Reverse Engineering: Uncovering Hidden Threats Through Hopper

Introduction Firmware analysis is a critical step in identifying vulnerabilities and potential backdoors embedded within IoT devices, routers, and other embedded systems. Often, firmware is encrypted or obfuscated to deter tampering, but once decrypted, it reveals binaries that control device behavior. In this article, we’ll walk through a real-world example of reverse engineering a suspicious binary (appmgr) extracted from decrypted firmware, using tools like Hopper Disassembler to uncover a hidden telnet backdoor.

Step 1: Initial Analysis with the strings Command Before diving into complex disassembly, start with a preliminary analysis using the strings command. This tool extracts human-readable text from binaries, often revealing hardcoded URLs, IP addresses, or commands that hint at malicious behavior.

For our target binary appmgr, we ran:

strings appmgr > strings.txt

Note: The encrypted file can be find here DWR and the steps required to crack the password for extracting its contents are mentioned in this article.

Scrolling through strings.tx

t, we focused on high-risk keywords like telnet, ssh, shell, and HELODBG—common indicators of backdoor functionality. The presence of telnetd -l /bin/sh stood out, suggesting the binary might spawn a telnet shell under specific conditions.

Step 2: Deep Dive with Hopper Disassembler Hopper Disassembler is a powerful reverse-engineering tool for macOS and Linux that converts machine code into readable assembly and pseudo-code. After loading appmgr into Hopper, we took the following steps:

1. Search for Suspicious Strings: Using Hopper’s search function (⌘ + F), we looked for the string telnet. This led us to a code block containing the command telnetd -l /bin/sh, which starts a telnet server with a shell prompt.

2. Trace Cross-References: Pressing X on the string revealed cross-references (XREFs) to functions invoking this command. This showed how and when the telnet server was triggered.

3. Convert to Pseudo-Code: Assembly can be dense, so we switched to Hopper’s pseudo-code mode (click the magic wand icon). The decompiled pseudo code highlighted a logical flow:

This indicated the binary checks for an input string HELODBG to activate the telnet backdoor.

Step 3: Identifying the Backdoor The pseudo-code revealed a critical vulnerability: sending the command HELODBG to the device triggers an unauthenticated telnet shell. This backdoor could allow attackers to:

• Gain root access to the device.
• Install malware or exfiltrate data.
• Pivot to other networked devices.

Further analysis showed the binary lacked authentication checks, meaning any user or remote attacker could exploit this.

Why This Matters Telnet is an insecure protocol (traffic is unencrypted), but its presence in firmware is especially alarming when paired with hidden activation commands. Such backdoors are often planted by malicious actors or inadvertently introduced via compromised development tools.

Mitigation Strategies

1. Patch the Firmware: Remove or disable the vulnerable binary.
2. Network Hardening: Block telnet/SSH ports at the firewall.
3. Monitoring: Log unexpected shell activations or HELODBG commands.
4. Vendor Disclosure: Report findings to the device manufacturer.

Conclusion Decrypting and reverse-engineering firmware is essential for uncovering hidden threats. In this case, a 30-minute analysis with Hopper Disassembler exposed a severe backdoor. Security researchers and developers must prioritize firmware audits to prevent such vulnerabilities from reaching production devices.

Tools Used

• strings for initial triage.
• Hopper Disassembler for static analysis.

Further Reading

• OWASP Firmware Security Guide
• Hopper Disassembler Documentation

By combining automated tools with manual analysis, even deeply embedded threats can be brought to light — and neutralized.

About the Author Horrow is a cybersecurity researcher specializing in IoT and embedded systems security. Follow for more insights into firmware analysis and vulnerability discovery.

Like this article? Share it with your network or leave a comment below!