neighbor report listinfo] [regulatory] [channel] [phytype]"
14199620 0xD8AB44 Neighborly text, "Neighbor_Report"
14200048 0xD8ACF0 Neighborly text, "Neighbor_Report_TSF_Offsett"
14265328 0xD9ABF0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/pf/usr/sbin/pfctl/pfctl_optimize.c
14289488 0xDA0A50 CRC32 polynomial table, little endian
14312536 0xDA6458 Unix path: /System/Library/Filesystems/hfs.fs/Encodings/
14332916 0xDAB3F4 Copyright string: "Copyright 2004-2010 Internet Systems Consortium."
14333348 0xDAB5A4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/server/dhcpd.c
14335636 0xDABE94 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/server/dhcp.c
14347000 0xDAEAF8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/server/db.c
14348160 0xDAEF80 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/server/class.c
14362752 0xDB2880 Copyright string: "Copyright 2004-2010 Internet Systems Consortium."
14365608 0xDB33A8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/client/dhclient.c
14368908 0xDB408C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/client/dhc6.c
14409591 0xDBDF77 Unix path: /WPA/WPA2/EAP/RADIUS Authenticator
14409626 0xDBDF9A Copyright string: "Copyright (c) 2002-2008, User #71421 <j@w1.fi> and contributors"
14436865 0xDC4A01 Neighborly text, "neighbor.set.]}"
14473306 0xDCD85A Copyright string: "Copyright (c) 2003-2008, User #71421 <j@w1.fi> and contributors"
14474656 0xDCDDA0 Copyright string: "copyright"
14474791 0xDCDE27 Copyright string: "copyright"
14474991 0xDCDEEF Copyright string: "copyright holder(s) nor the"
14493468 0xDD271C Unix path: /usr/local/share/curl/curl-ca-bundle.crt
14496916 0xDD3494 gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)
14542560 0xDDE6E0 Executable script, shebang: "/bin/sh -"
14542797 0xDDE7CD Copyright string: "Copyright (c) 2003,2007,2008 The NetBSD Foundation, Inc."
14543086 0xDDE8EE Copyright string: "copyright"
14543224 0xDDE978 Copyright string: "copyright"
14583520 0xDE86E0 Executable script, shebang: "/bin/sh"
14583534 0xDE86EE Copyright string: "Copyright (C) 2005-2006 Apple Computer, Inc. All Rights Reserved."
14588152 0xDE98F8 Copyright string: "Copyright (c) 2005-2013 Apple Inc. All rights reserved."
14661344 0xDFB6E0 Executable script, shebang: "/bin/sh"
14673124 0xDFE4E4 Copyright string: "Copyright (C) 2009 Apple Inc. All rights reserved."
14673632 0xDFE6E0 Executable script, shebang: "/bin/sh"
14677792 0xDFF720 Copyright string: "Copyright (c) 1997-2011 The NetBSD Foundation, Inc."
14678171 0xDFF89B Copyright string: "copyright"
14678309 0xDFF925 Copyright string: "copyright"
14706404 0xE066E4 Copyright string: "Copyright (C) 2009 Apple Inc. All rights reserved."
14708448 0xE06EE0 Executable script, shebang: "/sbin/sysctl -f"
14709476 0xE072E4 Copyright string: "Copyright (C) 2006 Apple Computer, Inc. All rights reserved."
14723559 0xE0A9E7 Neighborly text, "neighbor solicitation and advertisement.pv6-icmp all icmp6-type neighbrsol"
14724832 0xE0AEE0 Executable script, shebang: "/bin/sh"
14725856 0xE0B2E0 Executable script, shebang: "/bin/sh"
14734720 0xE0D580 Unix path: /var/chroot/named/etc/namedb
14741335 0xE0EF57 Unix path: /etc/racoon/remote/anonymous.conf
14742433 0xE0F3A1 Unix path: /etc/racoon/remote/anonymous.conf
14745312 0xE0FEE0 Executable script, shebang: "/bin/sh"
14745824 0xE100E0 Executable script, shebang: "/bin/sh"
14746336 0xE102E0 Executable script, shebang: "/bin/sh"
14746848 0xE104E0 Executable script, shebang: "/bin/sh"
14747360 0xE106E0 Executable script, shebang: "/bin/sh"
14747872 0xE108E0 Executable script, shebang: "/bin/sh"
14747886 0xE108EE Copyright string: "Copyright (c) 2005 Apple Computer, Inc. All rights reserved."
14748896 0xE10CE0 Executable script, shebang: "/bin/sh"
14749408 0xE10EE0 Executable script, shebang: "/bin/sh"
14749920 0xE110E0 Executable script, shebang: "/bin/sh"
14750944 0xE114E0 Executable script, shebang: "/bin/sh"
14751456 0xE116E0 Executable script, shebang: "/bin/sh"
14752480 0xE11AE0 Executable script, shebang: "/bin/sh"
14752501 0xE11AF5 Unix path: /cvs/repository/Embedded/Firmware/NetBSD/Targets/K30A/all/etc/rc.d/flash,v $
14753504 0xE11EE0 Executable script, shebang: "/bin/sh"
14754016 0xE120E0 Executable script, shebang: "/bin/sh"
14755040 0xE124E0 Executable script, shebang: "/bin/sh"
14755552 0xE126E0 Executable script, shebang: "/bin/sh"
14757600 0xE12EE0 Executable script, shebang: "/bin/sh"
14759136 0xE134E0 Executable script, shebang: "/bin/sh"
14759648 0xE136E0 Executable script, shebang: "/bin/sh"
14760672 0xE13AE0 Executable script, shebang: "/bin/sh"
14762208 0xE140E0 Executable script, shebang: "/bin/sh"
14762720 0xE142E0 Executable script, shebang: "/bin/sh"
14763744 0xE146E0 Executable script, shebang: "/bin/sh"
14776032 0xE176E0 Executable script, shebang: "/bin/sh"
14776544 0xE178E0 Executable script, shebang: "/bin/sh"
14777056 0xE17AE0 Executable script, shebang: "/bin/sh"
14779104 0xE182E0 Executable script, shebang: "/bin/sh"
14787808 0xE1A4E0 Executable script, shebang: "/bin/sh"
14788320 0xE1A6E0 Executable script, shebang: "/bin/sh"
14788334 0xE1A6EE Copyright string: "Copyright (C) 2009 Apple Inc. All rights reserved."
14798560 0xE1CEE0 Executable script, shebang: "/bin/sh"
14798655 0xE1CF3F Copyright string: "Copyright (C) 2009 Apple Inc. All rights reserved."
14800608 0xE1D6E0 Executable script, shebang: "/bin/sh"
14800624 0xE1D6F0 Copyright string: "Copyright (C) 2009 Apple Inc. All rights reserved."
14803680 0xE1E2E0 Executable script, shebang: "/bin/sh"
14804704 0xE1E6E0 Executable script, shebang: "/bin/sh"
14813684 0xE209F4 PEMPrivacy Enhanced Mail certificate
14818416 0xE21C70 PEMPrivacy Enhanced Mail certificate
14822268 0xE22B7C PEMPrivacy Enhanced Mail certificate
14825144 0xE236B8 PEMPrivacy Enhanced Mail certificate
14829954 0xE24982 PEMPrivacy Enhanced Mail certificate
14833149 0xE255FD PEMPrivacy Enhanced Mail certificate
14836291 0xE26243 PEMPrivacy Enhanced Mail certificate
14839413 0xE26E75 PEMPrivacy Enhanced Mail certificate
14843220 0xE27D54 PEMPrivacy Enhanced Mail certificate
14847646 0xE28E9E PEMPrivacy Enhanced Mail certificate
14851453 0xE29D7D PEMPrivacy Enhanced Mail certificate
14855849 0xE2AEA9 PEMPrivacy Enhanced Mail certificate
14859731 0xE2BDD3 PEMPrivacy Enhanced Mail certificate
14868878 0xE2E18E PEMPrivacy Enhanced Mail certificate
14873689 0xE2F459 PEMPrivacy Enhanced Mail certificate
14878432 0xE306E0 PEMPrivacy Enhanced Mail certificate
14882099 0xE31533 PEMPrivacy Enhanced Mail certificate
14885777 0xE32391 PEMPrivacy Enhanced Mail certificate
14888533 0xE32E55 PEMPrivacy Enhanced Mail certificate
14891148 0xE3388C PEMPrivacy Enhanced Mail certificate
14893773 0xE342CD PEMPrivacy Enhanced Mail certificate
14896493 0xE34D6D PEMPrivacy Enhanced Mail certificate
14899215 0xE3580F PEMPrivacy Enhanced Mail certificate
14900112 0xE35B90 Unix path: /Iw/wnOc9GTq36ntTlvIAWDuOW1DJ/N/qgjS/k5v
14903310 0xE3680E PEMPrivacy Enhanced Mail certificate
14907926 0xE37A16 PEMPrivacy Enhanced Mail certificate
14910456 0xE383F8 PEMPrivacy Enhanced Mail certificate
14915083 0xE3960B PEMPrivacy Enhanced Mail certificate
14919744 0xE3A840 PEMPrivacy Enhanced Mail certificate
