I'm trying to learn firmware analysis. The device I chosen was my Motorola SBG901 modem. I managed to dump the memory contents via JTAG using the FlashcatUSB adapter. The memory dump is about 8MB in size. Now this is where I am lost I'm trying to analyze the dump. But I don't know where to start. I have used binwalk on it which I believe brought back false positives as the output was as follow:DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------67434         0x1076A         Certificate in DER format (x509 v3), header length: 4, sequence length: 80368243         0x10A93         Certificate in DER format (x509 v3), header length: 4, sequence length: 102470361         0x112D9         Certificate in DER format (x509 v3), header length: 4, sequence length: 80871175         0x11607         Certificate in DER format (x509 v3), header length: 4, sequence length: 98881036         0x13C8C         Certificate in DER format (x509 v3), header length: 4, sequence length: 86681908         0x13FF4         Certificate in DER format (x509 v3), header length: 4, sequence length: 98382897         0x143D1         Certificate in DER format (x509 v3), header length: 4, sequence length: 86489278         0x15CBE         Certificate in DER format (x509 v3), header length: 4, sequence length: 80390087         0x15FE7         Certificate in DER format (x509 v3), header length: 4, sequence length: 102492205         0x1682D         Certificate in DER format (x509 v3), header length: 4, sequence length: 80893019         0x16B5B         Certificate in DER format (x509 v3), header length: 4, sequence length: 988102880        0x191E0         Certificate in DER format (x509 v3), header length: 4, sequence length: 866103752        0x19548         Certificate in DER format (x509 v3), header length: 4, sequence length: 983104741        0x19925         Certificate in DER format (x509 v3), header length: 4, sequence length: 864111122        0x1B212         Certificate in DER format (x509 v3), header length: 4, sequence length: 803111931        0x1B53B         Certificate in DER format (x509 v3), header length: 4, sequence length: 1024114049        0x1BD81         Certificate in DER format (x509 v3), header length: 4, sequence length: 808114863        0x1C0AF         Certificate in DER format (x509 v3), header length: 4, sequence length: 988124724        0x1E734         Certificate in DER format (x509 v3), header length: 4, sequence length: 866125596        0x1EA9C         Certificate in DER format (x509 v3), header length: 4, sequence length: 983126585        0x1EE79         Certificate in DER format (x509 v3), header length: 4, sequence length: 864I believe binwalk gave false postive output as the dump probably isn't a packed image. I say this because I also ran strings on the dump and received a lot of readable strings a snippet is shown below:I'm tryring to extract the firmware so I can use QEMU and try to do some vulnerability findings. I'm doing this for knowledge sake but I am inexperience with reading dump files. Can someone point me in the direction that would teach me how to decipher the memory dump and eventually extract the firmware. I really want to learn how to read the dump because I plan to analyze other firmwares hence I want to learn the essentials. For instance I know that there are firmwares that are packed/unpacked and/or encrypted/unencrypted. They usually consist of bootloaders, OS, filesystem, libraries, and apps (such as webserver). Can some point me in the direction of some useful resource that will teach me how to read dump and determine how to get the firmware out with all right files (filesystem, bootloader, apps, etc...)?Thanks in advance
Memory dump analysis
binary analysis;firmware;memory dump
I believe binwalk gave false postive outputIt is likely the output is not false positive. You can see the strings used in certificates.For instance I know that there are firmwares that are packed/unpacked and/or encrypted/unencryptedThis is the direction you would want to check. Binwalk has an entropy analysis option, and it can display a graph of it. Encrypted or packed files will have high and uniform entropy.I'm tryring to extract the firmware so I can use QEMU and try to do some vulnerability findings. While the CPU architecture might be well-known, device like this will likely have a custom SoC with little to none available documentation. I don't think you will be to do a complete emulation of the device, so static analysis can be a preferred option.Can someone point me in the directionIf you really have JTAG access, you can try dumping RAM, since it may contain unpacked/decrypted code. However, I suspect this is in fact a dump of SPI flash chip. Actual JTAG access may have been disabled by manufacturer.