const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/FIRMWARE" date="2026-08-03" title="What kind of blob is this firmware" lede="uImage, TRX, Android boot.img, raw NAND dump, vendor ZIP. If you guess the container wrong, every extractor after that is fan fiction."/>
<P>The first firmware question is not “where is the 0-day.” It is “what file did they actually send.” A 32 MB <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>update.bin</span> is a container until proven otherwise. Opening it in Ghidra as raw ARM is how you reverse the gzip header for an afternoon.</P>
<Callout>Copy, hash, then identify. Do not flash. Do not rename the file to .elf because hope is not a magic number.</Callout>
<H2>Magic numbers we actually see</H2>
<H3>uImage / FIT</H3>
<P>U-Boot wrappers. 64-byte legacy header, or a Flattened Image Tree. <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>mkimage -l</span> and <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>dumpimage</span> beat carving. Inside: kernel, maybe dtb, maybe ramdisk. The rootfs is often a later partition, not this file.</P>
<H3>TRX / vendor router blobs</H3>
<P>Broadcom-era and friends. Header, then LZMA, then squashfs. binwalk will light up three times. Believe the filesystem offset, not every gzip it found in entropy noise.</P>
<H3>Android boot.img / sparse</H3>
<P>If the “firmware” is a phone OTA or a <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>boot.img</span>, this is not a router unpack. Magisk-era tools, simg2img, payload.bin. Different desk. Mixing apktool into a gateway image is the same class of error in reverse.</P>
<H3>Raw flash / NAND dump</H3>
<P>No header. OOB data if they dumped via NAND protocol. Need page size, erase block, whether they included spare. unblob helps; a hex dump of the first 0x200 bytes helps more. If you see JFFS2 nodes or UBI “UBI#”, stop carving and use the filesystem tool.</P>
<H3>ZIP / tar that pretends to be firmware</H3>
<P>Vendor “upgrade package” that is just a signed or unsigned archive of images. Unzip first. Then recurse. The interesting image is rarely the outer name.</P>
<H2>A boring identify pass</H2>
<Code lang="sh">{`file firmware.bin
xxd firmware.bin | sed -n '1,12p'
binwalk firmware.bin
# then one of:
mkimage -l firmware.bin
unsquashfs -s firmware.bin
ubireader_display_info firmware.bin`}</Code>
<P>If three tools disagree, write the disagreement. Do not pick the answer that makes a prettier tree.</P>
<H2>Combination</H2>
<Ul items={[
'Identify the outer container.',
'Extract once, into a dated directory, hashed.',
'Identify each inner image the same way — do not assume they are all squashfs.',
'Only then pick a binary. See the unpack note.'
]}/>
<Related items={[
['post-firmware.html','Unpacking firmware without becoming the dump']
]}/>
</>;
}
window.Article=Article;
mountPost();