7

I am trying to unpack a clear spot firmware update

The firmware I am trying to reverse can be found on the download page of the vendor I have used the fwtools to unpack the firmware as described on this page.

After I did this, I managed to get a "kernel.bin" and a "rootfs.bin". Now I want to include a new/additional certificate to this modem and make some edits on the administrator page that is within this modem (a Wimax one).

So I checked the rootfs file using the file tool. And I got the following output:

rootfs.bin: Linux Compressed ROM File System data, little endian size 4280320 version #2 sorted_dirs CRC 0xbf224100, edition 16777728, 268441607 blocks, 1325400384 files

This was no to little help so I gave binwalk a try and I got this:

  DECIMAL         HEX             DESCRIPTION
-------------------------------------------------------------------------------------------------------
0               0x0             CramFS filesystem, little endian size 4280320 version #2 sorted_dirs CRC 0xbf224100, edition 16777728, 268441607 blocks, 1325400384 files
8               0x8             Squashfs filesystem, big endian, version 2.1, size: 4276396 bytes, 1028 inodes, blocksize: 65536 bytes, created: Fri Jun 22 23:02:36 2012

But for doing the entire firmware file I got the following output.

    root@bt:/pentest/reverse-engineering/binwalk# ./binwalk -m /pentest/reverse-engineering/binwalk/magic.binwalk /root/fwtools_20100826c/bin.linux/imw.bin

DECIMAL         HEX             DESCRIPTION
-------------------------------------------------------------------------------------------------------
855032          0xD0BF8         CramFS filesystem, little endian size 4280320 version #2 sorted_dirs CRC 0xbf224100, edition 16777728, 268441607 blocks, 1325400384 files
855040          0xD0C00         Squashfs filesystem, big endian, version 2.1, size: 4276396 bytes, 1028 inodes, blocksize: 65536 bytes, created: Fri Jun 22 23:02:36 20

As this did stoke me as odd I didn't continue. I don't know how to unpack the firmware. I think I have tried about everything I know you can do manually, firmware mod fit, fwtools, the whole lot!

Can someone shed some light on my issue and tell me how to continue?

Improve this question
1
  • So ... did you managed to extract the files ?
    – user4047
    Commented Mar 1, 2014 at 0:09

3 Answers 3

Reset to default
7

You can extract them with either a hex editor or dd.

To mount them you do:

  • mount -t cramfs -o loop /firmware/cramfs /mnt/cramfs/
  • mount -t squashfs /firmware/squashfs /mnt/squashfs
Improve this answer
10
  • 2
    Or just use cramfsck/unsquashfs to extract the image. Or 7-zip.
    – Igor Skochinsky ♦
    Commented Sep 17, 2013 at 10:55
  • not working at all !
    – Ahmed Rhuma
    Commented Sep 17, 2013 at 18:48
  • @AhmedRhuma Instead of putting "not working at all!" please eleborate what is going wrong. What the results are of your attempts what you tried etc.. etc.. Try to be constructive
    – Stolas
    Commented Sep 17, 2013 at 19:30
  • okay i'm sorry for that ,, the mount says error ,, can't mount i'll tell you where i am now i extracted the squashfs from the .bin firmware but ether Firmware Mod Kit won't extract it , can you please download the bin file and trying help me !
    – Ahmed Rhuma
    Commented Sep 17, 2013 at 20:15
  • this error : root@bt:~/fwtools_20100826c/bin.linux# mount -t squashfs rootfs.squashfs /mnt/point/ -o loop mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so
    – Ahmed Rhuma
    Commented Sep 17, 2013 at 20:23
7

The CramFS image is a false positive; I doubt there would be over 1 billion files in a 5MB firmware image.

It looks like your binwalk signatures are a bit old; here is the output from mine (running the latest from the trunk):

DECIMAL     HEX         DESCRIPTION
------------------------------------------------------------------------------------------------------------------- 
14944       0x3A60      LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: -1 bytes 
855040      0xD0C00     Squashfs filesystem, big endian, version 2.1, size: 4276396 bytes, 1028 inodes, blocksize: 65536 bytes, created: Fri Jun 22 23:02:36 2012

The LZMA image is the Linux kernel and can be decompressed using p7zip or a similar utility:

$ p7zip -d 3A60.7z

7-Zip (A) 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
p7zip Version 9.20 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,1 CPU)

Processing archive: 3A60.7z

Extracting  3A60

Everything is Ok

Size:       3072188
Compressed: 5120472

You won't be able to mount the SquashFS image, it is non-standard, likely "hacked up" to support LZMA compression. Unfortunately, I couldn't quickly find a version of unsquashfs that would extract the image; your best bet is to put in a GPL request with the company (I didn't see any GPL info on their downloads page), or to find a similar firmware which does have a GPL code release.

Improve this answer
4
1

For those who can't get it to work with the already suggested answers, try this as Igor Skochinsky said in the comments because it was the only thing that worked for me.

Or just use cramfsck/unsquashfs to extract the image. Or 7-zip

I used 7z e file.cramfs and it extracted all files perfectly.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.