如何从 I240w-A 固件中提取文件系统

逆向工程 固件 开箱
2021-06-16 01:54:28

我正在尝试提取这个ONT I240w-A 固件，binwalk 报告了一些 LZMA 压缩数据（在下面转储），但它们都读取“未压缩大小：-1 字节”这一事实让我怀疑它们是误报。这是一个正确的假设吗？有人可以提供有关如何解压缩此文件的任何建议吗？

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
64613         0xFC65          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
663307        0xA1F0B         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
1277775       0x137F4F        VMware4 disk image
1419798       0x15AA16        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2167742       0x2113BE        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2966631       0x2D4467        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
3649662       0x37B07E        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
4619541       0x467D15        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
5626408       0x55DA28        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
6526915       0x6397C3        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
7352076       0x702F0C        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
8028944       0x7A8310        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
8790601       0x862249        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
9628455       0x92EB27        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
10380524      0x9E64EC        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
11136805      0xA9EF25        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
11917494      0xB5D8B6        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
12590672      0xC01E50        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
13354487      0xCBC5F7        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
13954117      0xD4EC45        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
13955290      0xD4F0DA        uImage header, header size: 64 bytes, header CRC: 0xED8A6EC8, created: 2013-08-16 11:32:36, image size: 2369813 bytes, Data Address: 0x80010000, Entry Point: 0x80014110, data CRC: 0xB66029EE, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: gzip, image name: "Linux Kernel Image"
13955354      0xD4F11A        gzip compressed data, maximum compression, from Unix, NULL date (1970-01-01 00:00:00)
16325167      0xF91A2F        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
16476952      0xFB6B18        LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes
2个回答

所有 LZMA 条目似乎都是有效的，并解压为 tar 存档（-1 是有效的文件大小，当压缩器不知道原始数据的大小时使用，例如当数据通过 stdin 传递时） .

虽然大部分的 tar 文件名是相同的（“tmp_file”），但解压后的数据是不同的；那里似乎有一个 UBIFS 文件系统，以及大量纯文本 shell 脚本等：

Scan Time:     2015-07-27 23:33:31
Target File:   /home/eve/Downloads/_FE54869ACAD07.extracted/_6397C3.extracted/tmp_file
MD5 Checksum:  63a711b8ee1cdbb886d572dd610f7a2d
Signatures:    332

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
40361         0x9DA9          Executable script, shebang: "/bin/sh"
90177         0x16041         Executable script, shebang: "/bin/sh"
113593        0x1BBB9         Executable script, shebang: "/bin/sh"
197217        0x30261         Executable script, shebang: "/bin/sh"
203169        0x319A1         Unix path: /opt/tools/broadlight/sysroot)I
297561        0x48A59         Executable script, shebang: "/bin/sh"
376433        0x5BE71         Executable script, shebang: "/bin/sh"
388553        0x5EDC9         Executable script, shebang: "/bin/sh"
396018        0x60AF2         Unix path: /../sysroot/usr/include
415009        0x65521         Executable script, shebang: "/bin/sh"
415617        0x65781         Executable script, shebang: "/bin/sh"
431897        0x69719         Executable script, shebang: "/bin/sh"
436698        0x6A9DA         HTML document header
504153        0x7B159         Executable script, shebang: "/bin/sh"
629257        0x99A09         Executable script, shebang: "/bin/sh"
629673        0x99BA9         Executable script, shebang: "/bin/sh"
630169        0x99D99         Executable script, shebang: "/bin/sh"
630889        0x9A069         Executable script, shebang: "/bin/sh"
678623        0xA5ADF         Unix path: /x86-linux2/../sysroot/usr/include


Scan Time:     2015-07-27 23:33:31
Target File:   /home/eve/Downloads/_FE54869ACAD07.extracted/_862249.extracted/tmp_file
MD5 Checksum:  099fbe96cd12990a19fe55e2dc4b651c
Signatures:    332

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             UBIFS superblock node, CRC: 0xD1C96755, flags: 0x0, min I/O unit size: 2048, erase block size: 129024, erase block count: 157, max erase blocks: 288, format version: 4, compression type: lzo
129024        0x1F800         UBIFS master node, CRC: 0xCB83706A, highest inode: 1330, commit number: 0
258048        0x3F000         UBIFS master node, CRC: 0xC7B38577, highest inode: 1330, commit number: 0

我不知道有什么好的工具可以与 UBIFS 一起工作，也许这里的其他人有一些建议？

首先，我首先要说我只是在编写部分解决方案，因为我没有时间完全提取它。

您假设有很多误报是正确的，但是文件的开头似乎确实是 lzma 压缩的。检查的最简单方法（这就是我所做的）是使用十六进制编辑器查看它，如果标题正常，请尝试解压缩。

解压结果： 解压的

此外，固件似乎有几个部分，并包含风河 linux：“C: (Wind River Linux Sourcery G++ 4.4a-323) 4.4.1”

您可以在这里阅读类似的内容：http : //www.devttys0.com/2011/07/reverse-engineering-vxworks-firmware-wrt54gv8/

其它你可能感兴趣的问题
上一篇LG IR 数据包中的 4 位 CRC 逆向工程 下一篇通过分析可执行文件来反转加密