14920302 0xE3AA6E Unix path: /Xz7nZvThPOw1EblVB/vwJ29i/844h8egStfYTpdPGTJMisAL/7h0M
14924405 0xE3BA75 PEMPrivacy Enhanced Mail certificate
14929044 0xE3CC94 PEMPrivacy Enhanced Mail certificate
14929874 0xE3CFD2 Unix path: /8/UswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
14933489 0xE3DDF1 PEMPrivacy Enhanced Mail certificate
14938006 0xE3EF96 PEMPrivacy Enhanced Mail certificate
14942121 0xE3FFA9 PEMPrivacy Enhanced Mail certificate
14946236 0xE40FBC PEMPrivacy Enhanced Mail certificate
14950351 0xE41FCF PEMPrivacy Enhanced Mail certificate
14954444 0xE42FCC PEMPrivacy Enhanced Mail certificate
14957690 0xE43C7A PEMPrivacy Enhanced Mail certificate
14960963 0xE44943 PEMPrivacy Enhanced Mail certificate
14964219 0xE455FB PEMPrivacy Enhanced Mail certificate
14967457 0xE462A1 PEMPrivacy Enhanced Mail certificate
14970663 0xE46F27 PEMPrivacy Enhanced Mail certificate
14974601 0xE47E89 Unix path: /kzkyp/tgWpW/72M5We/XWIO/kR81jJP+5vvFIo8EBcua9wK3tJg3K
14993662 0xE4C8FE PEMPrivacy Enhanced Mail certificate
14998121 0xE4DA69 PEMPrivacy Enhanced Mail certificate
15001168 0xE4E650 PEMPrivacy Enhanced Mail certificate
15004215 0xE4F237 PEMPrivacy Enhanced Mail certificate
15007278 0xE4FE2E PEMPrivacy Enhanced Mail certificate
15007911 0xE500A7 Unix path: /AAa19oM/DJhuBUNlvP6Vxt/M3yv6ZiaYch6s7f/sdyZ
15010018 0xE508E2 PEMPrivacy Enhanced Mail certificate
15012818 0xE513D2 PEMPrivacy Enhanced Mail certificate
15016056 0xE52078 PEMPrivacy Enhanced Mail certificate
15020703 0xE5329F PEMPrivacy Enhanced Mail certificate
15023498 0xE53D8A PEMPrivacy Enhanced Mail certificate
15026740 0xE54A34 PEMPrivacy Enhanced Mail certificate
15031383 0xE55C57 PEMPrivacy Enhanced Mail certificate
15034178 0xE56742 PEMPrivacy Enhanced Mail certificate
15037416 0xE573E8 PEMPrivacy Enhanced Mail certificate
15042073 0xE58619 PEMPrivacy Enhanced Mail certificate
15045311 0xE592BF PEMPrivacy Enhanced Mail certificate
15049900 0xE5A4AC PEMPrivacy Enhanced Mail certificate
15052535 0xE5AEF7 PEMPrivacy Enhanced Mail certificate
15055163 0xE5B93B PEMPrivacy Enhanced Mail certificate
15059528 0xE5CA48 PEMPrivacy Enhanced Mail certificate
15064385 0xE5DD41 PEMPrivacy Enhanced Mail certificate
15070911 0xE5F6BF PEMPrivacy Enhanced Mail certificate
15076471 0xE60C77 PEMPrivacy Enhanced Mail certificate
15082015 0xE6221F PEMPrivacy Enhanced Mail certificate
15087584 0xE637E0 PEMPrivacy Enhanced Mail certificate
15092926 0xE64CBE PEMPrivacy Enhanced Mail certificate
15105771 0xE67EEB Unix path: /usr/share/tabset/vt100
15111392 0xE694E0 Executable script, shebang: "/bin/sh"
15114976 0xE6A2E0 Unix path: /var/sv/dnscache/root
15116512 0xE6A8E0 Executable script, shebang: "/bin/sh"
15119072 0xE6B2E0 Executable script, shebang: "/bin/sh"
15121120 0xE6BAE0 Unix path: /var/sv/walldns/root
15122656 0xE6C0E0 Executable script, shebang: "/bin/sh"
18719424 0x11DA2C0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/main.c
18719692 0x11DA3CC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/session.c
18720336 0x11DA650 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp.c
18726168 0x11DBD18 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/handler.c
18727392 0x11DC1E0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp_ident.c
18728532 0x11DC654 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp_agg.c
18728780 0x11DC74C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp_base.c
18728968 0x11DC808 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp_quick.c
