Security researchers have documented the process of extracting and analyzing the firmware of the Eufy HomeBase 2, a central hub in Eufy's smart home ecosystem. Because the device's flash memory is soldered directly to the circuit board without exposed pins for data dumping, the researchers had to physically remove the Winbond 25Q256JWEQ chip. Initial attempts to read the chip while it was still on the board failed because the power supplied for the read operation activated other components that interfered with the memory. To successfully dump the firmware, the chip had to be desoldered and read off-board using a Raspberry Pi's SPI0 interface.
The image illustrates the physical hardware modification required to extract the firmware from the Eufy HomeBase 2.
This visual demonstrates the off-board reading method used after the chip was removed from the device.
While the extraction was successful, the process resulted in a 64KB block of data being erased or rendered unreadable due to physical damage during the desoldering process. Despite this, the researchers were able to use Binwalk to identify and extract various components, including a Linux Kernel Image and a JFFS2 filesystem. They utilized a combination of tools, including 7-Zip to handle multiple XZ-compressed data streams, to carve out files from the firmware blob. This allowed them to access internal scripts and binaries that govern the device's behavior.
The image explains the complexity of the compressed data streams that required multiple tools to unpack.
One primary focus of the analysis was the algorithm used to generate credentials for the 'OCEAN_XXXXXX' management Wi-Fi network. By examining the extracted firmware, the researchers identified scripts that concatenate the 'OCEAN_' prefix with the device's MAC address to create the SSID. They also discovered that the Wi-Fi password is retrieved from a specific NVRAM variable (WPAPSK1). To further investigate the logic, the researchers used a custom Python script to carve out a 32-bit MIPS executable from the firmware blob, which contained symbols related to Wi-Fi password setting and management. This analysis helps clarify how the device handles local network authentication and whether the generation methods remain weak or have been updated in recent versions.