I am looking at the firmware for my router C1000A/C1000A-D and I am having some difficulties in mounting and otherwise emulating this. From what I have read, the general process for reverse engineering firmware is to extract the firmware and run it in Qemu or mount it to your filesystem.
I have managed to extract what I believe to be the filesystem from the following
$> binwalk -e --dd="lzma:7z:7zip -d %e" CAC002-31.30L.76.img
I see that there is a tool that will try to mount this runs called unjffs2 when I run this it fails with a seemingly unsolvable issue of a driver not being loaded. However oddly enough, a file system mounts and there is just a bunch of empty folders.
$> ./unjffs2 4000.jffs2
Converting image to little endian...
Wrong bitmask at 0x00033fe8, 0x0000
Wrong bitmask at 0x00033fec, 0x0000
Wrong bitmask at 0x00033ff0, 0x0000
Wrong bitmask at 0x00033ff4, 0x0000
Wrong bitmask at 0x00033ff8, 0x0000
Wrong bitmask at 0x00033ffc, 0x0000
Wrong bitmask at 0x00063f68, 0x0000
Wrong bitmask at 0x00063f6c, 0x0000
Wrong bitmask at 0x00063f70, 0x0000
Wrong bitmask at 0x00063f74, 0x0000
Wrong bitmask at 0x00063f78, 0x0000
Wrong bitmask at 0x00063f7c, 0x0000
Wrong bitmask at 0x00063f80, 0x0000
Wrong bitmask at 0x00063f84, 0x0000
Wrong bitmask at 0x00063f88, 0x0000
Wrong bitmask at 0x00063f8c, 0x0000
Wrong bitmask at 0x00063f90, 0x0000
Wrong bitmask at 0x00063f94, 0x0000
Wrong bitmask at 0x00063f98, 0x0000
Wrong bitmask at 0x00063f9c, 0x0000
Wrong bitmask at 0x00063fa0, 0x0000
Wrong bitmask at 0x00063fa4, 0x0000
Wrong bitmask at 0x00063fa8, 0x0000
...
Wrong bitmask at 0x000f3ff0, 0x0000
Wrong bitmask at 0x000f3ff4, 0x0000
Wrong bitmask at 0x000f3ff8, 0x0000
Wrong bitmask at 0x000f3ffc, 0x0000
modprobe: FATAL: Module mtdchar not found.
2033+1 records in
2033+1 records out
1041200 bytes (1.0 MB) copied, 0.00570635 s, 182 MB/s
JFFS2 image mounted to jffs2-root
At this point, since I don't see any mtdchar driver in my system (Ubuntu based).
I think the best method would be to run in Qemu. How can I do this ?