18731688 0x11DD2A8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp_inf.c
18733652 0x11DDA54 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/dnssec.c
18733980 0x11DDB9C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/privsep.c
18736088 0x11DE3D8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/pfkey.c
18740140 0x11DF3AC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/admin.c
18740972 0x11DF6EC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/evt.c
18741440 0x11DF8C0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/ipsec_doi.c
18746732 0x11E0D6C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/oakley.c
18758408 0x11E3B08 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/grabmyaddr.c
18758748 0x11E3C5C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/vendorid.c
18759600 0x11E3FB0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/policy.c
18759840 0x11E40A0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/localconf.c
18760124 0x11E41BC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/remoteconf.c
18761840 0x11E4870 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c
18762640 0x11E4B90 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/algorithm.c
18763412 0x11E4E94 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/proposal.c
18765092 0x11E5524 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/sainfo.c
18769504 0x11E6660 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/plog.c
18769852 0x11E67BC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/backupsa.c
18770356 0x11E69B4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/rsalist.c
18770620 0x11E6ABC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/cftoken.l
18771524 0x11E6E44 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/cfparse.y
18774828 0x11E7B2C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/prsa_par.y
18775456 0x11E7DA0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp_xauth.c
18777192 0x11E8468 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c
18779436 0x11E8D2C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp_unity.c
18779696 0x11E8E30 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/throttle.c
18779836 0x11E8EBC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/isakmp_frag.c
18780132 0x11E8FE4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/nattraversal.c
18780580 0x11E91A4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/vmbuf.c
18780812 0x11E928C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/dist/ipsec-tools/src/racoon/sockmisc.c
18811194 0x11F093A Unix path: /50/100/200/400/800 hz)
18814679 0x11F16D7 Unix path: /50/100/200/400/800 Hz
18819453 0x11F297D Neighborly text, "NeighborInfo__ACPCloud_Update_imp"
18838436 0x11F73A4 Neighborly text, "neighbor"
18848520 0x11F9B08 Unix path: /var/sv/dnscache/root/servers/@
18864216 0x11FD858 Unix path: /mnt/Flash/private/ca.key
18882948 0x1202184 XMLExtensible Markup Language document, version: "1.0"
18885020 0x120299C Base64 standard index table
18992000 0x121CB80 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/bin/cp/cp.c
18997744 0x121E1F0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/bin/df/df.c
19011072 0x1221600 Neighborly text, "Neighbor Solicitationtination: %s"
19011096 0x1221618 Neighborly text, "Neighbor Advertisement: %s"
19032668 0x1226A5C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/sys/kern/vfs_wapbl.c
19067020 0x122F08C Unix path: /kern/coredump/setid/mode
19068280 0x122F578 Unix path: /var/spool/lock/LCK..
