如何提取DVB固件bin文件?

逆向工程 二元分析 固件 二进制 固件分析
2021-06-30 14:41:00

我有一个 DVB (DTH) 盒固件的 bin 文件。我想更改那个 bin 文件中的一个图像,我该怎么做?请指导我正确的方向。

我试过 bin walk,但它提取的文件看起来没什么用。

下面是我试过的命令:

$ binwalk -B /Users/Me/Documents/Reverse/dump_all.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
52150         0xCBB6          LZMA compressed data, properties: 0xC8, dictionary size: 16777216 bytes, uncompressed size: 65536 bytes
55216         0xD7B0          eCos RTOS string reference: "ecos.bin.lzma"
55232         0xD7C0          eCos RTOS string reference: "ecos.bin.gz"
66048         0x10200         JPEG image data, JFIF standard 1.02
66078         0x1021E         TIFF image data, big-endian, offset of first image directory: 8
68069         0x109E5         Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='http://ns.adobe.com/iX/1.0/'>
68238         0x10A8E         Unix path: /ns.adobe.com/xap/1.0/mm/'>
131072        0x20000         romfs filesystem, version 1 size: 2439392 bytes, named "rom 5c67f699"
2621440       0x280000        CramFS filesystem, little endian, size: 12288 version 2 sorted_dirs CRC 0xA76D500A, edition 0, 5 blocks, 20 files
2883584       0x2C0000        CramFS filesystem, little endian, size: 819200 version 2 sorted_dirs CRC 0xB7F50F6A, edition 0, 976 blocks, 362 files
3739148       0x390E0C        Zlib compressed data, compressed
3741196       0x39160C        Zlib compressed data, compressed
3743756       0x39200C        Zlib compressed data, compressed
3744780       0x39240C        Zlib compressed data, compressed
3746316       0x392A0C        Zlib compressed data, compressed
3750924       0x393C0C        Zlib compressed data, compressed
3752460       0x39420C        Zlib compressed data, compressed
3753996       0x39480C        Zlib compressed data, compressed
3755532       0x394E0C        Zlib compressed data, compressed
3757068       0x39540C        Zlib compressed data, compressed
3758604       0x395A0C        Zlib compressed data, compressed
3867148       0x3B020C        Zlib compressed data, compressed
3901964       0x3B8A0C        Zlib compressed data, compressed
3903500       0x3B900C        Zlib compressed data, compressed
3905036       0x3B960C        Zlib compressed data, compressed
3906572       0x3B9C0C        Zlib compressed data, compressed
3908108       0x3BA20C        Zlib compressed data, compressed
3909644       0x3BA80C        Zlib compressed data, compressed
3911180       0x3BAE0C        Zlib compressed data, compressed
3912716       0x3BB40C        Zlib compressed data, compressed
3914252       0x3BBA0C        Zlib compressed data, compressed
4020748       0x3D5A0C        Zlib compressed data, compressed
4022284       0x3D600C        Zlib compressed data, compressed
4023820       0x3D660C        Zlib compressed data, compressed
4041740       0x3DAC0C        Zlib compressed data, compressed
4045836       0x3DBC0C        Zlib compressed data, compressed
4047372       0x3DC20C        Zlib compressed data, compressed
4064780       0x3E060C        Zlib compressed data, compressed
4065804       0x3E0A0C        Zlib compressed data, compressed
4133900       0x3F140C        Zlib compressed data, compressed
4135436       0x3F1A0C        Zlib compressed data, compressed
4140556       0x3F2E0C        Zlib compressed data, compressed
4142092       0x3F340C        Zlib compressed data, compressed
4147212       0x3F480C        Zlib compressed data, compressed
4148748       0x3F4E0C        Zlib compressed data, compressed

以及提取文件的第二个命令:

$ binwalk -e /Users/Me/Documents/Reverse/dump_all.bin -C /Users/me/Documents/Reverse/dump_all 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

WARNING: Extractor.execute failed to run external extractor '7z e -y '%e'': [Errno 2] No such file or directory
52150         0xCBB6          LZMA compressed data, properties: 0xC8, dictionary size: 16777216 bytes, uncompressed size: 65536 bytes
55216         0xD7B0          eCos RTOS string reference: "ecos.bin.lzma"
55232         0xD7C0          eCos RTOS string reference: "ecos.bin.gz"
66048         0x10200         JPEG image data, JFIF standard 1.02
66078         0x1021E         TIFF image data, big-endian, offset of first image directory: 8
68069         0x109E5         Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#' xmlns:iX='http://ns.adobe.com/iX/1.0/'>
68238         0x10A8E         Unix path: /ns.adobe.com/xap/1.0/mm/'>
131072        0x20000         romfs filesystem, version 1 size: 2439392 bytes, named "rom 5c67f699"

