经过几天的努力,我正在寻求有关此问题的帮助。

下载固件的链接。

我从带有Flashrom的EEPROM Spansion FL128SAIF00中转储了固件映像,并通过SPI在系统中提取了buspirate。 Binwalk显示以下内容:

kartone@kartone-VirtualBox:~/project$ binwalk -eM newdump.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
-----------------------------------------------------------------------   ---------
65536         0x10000         Broadcom 96345 firmware header, header size: 256, firmware version: "68", board id: "63168_FW_TW", ~CRC32 header checksum: 0x1FD327FA, ~CRC32 data checksum: 0xD3CB1AD5
1114112       0x110000        Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 7078804 bytes, 3030 inodes, blocksize: 65536 bytes, created: 2016-03-18 09:53:17
12189696      0xBA0000        Broadcom 96345 firmware header, header size: 256, firmware version: "68", board id: "63168_FW_TW", ~CRC32 header checksum: 0x968C91F8, ~CRC32 data checksum: 0x9965CD
13172736      0xC90000        Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 2847848 bytes, 1171 inodes, blocksize: 65536 bytes, created: 2013-12-04 12:31:36


因此提取显示:

kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ ll -R
.:
total 9,5M
drwxr-xr-x 3 kartone kartone 4,0K dic 12 22:03 .
drwxr-xr-x 3 kartone kartone 4,0K dic 12 22:21 ..
-rw-r--r-- 1 kartone kartone 6,8M dic 12 22:03 110000.squashfs
-rw-r--r-- 1 kartone kartone 2,8M dic 12 22:03 C90000.squashfs
drwxr-xr-x 2 kartone kartone 4,0K dic 12 22:03 squashfs-root

./squashfs-root:
total 8,0K
drwxr-xr-x 2 kartone kartone 4,0K dic 12 22:03 .
drwxr-xr-x 3 kartone kartone 4,0K dic 12 22:03 ..


Binwalk无法提取那些两个squashfs文件系统:

kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ binwalk 110000.squashfs 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 7078804 bytes, 3030 inodes, blocksize: 65536 bytes, created: 2016-03-18 09:53:17

kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ binwalk C90000.squashfs 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 2847848 bytes, 1171 inodes, blocksize: 65536 bytes, created: 2013-12-04 12:31:36


所以我尝试使用这些实用程序进行提取(从证据11000.squashfs报告,但与第二个文件C90000.squashfs的结果相同):

kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ unsquashfs -v; unsquashfs 110000.squashfs 
unsquashfs version 4.3 (2014/05/12)
copyright (C) 2014 Phillip Lougher <phillip@squashfs.org.uk>

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2,
or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
Parallel unsquashfs: Using 2 processors
lzma uncompress failed with error code 9
read_block: failed to read block @0x6bea07
read_fragment_table: failed to read fragment table index
FATAL ERROR:failed to read fragment table


kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ sasquatch -v; sasquatch 110000.squashfs 
unsquashfs version 4.3 (2014/05/12)
copyright (C) 2014 Phillip Lougher <phillip@squashfs.org.uk>

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2,
or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
SquashFS version [4.0] / inode count [3030] suggests a SquashFS image of the same endianess
Non-standard SquashFS Magic: shsq
Parallel unsquashfs: Using 1 processor
Trying to decompress using default gzip decompressor...
Trying to decompress with lzma...
Trying to decompress with lzma-adaptive...
Trying to decompress with lzma-alt...
Trying to decompress with lzma-ddwrt...
Trying to decompress with lzo...
Trying to decompress with xz...
read_block: failed to read block @0x6bea07
read_fragment_table: failed to read fragment table index
FATAL ERROR:failed to read fragment table


使用固件-mod-kit提取脚本的结果非常相似:

kartone@kartone-VirtualBox:~/project/_newdump.bin.extracted$ sudo /opt/firmware-mod-kit/unsquashfs_all.sh 110000.squashfs 
Attempting to extract SquashFS 4.X file system...

Skipping squashfs-2.1-r2 (wrong version)...
Skipping squashfs-3.0 (wrong version)...
Skipping squashfs-3.0-lzma-damn-small-variant (wrong version)...
Skipping others/squashfs-2.0-nb4 (wrong version)...
Skipping others/squashfs-2.2-r2-7z (wrong version)...
Skipping others/squashfs-3.0-e2100 (wrong version)...
Skipping others/squashfs-3.2-r2 (wrong version)...
Skipping others/squashfs-3.2-r2-lzma (wrong version)...
Skipping others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools (wrong version)...
Skipping others/squashfs-3.2-r2-hg612-lzma (wrong version)...
Skipping others/squashfs-3.2-r2-wnr1000 (wrong version)...
Skipping others/squashfs-3.2-r2-rtn12 (wrong version)...
Skipping others/squashfs-3.3 (wrong version)...
Skipping others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools (wrong version)...
Skipping others/squashfs-3.3-grml-lzma/squashfs3.3/squashfs-tools (wrong version)...
Skipping others/squashfs-3.4-cisco (wrong version)...
Skipping others/squashfs-3.4-nb4 (wrong version)...
Skipping others/squashfs-hg55x-bin (wrong version)...
File extraction failed!


文件:

00000000  73 68 73 71 d6 0b 00 00  0d d0 eb 56 00 00 01 00  |shsq.......V....|
00000010  96 00 00 00 01 00 10 00  c0 06 01 00 04 00 00 00  |................|
00000020  af 02 97 59 00 00 00 00  94 03 6c 00 00 00 00 00  |...Y......l.....|
00000030  8c 03 6c 00 00 00 00 00  ff ff ff ff ff ff ff ff  |..l.............|
00000040  70 1e 6b 00 00 00 00 00  05 79 6b 00 00 00 00 00  |p.k......yk.....|


任何帮助将不胜感激。谢谢。

评论

可以共享固件映像吗?

编辑:添加了下载固件转储的链接。

我现在没有时间去研究它,但是由于报告的签名是非标准的,因此您可以尝试将前128个字节左右与该固件二进制文件中的squashfs数据进行比较,并比较字节值与格式规范。供应商似乎确实会时不时地使用格式做奇怪的事情

@julian这是什么固件?似乎与此类似,我正在研究

它是在此站点上共享的,但是我不记得在哪个帖子中。我相信这是用于Swisscom路由器的。可能来自这篇文章

#1 楼

此问题是由于转储损坏所致:事实证明,系统内转储以某种方式唤醒了主CPU,从而干扰了SPI总线上的eeprom。将芯片拆焊并使用相同的工具进行读取,并使用Binwalk进行了可提取的转储。

评论


能够找出导致问题的原因非常好。感谢您在此处发布答案

– julian♦
19年2月1日在16:48