19073716 0x1230AB4 Copyright string: "Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,"
19073889 0x1230B61 Copyright string: "Copyright (c) 1982, 1986, 1989, 1991, 1993"
19081260 0x123282C Copyright string: "Copyright (c) 1984 through 2008, User #71420"
19103228 0x1237DFC Unix path: /avg/max/total/stddev = %d/%.0f/%d/%.0f/%.1f
19113188 0x123A4E4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/iperf/compat/Thread.c
19114120 0x123A888 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/iperf/src/Reporter.c
19114368 0x123A980 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/iperf/src/sockets.c
19114872 0x123AB78 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/iperf/src/Listener.cpp
19115216 0x123ACD0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/iperf/src/PerfSocket.cpp
19119976 0x123BF68 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssh/dist/sshd.c
19126364 0x123D85C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssh/dist/auth-rsa.c
19130864 0x123E9F0 Unix path: /usr/X11R7/bin/xauth
19136524 0x124000C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssh/dist/auth1.c
19144840 0x1242088 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssh/dist/auth2-chall.c
19166112 0x12473A0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssh/dist/ssh.c
19171572 0x12488F4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssh/dist/clientloop.c
19180560 0x124AC10 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssh/dist/sshconnect1.c
19192432 0x124DA70 OpenSSL encryption, salted, salt: 0x00
19195444 0x124E634 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/apps.c
19201336 0x124FD38 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/ecparam.c
19205596 0x1250DDC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/pkeyutl.c
19206288 0x1251090 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/ts.c
19213724 0x1252D9C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/s_cb.c
19214000 0x1252EB0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/s_socket.c
19220384 0x12547A0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/dgst.c
19222244 0x1254EE4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/dh.c
19223312 0x1255310 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/dhparam.c
19224004 0x12555C4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/enc.c
19225092 0x1255A04 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/passwd.c
19226888 0x1256108 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/ca.c
19236544 0x12586C0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/rsa.c
19237128 0x1258908 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/rsautl.c
19237592 0x1258AD8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/dsaparam.c
19238388 0x1258DF4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/x509.c
19250392 0x125BCD8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/s_server.c
19251396 0x125C0C4 HTMLHypertext Markup Language document header
19251631 0x125C1AF HTMLHypertext Markup Language document footer
19252588 0x125C56C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/s_client.c
19254847 0x125CE3F Unix path: /-no_tls1_1/-no_tls1/-no_ssl3/-no_ssl2 - turn off that protocol
19258304 0x125DBC0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/speed.c
19263384 0x125EF98 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/srp.c
19270680 0x1260C18 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/engine.c
19276104 0x1262148 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/apps/ocsp.c
19324820 0x126DF94 Neighborly text, "Neighbor Signaled Session Downwn"
19335898 0x1270ADA Neighborly text, "neighbor %ss metric %d"
19335981 0x1270B2D Neighborly text, "neighbors(old)ghbors2"
19335997 0x1270B3D Neighborly text, "Neighbors(old)rs2"
19336041 0x1270B69 Neighborly text, "neighbors2nel"
19336053 0x1270B75 Neighborly text, "Neighbors2/querier"
19347037 0x127365D Neighborly text, "Neighbor: %s"
19349106 0x1273E72 Neighborly text, "Neighbor: %s%s"
19349159 0x1273EA7 Neighborly text, "Neighbor: %sd vs %lu)"
19349183 0x1273EBF Neighborly text, "Neighbor: %s %s mask %s"
19349588 0x1274054 Neighborly text, "Neighbor System-ID: %s-ID: 0x%08x"
19349620 0x1274074 Neighborly text, "Neighbor Extended Local circuit-ID: 0x%08x"
19349821 0x127413D Neighborly text, "neighbor address: %s%s"
19351159 0x1274677 Neighborly text, "Neighbor(s)"
19351195 0x127469B Neighborly text, "Neighbors"
19351211 0x12746AB Neighborly text, "Neighbor(s)ecksum"
19351227 0x12746BB Neighborly text, "Neighbor(s) (variable length)ffersize"
19352237 0x1274AAD Neighborly text, "neighbor addresswidth"
19362422 0x1277276 Neighborly text, "Neighbor Router-ID: %s, Interface Address: %sRouter-ID: %s, Interface Address: %s"
19362476 0x12772AC Neighborly text, "Neighbor Router-ID: %s, Interface Address: %sr Network-ID: %s, Interface Address: %s"
19362532 0x12772E4 Neighborly text, "Neighbor Network-ID: %s, Interface Address: %stwork: %s, Mask: %s"
19363904 0x1277840 Neighborly text, "Neighbor List:"
19367031 0x1278477 Neighborly text, "neighbor: "
19401799 0x1280C47 Neighborly text, "NeighborLossn"
19441500 0x128A75C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/external/bsd/tcpdump/bin/../dist/checksum.c
