U-Boot Bootloader Firmware Extraction Tools

Поділитися
Вставка
  • Опубліковано 28 лис 2024

КОМЕНТАРІ • 41

  • @0xbitbybit
    @0xbitbybit 6 місяців тому +17

    Keen to see you tackle a more realistic device, say without the full uboot version, a login prompt for UART, encrypted firmware etc. that's what I keep getting lately, or not being able to find a file system at all after desoldering and reading the memory chip 😢

  • @muh1h1
    @muh1h1 6 місяців тому +8

    Thanks for making these videos! I watch them purely for education and entertainment, even though i have no professional relationship with any of this. I really find your videos very interesting to watch and easy to grasp, so please keep them going!!!

    • @mattbrwn
      @mattbrwn  6 місяців тому +4

      This is awesome to hear :)

  • @mytechnotalent
    @mytechnotalent 6 місяців тому +2

    Nice job as always Matt. Really like the firmware tools, awesome automation for this extraction analysis.

  • @TheRealWulfderay
    @TheRealWulfderay 6 місяців тому +1

    Thanks, Matt. Uboot has always seemed a bit mystical to me. Very practical example.

  • @bartzilla333
    @bartzilla333 5 місяців тому +2

    If you run 'bdinfo' that will give you the memory organization of U-Boot. Failures on md/mw on address could be; 1. Memory is mapped to CPU registers, 2 the address does not exist, or 3 U-boot could be running out of that memory rang. There could be a lot of things to cause failure.

    • @mattbrwn
      @mattbrwn  5 місяців тому +2

      Yeah that makes sense. I was just writing over random blocks of memory :D

  • @OsamaAltobuli
    @OsamaAltobuli Місяць тому +1

    Great video ! Thanks for all these useful details and tools.
    I’m dealing with similar reset issue on a device I’m trying to recover, can you share how did you identified the block of memory you write without resetting the device?

  • @Spozinbro
    @Spozinbro 6 місяців тому +1

    Love your stuff! This is super useful for what I'm trying to do right now with my router, keep up the awesome work!

  • @XYZ56771
    @XYZ56771 6 місяців тому +3

    Thank you for the content, great insights, as always!

  • @feff6754
    @feff6754 6 місяців тому +3

    Lots of really good info here, thanks!

  • @alecsei393ify
    @alecsei393ify 6 місяців тому +4

    Thank you , the content is awesome, good information!!

  • @zachkost-smith6923
    @zachkost-smith6923 6 місяців тому +3

    Surprised to see that your parse uboot dump wasn't just wrapping a call to 'xxd -r'

    • @mattbrwn
      @mattbrwn  6 місяців тому +2

      why use bash when python do trick? ;)

  • @tritnaha1345
    @tritnaha1345 3 місяці тому +1

    You should give any Avaya J-series phone a try, they offer a pretty fun challenge

  • @kixxthemanz437
    @kixxthemanz437 6 місяців тому +1

    Matt make a video on extracting the files on locked down phones like Samsung, extracting the files that tell the device can use ADB or that tell the device if the OEM is on or not so we can extract them and change the values then push them back to the device to gain root access

  • @kaderdz4564
    @kaderdz4564 5 місяців тому

    am i only person get entertained by watching your content 🤠 ❤
    GOOD 👍 JOB 👌 BRO

  • @tomwimmenhove4652
    @tomwimmenhove4652 6 місяців тому +1

    Don't you think the reset is simply caused by you overwriting code in memory that is currently being executed? Maybe the bootloader code itself, or interrupt vectors?

    • @mattbrwn
      @mattbrwn  6 місяців тому +1

      that's a good point. that could totally be it.

  • @charlesdorval394
    @charlesdorval394 4 місяці тому

    Wow! That was sooooooooooooooo interesting! Thanks!
    I wish I had some device to mess around with now lol

  • @sonysav3813
    @sonysav3813 6 місяців тому +2

    Nice job Matt 👍

  • @njmust
    @njmust Місяць тому +1

    From Unlock boot loader do anyone by any os system like putty in window u using ubuntu and using picocom. But when the boot is lock now you do this is the thing..

