A detailed walkthrough of reverse engineering the firmware encryption used in Yaesu FT-70D ham radios. The author extracts encrypted firmware from a Windows update utility, uses IDA Pro and WinDbg's Time Travel Debugging to analyze the decryption algorithm, and discovers a multi-stage process involving timestamp-based key derivation, bit inflation, and XOR operations with static lookup tables. The article concludes with loading the decrypted firmware into IDA Pro for further analysis and provides a Rust implementation of the decryption utility.
Table of contents
# Background# Other Avenues# Reverse Engineering the Binary# Encryption Details# Loading the Firmware in IDA ProSort: