0

I'm trying to extract the GoPro Hero 9's firmware to tweak some of the parameters. This is my first time doing any sort of reverse engineering but I'm hoping that by finding the filesystem I can update the constant and rebuild the firmware. Unfortunately, I haven't been able to identify the firmware's filesystem correctly. The firmware can be downloaded here: https://bit.ly/35JJlcc or here: https://community.gopro.com/t5/en/Introducing-GoPro-Labs/ta-p/603173 by clicking HERO9 Black at the bottom.

binwalk -e doesn't seem to result in any useful information, very similar to this post. Entropy analysis and browsing the hex dump seems to indicate the firmware isn't encrypted but I haven't been able to find any pointers to the underlying filesystem.

In the extracted binwalk -e files I did notice that it seems to find a romfs file, but I suspect this is a false positive based on the file size? I'm not sure where to go from here, would appreciate any tips to figure out the underlying fs.

kevmo314
  • 101
  • 1
  • Wild guess: ext4? The Eufy Security cams use that filesystem. – jdmc Aug 07 '21 at 22:48
  • 1
    @jdmc I believe you are correct, but I'll have to go back and check my exact notes later on how to extract. This means you'll manually have to mount the ext4 filesystem. Also note that the cameras have a separate RTOS, so you may be seeing that firmware in addition to the Linux filesystem. – multithr3at3d Aug 12 '21 at 12:04
  • 1
    It looks like it is indeed ext4, I managed to figure out the false positives and mount it correctly. binwalk seemed to produce different output on mac than linux. On the other hand, actually tweaking the param I'm looking to tweak doesn't seem to be as easy as I had hoped: it looks like it's hardcoded in to some binaries and not so easy to modify. – kevmo314 Aug 12 '21 at 22:22
  • For use with macOS, I've found that extFS for Mac by Paragon Software works marvelously, and for anyone who needs access to extFS volumes on a regular basis, is well worth its price of US$40. – jdmc Aug 18 '21 at 13:21

0 Answers0