  • @sp33dracerx2
    @sp33dracerx2 6 місяців тому +3

    Good stuff

  • @timmturner
    @timmturner 6 місяців тому

    What's the sensitive nature of the device? I don't understand why you would not want the viewers to know what it is?

  • @EricMarsi
    @EricMarsi 6 місяців тому

    Awesome work dude!

  • @saad1983
    @saad1983 6 місяців тому

    awesome tool. i will be putting it to work and def makes life a whole lot easier to just be able to fetch the actual files rather than MD. Can you elaborate on any write methods which can help write files or strings back to a location on an ext4fs via uboot.

    • @mattbrwn
      @mattbrwn  6 місяців тому +2

      yeah I'm going to work on adding a tool that will do that. You do it the opposite way of reading.
      First write data to memory with the "mw" command. Second write file to filesystem with the "ext4write".

    • @saad1983
      @saad1983 6 місяців тому +1

      @@mattbrwn will def give it a shot. thank you.

  • @wtftolate3782
    @wtftolate3782 6 місяців тому

    Can you do this to cell phones?

  • @robertsimon6911
    @robertsimon6911 6 місяців тому

    I have a Device, that boots it's normal OS after 30-60 seconds in u-boot command-prompt. Any chance to interrupt this autoboot?

    • @mattbrwn
      @mattbrwn  6 місяців тому +2

      Can you interact with the uboot menu during that time? Come join us in discord for help with stuff like this 😁

    • @pinpinpoola
      @pinpinpoola 6 місяців тому +1

      @@mattbrwnso good to see you back on here Matt. I really enjoy your content and was worried when you stopped posting a year or so ago. Hope all is well. I am now catching up with the last few weeks content.

    • @DJStompZone
      @DJStompZone 6 місяців тому +1

      bootretry is an environment variable containing the current delay in effect. Negative values mean boot retry will not occur. Unfortunately, *this value is only sampled on startup* - changing it will *not* prevent boot retry in the current session.
      If your build supports saving environment variables persistently:
      u-boot> setenv bootretry -1
      u-boot> saveenv
      Otherwise you would have to modify the source and rebuild. If you wanted to get rid of that behavior entirely you could do something like
      `grep -r CONFIG_BOOT_RETRY *`, remove those lines, rebuild, and reflash.
      Definitely make sure you have a backup means of booting or flashing before overwriting the existing U-Boot, just in case

  • @xenoxaos1
    @xenoxaos1 6 місяців тому

    10:35 probably memory mapped io or memory that's being used by the bootloader.

  • @Hobypyrocom
    @Hobypyrocom 6 місяців тому +2

    if i have a firmware extracted from a device (example wifi camera), is there any way to modify the firmware? can you make such video?

    • @mattbrwn
      @mattbrwn  6 місяців тому +2

      It depends on a lot of factors: what is the flash layout? what is the actual underlying system? what modifications do you want to make? Join us on discord (invite in description) and some of the community might be able to help you learn :)

    • @Hobypyrocom
      @Hobypyrocom 6 місяців тому +1

      @@mattbrwn sadly i am not that far in, i just found the UART pins and managed to execute some useless commands, noticed that its a U-boot. just wanted to know if extracting the firmware is worth the effort for future modifications of the functionalities. for example i have many old wifi Chinese cameras, but they turned down the servers and now you cant connect the cameras, so i wanted to connect LAN module instead of the WiFi module that they use and that way make them work again, but i will probably have to change some settings for the camera to use the LAN connection instead the WiFi.
      thank you for the replay, i will definitely check and join the discord.

  • @MarshallLevin
    @MarshallLevin 6 місяців тому +1

    Ugh, that thumbnail font. FIAWAAE EHTAACTION?

  • @brighttech8922
    @brighttech8922 6 місяців тому

    Hack the Facebook portal plus 15.6 please