TL;DR:
Trying to mount extracted ubi file system onto /dev/mtd0 gives me the error:
libscan: scanning eraseblock 323 -- 100 % complete
ubiformat: 324 eraseblocks are supposedly empty
ubiformat: error!: file "340D04.ubi" (size 42467348 bytes) is not multiple of eraseblock size (131072 bytes)
error 0 (Success)
How do I get that thing flashed?
Longer version:
I am looking to reverse the firmware for an Arris modem firmware, comparing older versions of the firmware to newer ones. I want to get access to the webroot of the little web server that runs the firmware because I think there is a bug in it.
In this older version, binwalk gives me this:
> binwalk spTurquoise210-700_1.6.9.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
544 0x220 Certificate in DER format (x509 v3), header length: 4, sequence length: 985
1533 0x5FD Certificate in DER format (x509 v3), header length: 4, sequence length: 1246
3332 0xD04 JFFS2 filesystem, little endian
3411204 0x340D04 UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000
Extracting this binwalk -e spTurquoise210-700_1.6.9.bin yields:
total 166M
drwxr-xr-x 3 root root 4.0K Mar 5 16:10 .
drwxr-xr-x 4 michael michael 4.0K Mar 5 16:10 ..
-rw-r--r-- 1 root root 43M Mar 5 16:10 220.crt
-rw-r--r-- 1 root root 39M Mar 5 16:10 340D04.ubi
-rw-r--r-- 1 root root 43M Mar 5 16:10 5FD.crt
-rw-r--r-- 1 root root 43M Mar 5 16:10 D04.jffs2
drwxr-xr-x 3 root root 4.0K Mar 5 16:10 jffs2-root
The contents of jffs2-root don't reveal the webroot. I have mounted the D04.jffs2 image, and it appears to be identical to the extracted jffs2-root directory contents. It appears to be the upgrader that flashes the firmware.
So, I figure I'll check the 340D04.ubi image. To mount that and check it, I:
> rmmod mtdram
> du -sk 340D04.ubi
39812 340D04.ubi
> modprobe mtdram total_size=39812
> flash_erase /dev/mtd0 0 0
> ubiformat /dev/mtd0 -f 340D04.ubi
That's where I've hit a problem. The output of the ubiformat command is:
libscan: scanning eraseblock 323 -- 100 % complete
ubiformat: 324 eraseblocks are supposedly empty
ubiformat: error!: file "340D04.ubi" (size 42467348 bytes) is not multiple of eraseblock size (131072 bytes)
error 0 (Success)
I cannot figure out how to flash the ubi file system onto the mtd0 device so I can (later) mount it.