19456112 0x128E070 Neighborly text, "neighbor-type %s, len %u%sx"
19456157 0x128E09D Neighborly text, "neighbor seq 0x%04xed networks (total %u)"
19456372 0x128E174 Neighborly text, "neighbor %s, link-quality %.2lf%%, neighbor-link-quality %.2lf%%%"
19456407 0x128E197 Neighborly text, "neighbor-link-quality %.2lf%%eq 0x%04x, length %u"
19456448 0x128E1C0 Neighborly text, "neighbor"
19456604 0x128E25C Neighborly text, "Neighbored"
19465284 0x1290444 Neighborly text, "Neighbor TLV02d)"
19470132 0x1291734 Neighborly text, "neighborhood, block backup power source"
19474392 0x12927D8 Neighborly text, "neighbor solicitationst listener report v2"
19474424 0x12927F8 Neighborly text, "neighbor advertisementovery request"
19475498 0x1292C2A Neighborly text, "Neighbor Router-ID %se %s"
19475527 0x1292C47 Neighborly text, "Neighbor Interface-ID %s, Interface %sr-ID %s"
19475576 0x1292C78 Neighborly text, "Neighbor Router-ID %se %s"
19475605 0x1292C95 Neighborly text, "Neighbor Interface-ID %s, Interface %s-ID %s"
19475652 0x1292CC4 Neighborly text, "Neighbor Network-ID %sce %s"
19475682 0x1292CE2 Neighborly text, "Neighbor Interface-ID %s, Interface %sr Links Type 0x%02x"
19501208 0x1299098 Neighborly text, "neighbor solicitation%ss"
19501248 0x12990C0 Neighborly text, "neighbor advertisement%s MLD query%s"
19501813 0x12992F5 Neighborly text, "neighbor solicitation%ss"
19501853 0x129931D Neighborly text, "neighbor advertisement%stput MLD query%s"
19503582 0x12999DE Neighborly text, "neighbor solicitation message%sent message%s"
19503626 0x1299A0A Neighborly text, "neighbor advertisement message%s message%s"
19548712 0x12A4A28 XMLExtensible Markup Language document, version: "1.0"
19548880 0x12A4AD0 Base64 standard index table
19549528 0x12A4D58 Base64 standard index table
19551277 0x12A542D Unix path: /www.w3.org/XML/1998/namespace
19551352 0x12A5478 CRC32 polynomial table, little endian
19590004 0x12AEB74 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/curl/lib/ssluse.c
19600460 0x12B144C Base64 standard index table
19610304 0x12B3AC0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/common/heap.c
19614804 0x12B4C54 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/common/tables.c
19622896 0x12B6BF0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/common/parse.c
19629728 0x12B86A0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/common/dns.c
19632688 0x12B9230 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/common/memory.c
19633064 0x12B93A8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/common/execute.c
19636184 0x12B9FD8 Base64 standard index table
19640868 0x12BB224 Base64 standard index table
19642176 0x12BB740 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/isc/dhcp/omapip/auth.c
19728100 0x12D06E4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/protobuf-c/src/google/protobuf-c/protobuf-c.c
19737368 0x12D2B18 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/ssl/d1_srvr.c
19738584 0x12D2FD8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/ssl/ssl_txt.c
19759364 0x12D8104 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/ssl/d1_lib.c
19759584 0x12D81E0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/ssl/d1_enc.c
19764656 0x12D95B0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/ssl/ssl_sess.c
19771433 0x12DB029 eCos RTOS string reference: "ecos"
19776932 0x12DC5A4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/lib/libutil/login_cap.c
19786740 0x12DEBF4 Unix path: /usr/share/misc/terminfo
19789145 0x12DF559 Unix path: /usr/share/tabset/vt100
19790472 0x12DFA88 Unix path: /usr/share/tabset/vt100
19813820 0x12E55BC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/lib/libpthread/pthread_rwlock.c
19815052 0x12E5A8C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/lib/libpthread/pthread.c
19817180 0x12E62DC Unix path: /usr/X11R7/bin/ssh-askpass
19824332 0x12E7ECC OpenSSH RSA1 private key, version "1.1"
19827236 0x12E8A24 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssh/dist/packet.c
19829648 0x12E9390 CRC32 polynomial table, little endian
19841612 0x12EC24C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssh/dist/channels.c
19852312 0x12EEC18 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/x509/x509spki.c
19852624 0x12EED50 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/ts/ts_conf.c
19852880 0x12EEE50 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/ts/ts_verify_ctx.c
19855076 0x12EF6E4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/ts/ts_rsp_utils.c
19855228 0x12EF77C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/srp/srp_vfy.c
19855844 0x12EF9E4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/pqueue/pqueue.c
19857484 0x12F004C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/ocsp/ocsp_srv.c
19858080 0x12F02A0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/ocsp/ocsp_ext.c
19858932 0x12F05F4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/ec/ec_check.c
19859536 0x12F0850 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/comp/comp_lib.c
19860732 0x12F0CFC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/asn_moid.c
