/FIRMWARE · 2026-08-03
What kind of blob is this firmware
uImage, TRX, Android boot.img, raw NAND dump, vendor ZIP. If you guess the container wrong, every extractor after that is fan fiction.
The first firmware question is what file they actually sent. A 32 MB update.bin is a container until proven otherwise. Opening it in Ghidra as raw ARM is how you reverse the gzip header for an afternoon.
Copy, hash, then identify. Do not flash. Do not rename the file to .elf because hope is not a magic number.
Magic numbers we actually see
uImage / FIT
U-Boot wrappers. 64-byte legacy header, or a Flattened Image Tree. mkimage -l and dumpimage beat carving. Inside: kernel, maybe dtb, maybe ramdisk. The rootfs is often a later partition, not this file.
TRX / vendor router blobs
Broadcom-era and friends. Header, then LZMA, then squashfs. binwalk will light up three times. Believe the filesystem offset, not every gzip it found in entropy noise.
Android boot.img / sparse
If the “firmware” is a phone OTA or a boot.img, this is not a router unpack. Magisk-era tools, simg2img, payload.bin. Different desk. Mixing apktool into a gateway image is the same class of error in reverse.
Raw flash / NAND dump
No header. OOB data if they dumped via NAND protocol. Need page size, erase block, whether they included spare. unblob helps; a hex dump of the first 0x200 bytes helps more. If you see JFFS2 nodes or UBI “UBI#”, stop carving and use the filesystem tool.
ZIP / tar that pretends to be firmware
Vendor “upgrade package” that is just a signed or unsigned archive of images. Unzip first. Then recurse. The interesting image is rarely the outer name.
A boring identify pass
file firmware.bin
xxd firmware.bin | sed -n '1,12p'
binwalk firmware.bin
# then one of:
mkimage -l firmware.bin
unsquashfs -s firmware.bin
ubireader_display_info firmware.bin
If three tools disagree, write the disagreement. Do not pick the answer that makes a prettier tree.
Combination
- Identify the outer container.
- Extract once, into a dated directory, hashed.
- Identify each inner image the same way — do not assume they are all squashfs.
- Only then pick a binary. See the unpack note.