A moderated community dedicated to all things reverse engineering.STICKIED THREADS.(or, 'why are there all of these papers about theoretical computer science and mathematics?' )QUESTIONS POLICYIf you have a question about how to use a reverse engineering tool, or what types of tools might be applicable to your project, or your question is specific to some particular target, ask it on the. Apart from that, self-posts severely degraded the quality of this subreddit when they were enabled, so they have been disabled in favor of a biweekly questions thread which is posted automatically by a robot (the latest of which is in the list of stickied threads above).SUBMISSION, COMMENTING, AND VOTINGWhen feasible, post direct links to content.

• Audio By Harman Software

Blogs and websites that re-host or merely link to content that was originally available on another site, and remains available on its original site, are not allowed. Domains that do not produce original content of their own and only exist to re-host content will be banned on the grounds of being spam.If it's a non-HTML link (e.g., a PDF), please tag it (e.g., put PDF at the end of the title). Similarly for videos, please tag them with VIDEO. Don't post it if it's irrelevant or has no content: we have technical standards and might remove these posts.Please vote for no reason other than quality of content. When commenting, please discuss content and not presentation. This is a technical community, so pointing out technical flaws is certainly within the realm of discourse, but please try not to be an asshole when you do.

Imagine yourself speaking your comment in a public place to the person's face when you write it. It would be tragic if needlessly negative commentary discouraged participation in the already-microscopic world of reverse engineering.

If the point of your comment is to put down someone else so as to demonstrate your superiority, please delete it without posting it, and then make an appointment with a psychotherapist regarding your inferiority complex.The legality of reverse engineering is a miasmic subject compounded by differing laws in differing jurisdictions. For basic legal information (not 'legal advice') surrounding reverse engineering in the United States, see the on the subject.

None of the moderators are trained lawyers, so please use your best discretion when submitting, and we shall do the same while moderating. Subjects such as stolen source code and pirated software are never acceptable and will always be removed.

Please instead post these links to (not affiliated with or endorsed by the moderators of ).RELATED RESOURCES. sister subreddit for non-technical submissions and discussion. sister subreddit for mathematics related to program analysis. ##re on FreeNode IRC. I'm trying to extract firmware for the Harman Kardon AVR 1700, with the eventual goal of modifying it but mostly just for fun.

(This is a networked receiver and it has a remote app that can be used to control the device. Unfortunately, it's horribly unreliable, and I'd much prefer to get shell access to the device and write some basic software to be able to control it remotely from my computer.)There's a firmware update available (EU version is numbered 170 but otherwise identical), which I installed recently.

This is a fairly small file (3MB unpacked), so I'm not sure whether it contains the full firmware or I'm just not used to the small size of embedded OS's. A file system? Not where we're going!Browsing around using, looks like the image contains:.

Audio By Harman Software

0x000000 6kB bootloader. 0x010000 62kB main image. 0x100000 small mystery data section. 0x110000 large mystery data section. 0x200000 another small data section - looks kind of like image data?Opening the thing up and taking some nice photos of PCBs + chip part numbers will result in datasheets for whatever microprocessor + storage are on the device, and make reversing much easier. You could identify some things with just an image (bootloader has status print function at 0x63D4, main image printf at 0x56944) but why do it the time consuming way:).

Thanks for the suggestions! Hadn't run into bz before, looks useful. I'm obviously a bit out of my depth here. Would you mind explaining why knowing the microprocessor/storage would make it easier to identify/extract whatever is in the mystery data sections?

As in, why would they affect the format?Also, how did you identify 0x63D4 and 0x56944 as print functions? Looking at 0x63D4 I certainly agree it looks like a little loop to copy a null-terminated string off somewhere. 0x56944 appears to deal with varargs but is too short to actually do any printing (looks like it just increments the stack pointer by 12 bytes).Thanks for the help!. Part numbers to identify what exactly all the memory mapped peripheral stuff is; those are your libraries and syscalls. General component layout, too, to figure out what external components it's talking to via those libraries/syscalls. If you want to do fun stuff to the device beyond editing strings/pictures, you'll need 'em.On closer look it looks like covers everything needed for the STM32 F4 line. Seems to at least partially match the firmware, so I guess the part number isn't too important.