19861648 0x12F1090 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/t_crl.c
19862016 0x12F1200 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/t_req.c
19862172 0x12F129C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/i2d_pu.c
19864772 0x12F1CC4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/ts/ts_req_utils.c
19865188 0x12F1E64 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/pkcs12/p12_mutl.c
19866812 0x12F24BC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/engine/eng_cnf.c
19905224 0x12FBAC8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/evp/e_rc5.c
19905760 0x12FBCE0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/evp/e_rc2.c
19910892 0x12FD0EC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/engines/e_ubsec.c
19915848 0x12FE448 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/engines/e_atalla.c
19923920 0x13003D0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/x_pkey.c
19928744 0x13016A8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/pem/pem_pkey.c
19933220 0x1302824 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/modes/gcm128.c
19963328 0x1309DC0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/engines/ccgost/gost_crypt.c
19963700 0x1309F34 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/engines/ccgost/gost2001.c
19975784 0x130CE68 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/f_string.c
19979620 0x130DD64 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/x509v3/v3_crld.c
19981372 0x130E43C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/x509v3/v3_cpols.c
19983620 0x130ED04 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/conf/conf_mod.c
19986640 0x130F8D0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/stack/stack.c
19988224 0x130FF00 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/rsa/rsa_lib.c
19993852 0x13114FC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/evp/evp_key.c
20053344 0x131FD60 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/hmac/hmac.c
20056248 0x13208B8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/evp/bio_enc.c
20056400 0x1320950 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/evp/p_lib.c
20060156 0x13217FC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/ec/ec_print.c
20062992 0x1322310 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/conf/conf_lib.c
20072796 0x132495C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/cms/cms_dd.c
20074812 0x132513C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/a_i2d_fp.c
20075724 0x13254CC Base64 standard index table
20075792 0x1325510 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/bio/bf_buff.c
20081928 0x1326D08 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/tasn_prn.c
20084156 0x13275BC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/t_x509.c
20084684 0x13277CC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/objects/obj_xref.c
20085688 0x1327BB8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/ameth_lib.c
20086056 0x1327D28 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/dh/dh_ameth.c
20086656 0x1327F80 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/cmac/cmac.c
20086964 0x13280B4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/x_long.c
20088032 0x13284E0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/x_name.c
20090056 0x1328CC8 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/x509v3/v3_asid.c
20091544 0x1329298 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/x509v3/v3_addr.c
20094688 0x1329EE0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/a_bool.c
20111012 0x132DEA4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/ec/ecp_nist.c
20117660 0x132F89C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/asn1/tasn_dec.c
20121520 0x13307B0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/cryptlib.c
20122596 0x1330BE4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/x509v3/v3_sxnet.c
20123308 0x1330EAC Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/x509v3/v3_pci.c
20125852 0x133189C Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/rsa/rsa_pk1.c
20128708 0x13323C4 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/crypto/external/bsd/openssl/dist/crypto/conf/conf_def.c
20154560 0x13388C0 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/lib/libedit/tty.c
20164575 0x133AFDF Copyright string: "Copyright 1995-2005 User #71419 "
20164875 0x133B10B Copyright string: "Copyright 1995-2005 Jean-loup Gailly "
20167776 0x133BC60 CRC32 polynomial table, little endian
20171872 0x133CC60 CRC32 polynomial table, big endian
20175968 0x133DC60 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/common/lib/libprop/prop_string.c
20176736 0x133DF60 XMLExtensible Markup Language document, version: "1.0"
20176928 0x133E020 Unix path: /SourceCache/J28/AirPortFW-77300.1/Embedded/External/netbsd6/src/common/lib/libprop/prop_number.c
20178924 0x133E7EC Base64 standard index table
20253952 0x1350D00 SHA256 hash constants, little endian
20261496 0x1352A78 Unix path: /usr/share/nls/nls.alias
20271540 0x13551B4 Base64 standard index table
20338024 0x1365568 Copyright string: "Copyright 1998 Apple Computer, Inc. All rights reserved."
