Question 1

如果您查看备份文件的偏移量 0xDF，您将看到两个字节：

0x78 0xDA

这些通常分隔 zlib 压缩文件的开头。

事实上，原来的 XML 配置文件已经被拆分成多个 zlib 压缩块：

$ binwalk default-config.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------------------
223           0xDF            Zlib header, best compression, uncompressed size >= 8192
1211          0x4BB           Zlib header, best compression, uncompressed size >= 8192
2260          0x8D4           Zlib header, best compression, uncompressed size >= 8192
2901          0xB55           Zlib header, best compression, uncompressed size >= 8192
3796          0xED4           Zlib header, best compression, uncompressed size >= 8192
4306          0x10D2          Zlib header, best compression, uncompressed size >= 8192
5224          0x1468          Zlib header, best compression, uncompressed size >= 8192
6066          0x17B2          Zlib header, best compression, uncompressed size >= 8192
7084          0x1BAC          Zlib header, best compression, uncompressed size >= 8192
8058          0x1F7A          Zlib header, best compression, uncompressed size >= 8192
8981          0x2315          Zlib header, best compression, uncompressed size >= 3156

如果您解压缩每个块并将解压缩的数据连接在一起，您将获得原始 XML 配置文件。

Question 2

好的，这是可行的小python脚本:)


import zlib


magic_numbers = ['\x78\xDA']
filename = 'config-marina.bin'


infile = open(filename, 'r')
data = infile.read()


pos = 0
found = False


while pos < len(data):
    window = data[pos:pos+2]
    for marker in magic_numbers:
        if window == marker:
            found = True
            start = pos
            print "Start of zlib %s" % pos
            rest_of_data = data[start:]
            decomp_obj = zlib.decompressobj()
            uncompressed_msg = decomp_obj.decompress(rest_of_data)
            print "Content: %s" % uncompressed_msg
            break
    if pos == len(data):
        break
    pos += 1


if found:
    header = data[:start]
    footer = decomp_obj.unused_data


if not found:
    print "Sorry, no zlib found."

Question 3

config.bin 文件中的每个压缩块都由一个包含以下信息的小 3-DWORD 标头开头：

未压缩的 xml 块的长度。对于除最后一个块之外的所有块，此值为 0x10000
压缩后的 zlib 块的长度
附加块后文件的累积长度。对于最后一个块，该值为 0x0。

这些标头可用于在块检测期间避免误报：有效块将在第一个字段上具有 0x10000 或在第三个字段上具有 0x0。标头还可用于验证未压缩的数据大小。

import re
import zlib
import struct


def extract_config_xml(config_bin):
    config_xml = b''
    for zlib_chunk in re.finditer('\x78\xda', config_bin):
        zlib_chunk_start = zlib_chunk.start()
        zlib_chunk_header = config_bin[zlib_chunk_start - 12: zlib_chunk_start]
        xml_chunk_length, zlib_chunk_length, config_bin_length = \
            struct.unpack('>LLL', zlib_chunk_header)
        if xml_chunk_length == 0x10000 or config_bin_length == 0:
            zlib_chunk_end = zlib_chunk_start + zlib_chunk_length
            zlib_chunk = config_bin[zlib_chunk_start: zlib_chunk_end]
            xml_chunk = zlib.decompress(zlib_chunk)
            assert xml_chunk_length == len(xml_chunk)
            config_xml += xml_chunk
    return config_xml


with open('config.bin', 'rb') as f:
    print extract_config_xml(f.read())

Answer 1