Advanced firmware analysis techniques using Binwalk, Firmwalker, and manual inspection for hardware security
Now that we've successfully dumped the .bin file from the SPI flash chip, the next step is to analyze it. This process helps uncover the contents of the firmware like file systems, configuration files, scripts, and potentially sensitive data.
Before doing any advanced analysis, we identify what type of file we're dealing with using the file command:
file TL-WR840N.bin
This gives us a basic classification whether it's just data, a compressed archive, or contains a known file system like SquashFS. We'll need deeper inspection to understand its structure.
Sometimes firmware contains plain-text strings (e.g., usernames, URLs, or paths). To extract them:
strings TL-WR840N.bin | less
Extracts readable content embedded in binary, including references to system files and configurations.
BusyBox (lightweight Linux utility), default IP addresses like 192.168.0.1, filesystem paths like /etc/config or /bin/sh.
Next, we use Binwalk, a powerful tool to locate and extract embedded filesystems from binary blobs.
sudo apt install binwalk
binwalk TL-WR840N.bin
This creates a directory like _TL-WR840N.bin.extracted/ containing the extracted filesystem. You can explore it using normal commands.
To extract these embedded filesystems automatically:
binwalk -e TL-WR840N.bin
This creates a directory containing the extracted filesystem. You can explore it using normal commands.
Once extracted, you can:
Look inside configuration files like /etc/passwd or /etc/shadow.
Look for scripts in directories like /bin/ or /sbin/.
If you want a quick automated overview, use Firmwalker, a script that scans extracted firmware directories for interesting files like:
Scans for passwords, SSH keys, URLs, and configuration files.
Identifies potential vulnerabilities and security-related configurations.
git clone https://github.com/craigz28/firmwalker.git
./firmwalker.sh ../_TL-WR840N.bin.extracted/squashfs-root
This outputs a categorized list of findings, like:
Passwords found in configWeb server scriptsShell commands and busybox usageNetwork configurationFile system analysis
In this final post, we explored how to dig into a raw firmware dump using both manual and automated tools. With tools like strings binwalkand firmwalkeryou now know how to:
Extract and explore embedded Linux filesystems from binary blobs.
Find sensitive data, configuration files, and security-related content.
Contact us for advanced hardware security assessments and SPI firmware analysis services.
GET ASSESSMENT