20368568 0x136CCB8 YAFFS filesystem
20372327 0x136DB67 Private key in DERDistinguished Encoding Rules (certificate file format) format (PKCS header length: 4, sequence length: 314
20372645 0x136DCA5 Private key in DERDistinguished Encoding Rules (certificate file format) format (PKCS header length: 4, sequence length: 604
20373253 0x136DF05 Private key in DERDistinguished Encoding Rules (certificate file format) format (PKCS header length: 4, sequence length: 1187
20374444 0x136E3AC Private key in DERDistinguished Encoding Rules (certificate file format) format (PKCS header length: 4, sequence length: 2345
Previous Attempts
Interesting points of
| Offset | Data | Notes |
|---|---|---|
| 0x0000 - 0x003f | unknown, but repetitive data | inital bootstrap code? |
| 0x03E0 | "ZSIB" | Some kind of section header |
| 0x0400 | "FLSH" |
16 bytes of data, followed by what looks like null-terminated strings for NVRAMNon-volatile Random Access Memory variables. Seems data is repeated at offset 0x80000. |
| 0x1400 | "AMZL" | AMZL == LZMA in reverse? |
| 0x8230 | "SHMOO VEPKID" | wtf? |
| 0xB0008 | "C86439500FNF55QAX" |
serial #? repeated later in variable as "mlbserial" |
| 0xB0050 | "141004141004p" 0x700a 0x07d4 | unknown data |
| 0x108164 | gzip compressed data | filename included: "netbsd.j28_release.image.bin", file repeated again at offset 0xF08164 |
| 0xF08164 | gzip compressed data | filename included: "netbsd.j28_release.image.bin" (repeated) |
My attempt at parsing the firmware for the Time Capsule -
| Start Offset | End Offset | Length (bytes) | Interesting Bytes | Notes |
|---|---|---|---|---|
| 0x00000000 | 0x000003DF | 992 | 0xff 0x04 0x00 0xea ... 0x78 0x56 0x34 0x12 | strange/unknown header with several repeating values |
| 0x000003E0 | 0x000003FF | 32 | ZSIB – what is ZSIB | |
| 0x00000400 | 0x000013FF | 4096 | 0xb9 0xb3 0xac 0xb7 at the end of the section | FLSH – I believe this is NVRAM |
| 0x00001400 | 0x0001FFFF | 125,952 | AMZL – I believe this is Broadcom/Apple CFECommon Firmware Environment Bootloader | |
| 0x00020000 | 0x00023FFF | 16,384 | a simple pattern exists for what reason I don't know | |
| 0x00024000 | 0x0004F87F | 178,304 | binary, compressed, and/or encrypted information | |
| 0x0004F880 | 0x0007FFFF | 198,528 | all 0xff – uninitialized flash memory | |
| 0x00080000 | 0x0008026F | 624 | FLSH – an almost complete copy of previous FLSH | |
| 0x00080270 | 0x0009FFFF | 130,448 | all 0xff – uninitialized flash memory | |
| 0x000A0000 | 0x000A7FFF | 32,768 | mlbserial=C86439500FNF55QAX.apple-sn=C86NH3UGF9H5 | NULL terminated strings – transceiver settings |
| 0x000A8000 | 0x000FFFFF | 360,448 | all 0xff – uninitialized flash memory with two exceptions (see above) | |
| 0x00100000 | gzipped NetBSD for Broadcom BCM5301x |
-- that is what I have so far