3MB is a bit much for internal storage on an STM32, some of the firmware upgrade image probably gets written to something external. Hm, find comms interface used to do so, walk up to read/write code, then get lost in whatever the image/audio routines are? At a glance, code doesn't seem to be using the SPI registers, but is doing some bitbanging with unrolled nop-loops around 0x805674A. Ehh, this looks time consuming, fully reversing the boot process (especially communication with external stuff) may be a better first step. I wonder if there's a static standard library for this part's peripherals?The print functions were purely due to string arguments.

Huh - that printf is a bit weird. Implementation #ifdef'd out, but arguments got left in?. Does the demo work if you blindly throw the firmware in an ELF via something like the below command? Objcopy -B arm -I binary -O elf32-littlearm -adjust-vma $((0x08000000)) -strip-all -rename-section.data=.text,contents,alloc,load,readonly,code 'AVR170USB(V0305A).fw' AVR170.elfIf you get processor options when loading it in the IDA demo, choose cortex-m.The first 32bit value (at 0x08000000) is the initial SP, followed by a whole heap of 32bit exception vectors, the last being at +0x180. If you follow the reset exception (@0x08000004 - value of 0x0800d0c9) and turn it into code (press c on 0x0800d0c8 - LSBit is set in the exception vector table because it's thumb code.) it should give you a starting point.From a very brief look, that code is just for the USB-firmware-upgrade stuff, and it later loads an exception vector table/etc for the main app from 0x08010000 (so you want to do similar with that table). I noticed the padding to 3MB too. Based on extrwi's post above noting the STM32 string, I figured it was likely a, although nothing in that series of chips has higher than 2MB flash or 256kB RAM.Any thoughts on where this thing might be hiding a filesystem?

It has a web interface (running GoAhead web server), but I can't find any trace of the associated files in the firmware (at least, nothing that shows up in strings, and as I mentioned in OP binwalk finds no signatures for compressed files either).

Product Information. The Harman Kardon AVR 1700 5.1 Channel 95 Watt Receiver is an HDMI 1.4a audio return, 3D video, deep color home audio receiver that has a clean design and reliable, high-quality audio processing. The Harman Kardon AVR 1700 receiver features DTS-MA and Dolby TrueHD decoding as well as standard Dolby and DTS modes. Harman has included several connectivity options that make installation easy. The AVR 1700 has five-way binding post speaker connections to make hooking speakers up easy. There is also a two-prong detachable IEC power cord, which allows installers to position the receiver from the front of a cabinet or rack then attach the power cable from behind without the process of feeding the heavier cable from the case front.

The Harman Kardon AVR 1700 has a single USB port on the front panel so that the user can connect digital devices such as MP3 players, Windows media devices, or other USB systems, such as a USB jump drive with audio files on it. The AVR is rated at 100 watts per channel, but this rating is for two channels. The Harman Kardon AVR 1700 can drive two speakers at 100 watts each.

On the connectivity side, the device has 6 HDMI in/out ports on the rear panel. This facilitates the connection of devices, such as Blu-ray disc players, high-definition audio components, and televisions with HDMI inputs.

The rear panel also houses one coaxial and two optical digital audio connection ports. Analog audio duties are handled by 2 stereo inputs and one stereo output plugs on the rear panel and one stereo input on the front. The rear also has two analog video inputs and one analog video out. Computer connectivity is made both easy and powerful by the addition of a single RJ-45 Ethernet network port on the rear.

The goat in the chili patch story book. This allows the home theater a/v power to be used to play music from sources, such as Apple iTunes, Google Play, or YouTube. The Harman Kardon AVR 1700 can also search and play audio from Internet radio stations through the included vTuner app software protocol.

The AVR 1700 receivers can also stream audio using airplay. When connected to a network, the AVR 1700 also supports DLNA 1.5 Internet radio. The sleek, black front panel has a large LED display, a weighted full-size volume knob, a power button, selector buttons for source, tuning, station presets, memory settings. The volume knob is illuminated with a blue ring light. A slight inset on the bottom right houses the USB port, as well as a video input, and left / right RCA audio input jacks.

Just to the left of the a/v inputs is the 1/4-inch phone jack for plugging in headphones. In addition to the front panel controls, the AVR 1700 includes a programmable, universal wireless remote control. The Harman Kardon AVR 1700 5.1 Channel 95 Watt Receiver is capable of delivering up to 100 watts to two speakers, and the device includes a selection of built-in software and protocols to make streaming Internet audio easy. The five-way binding post speaker connections and detachable power cord simplify installation, and the sleek front panel includes connectivity for USB devices as well as audio and video so that quick connections can be made without moving the unit.