下载固件的链接。
我从带有Flashrom的EEPROM Spansion FL128SAIF00中转储了固件映像,并通过SPI在系统中提取了buspirate。 Binwalk显示以下内容:
kartone@kartone-VirtualBox:~/project$ binwalk -eM newdump.bin
DECIMAL HEXADECIMAL DESCRIPTION
----------------------------------------------------------------------- ---------
65536 0x10000 Broadcom 96345 firmware header, header size: 256, firmware version: "68", board id: "63168_FW_TW", ~CRC32 header checksum: 0x1FD327FA, ~CRC32 data checksum: 0xD3CB1AD5
1114112 0x110000 Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 7078804 bytes, 3030 inodes, blocksize: 65536 bytes, created: 2016-03-18 09:53:17
12189696 0xBA0000 Broadcom 96345 firmware header, header size: 256, firmware version: "68", board id: "63168_FW_TW", ~CRC32 header checksum: 0x968C91F8, ~CRC32 data checksum: 0x9965CD
13172736 0xC90000 Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 2847848 bytes, 1171 inodes, blocksize: 65536 bytes, created: 2013-12-04 12:31:36
因此提取显示:
kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ ll -R
.:
total 9,5M
drwxr-xr-x 3 kartone kartone 4,0K dic 12 22:03 .
drwxr-xr-x 3 kartone kartone 4,0K dic 12 22:21 ..
-rw-r--r-- 1 kartone kartone 6,8M dic 12 22:03 110000.squashfs
-rw-r--r-- 1 kartone kartone 2,8M dic 12 22:03 C90000.squashfs
drwxr-xr-x 2 kartone kartone 4,0K dic 12 22:03 squashfs-root
./squashfs-root:
total 8,0K
drwxr-xr-x 2 kartone kartone 4,0K dic 12 22:03 .
drwxr-xr-x 3 kartone kartone 4,0K dic 12 22:03 ..
Binwalk无法提取那些两个squashfs文件系统:
kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ binwalk 110000.squashfs
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 7078804 bytes, 3030 inodes, blocksize: 65536 bytes, created: 2016-03-18 09:53:17
kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ binwalk C90000.squashfs
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 2847848 bytes, 1171 inodes, blocksize: 65536 bytes, created: 2013-12-04 12:31:36
所以我尝试使用这些实用程序进行提取(从证据11000.squashfs报告,但与第二个文件C90000.squashfs的结果相同):
kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ unsquashfs -v; unsquashfs 110000.squashfs
unsquashfs version 4.3 (2014/05/12)
copyright (C) 2014 Phillip Lougher <phillip@squashfs.org.uk>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
Parallel unsquashfs: Using 2 processors
lzma uncompress failed with error code 9
read_block: failed to read block @0x6bea07
read_fragment_table: failed to read fragment table index
FATAL ERROR:failed to read fragment table
kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ sasquatch -v; sasquatch 110000.squashfs
unsquashfs version 4.3 (2014/05/12)
copyright (C) 2014 Phillip Lougher <phillip@squashfs.org.uk>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
SquashFS version [4.0] / inode count [3030] suggests a SquashFS image of the same endianess
Non-standard SquashFS Magic: shsq
Parallel unsquashfs: Using 1 processor
Trying to decompress using default gzip decompressor...
Trying to decompress with lzma...
Trying to decompress with lzma-adaptive...
Trying to decompress with lzma-alt...
Trying to decompress with lzma-ddwrt...
Trying to decompress with lzo...
Trying to decompress with xz...
read_block: failed to read block @0x6bea07
read_fragment_table: failed to read fragment table index
FATAL ERROR:failed to read fragment table
使用固件-mod-kit提取脚本的结果非常相似:
kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ sudo /opt/firmware-mod-kit/unsquashfs_all.sh 110000.squashfs
Attempting to extract SquashFS 4.X file system...
Skipping squashfs-2.1-r2 (wrong version)...
Skipping squashfs-3.0 (wrong version)...
Skipping squashfs-3.0-lzma-damn-small-variant (wrong version)...
Skipping others/squashfs-2.0-nb4 (wrong version)...
Skipping others/squashfs-2.2-r2-7z (wrong version)...
Skipping others/squashfs-3.0-e2100 (wrong version)...
Skipping others/squashfs-3.2-r2 (wrong version)...
Skipping others/squashfs-3.2-r2-lzma (wrong version)...
Skipping others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools (wrong version)...
Skipping others/squashfs-3.2-r2-hg612-lzma (wrong version)...
Skipping others/squashfs-3.2-r2-wnr1000 (wrong version)...
Skipping others/squashfs-3.2-r2-rtn12 (wrong version)...
Skipping others/squashfs-3.3 (wrong version)...
Skipping others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools (wrong version)...
Skipping others/squashfs-3.3-grml-lzma/squashfs3.3/squashfs-tools (wrong version)...
Skipping others/squashfs-3.4-cisco (wrong version)...
Skipping others/squashfs-3.4-nb4 (wrong version)...
Skipping others/squashfs-hg55x-bin (wrong version)...
File extraction failed!
文件:
00000000 73 68 73 71 d6 0b 00 00 0d d0 eb 56 00 00 01 00 |shsq.......V....|
00000010 96 00 00 00 01 00 10 00 c0 06 01 00 04 00 00 00 |................|
00000020 af 02 97 59 00 00 00 00 94 03 6c 00 00 00 00 00 |...Y......l.....|
00000030 8c 03 6c 00 00 00 00 00 ff ff ff ff ff ff ff ff |..l.............|
00000040 70 1e 6b 00 00 00 00 00 05 79 6b 00 00 00 00 00 |p.k......yk.....|
任何帮助将不胜感激。谢谢。
#1 楼
此问题是由于转储损坏所致:事实证明,系统内转储以某种方式唤醒了主CPU,从而干扰了SPI总线上的eeprom。将芯片拆焊并使用相同的工具进行读取,并使用Binwalk进行了可提取的转储。评论
能够找出导致问题的原因非常好。感谢您在此处发布答案
– julian♦
19年2月1日在16:48
评论
可以共享固件映像吗?编辑:添加了下载固件转储的链接。
我现在没有时间去研究它,但是由于报告的签名是非标准的,因此您可以尝试将前128个字节左右与该固件二进制文件中的squashfs数据进行比较,并比较字节值与格式规范。供应商似乎确实会时不时地使用格式做奇怪的事情
@julian这是什么固件?似乎与此类似,我正在研究
它是在此站点上共享的,但是我不记得在哪个帖子中。我相信这是用于Swisscom路由器的。可能来自这篇文章