WARNING: Extractor.execute failed to run external extractor 'cramfsck -x '%%cramfs-root%%' '%e'': [Errno 2] No such file or directory

WARNING: Extractor.execute failed to run external extractor 'cramfsswap '%e' '%e.swap' && cramfsck -x '%%cramfs-root%%' '%e.swap'': [Errno 2] No such file or directory
2621440       0x280000        CramFS filesystem, little endian, size: 12288 version 2 sorted_dirs CRC 0xA76D500A, edition 0, 5 blocks, 20 files

WARNING: Extractor.execute failed to run external extractor 'cramfsck -x '%%cramfs-root%%' '%e'': [Errno 2] No such file or directory

WARNING: Extractor.execute failed to run external extractor 'cramfsswap '%e' '%e.swap' && cramfsck -x '%%cramfs-root%%' '%e.swap'': [Errno 2] No such file or directory
2883584       0x2C0000        CramFS filesystem, little endian, size: 819200 version 2 sorted_dirs CRC 0xB7F50F6A, edition 0, 976 blocks, 362 files
3739148       0x390E0C        Zlib compressed data, compressed
3741196       0x39160C        Zlib compressed data, compressed
3743756       0x39200C        Zlib compressed data, compressed
3744780       0x39240C        Zlib compressed data, compressed
3746316       0x392A0C        Zlib compressed data, compressed
3750924       0x393C0C        Zlib compressed data, compressed
3752460       0x39420C        Zlib compressed data, compressed
3753996       0x39480C        Zlib compressed data, compressed
3755532       0x394E0C        Zlib compressed data, compressed
3757068       0x39540C        Zlib compressed data, compressed
3758604       0x395A0C        Zlib compressed data, compressed
3867148       0x3B020C        Zlib compressed data, compressed
3901964       0x3B8A0C        Zlib compressed data, compressed
3903500       0x3B900C        Zlib compressed data, compressed
3905036       0x3B960C        Zlib compressed data, compressed
3906572       0x3B9C0C        Zlib compressed data, compressed
3908108       0x3BA20C        Zlib compressed data, compressed
3909644       0x3BA80C        Zlib compressed data, compressed
3911180       0x3BAE0C        Zlib compressed data, compressed
3912716       0x3BB40C        Zlib compressed data, compressed
3914252       0x3BBA0C        Zlib compressed data, compressed
4020748       0x3D5A0C        Zlib compressed data, compressed
4022284       0x3D600C        Zlib compressed data, compressed
4023820       0x3D660C        Zlib compressed data, compressed
4041740       0x3DAC0C        Zlib compressed data, compressed
4045836       0x3DBC0C        Zlib compressed data, compressed
4047372       0x3DC20C        Zlib compressed data, compressed
4064780       0x3E060C        Zlib compressed data, compressed
4065804       0x3E0A0C        Zlib compressed data, compressed
4133900       0x3F140C        Zlib compressed data, compressed
4135436       0x3F1A0C        Zlib compressed data, compressed
4140556       0x3F2E0C        Zlib compressed data, compressed
4142092       0x3F340C        Zlib compressed data, compressed
4147212       0x3F480C        Zlib compressed data, compressed
4148748       0x3F4E0C        Zlib compressed data, compressed

输出文件夹如下所示: 使用 binwalk 提取文件

我也试过7zip解压文件,下面是解压文件截图:

使用 7zip 提取的文件

看起来 7zip 提取了我正在寻找的文件结构,但问题是它没有提取文件,只有文件夹,而且还有一条错误消息: 7zip 提取错误

这是固件的链接

1个回答

我正在尝试做同样的事情。

它是一个 gx6605 固件,用于国家芯片组 dvbs2 盒中。我使用 tuxbox 工具来提取 cramfs 文件,但它只提取主题和 xml 文件。没什么用。

我使用 gx6605 解包重新打包工具并将这些部分解压缩为

boot.bin
data.bin
kernel.bin
logo.bin
root.bin
table.bin
theme.bin

Kernel是用lzma打包的,但是首先你需要把kernel文件的前8行去掉并保存。

在此处输入图片说明

删除此标头并保存文件后,您可以在 Windows 中使用 lzma.exe 对文件进行解码。

解码语法: lzma d kernel.bin kernel_unpacked.bin

现在您可以修改kernel_unpacked.bin文件并使用十六进制编辑器或其他一些查看器查看代码。

但是,我无法从该文件中提取任何内容(因为我对二进制文件了解不多)。如果您能找到实际代码所在的位置,请告诉我。

我在BOOT.bin文件中找到了一些ecos.bin.gz您可以检查的参考资料

谢谢。