Thursday, June 18, 2015

Broken, Abandoned, and Forgotten Code, Part 8

›
In the previous few posts , we spent time reversing how the Netgear R6200's HTTP daemon parses a firmware header before writing the fi...
Monday, June 08, 2015

Broken, Abandoned, and Forgotten Code, Intermission

›
We're about halfway through the Broken, Abandoned series, so this is a good time to pause for a minute and take stock. At this point, t...
Thursday, June 04, 2015

Broken, Abandoned, and Forgotten Code, Part 7

›
In the previous post , I finished discussing the abCheckBoardID() function. I called attention to a checksum in the header generated by an ...
Thursday, May 28, 2015

Broken, Abandoned, and Forgotten Code, Part 6

›
Note:   It is assumed that the reader is debugging the processes described in this and the next several posts using emulation and IDA Pro. T...
Thursday, May 21, 2015

Broken, Abandoned, and Forgotten Code, Part 5

›
In previous installments I shared proof-of-concept code that would exercise the Netgear R6200's hidden (and badly broken) SetFirmware...
Thursday, May 14, 2015

Broken, Abandoned, and Forgotten Code, Part 4

›
In the last post , I described how upnpd 's sa_parseRcvCmd() function finds the body of a SOAP request and how it parses that SOAP requ...
Thursday, May 07, 2015

Broken, Abandoned, and Forgotten Code, Part 3

›
In the previous posts , I talked about the hidden "SetFirmware" SOAP action in the Netgear R6200's UPnP daemon, and the weird...
Thursday, April 30, 2015

Broken, Abandoned, and Forgotten Code, Part 2

›
In the part 1 , I showed how the Netgear R6200's upnpd binary contains what appears to be a hidden SOAP action related to the string ...