7

I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself.

Problem : It's only extracting "sysversion.txt, a bit light :).

Files :

ron@vpsXXXXXX:~/firmware$ ls
CH-sys-48.53.64.67.zip

Verification and extraction :

ron@vpsXXXXXX:~/firmware$ binwalk CH-sys-48.53.64.67.zip

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Zip archive data, at least v2.0 to extract, compressed size: 605571, uncompressed size: 612699, name: CH-sys-48.53.64.67.bin
605717        0x93E15         End of Zip archive

ron@vpsXXXXXX:~/firmware$ file CH-sys-48.53.64.67.zip
CH-sys-48.53.64.67.zip: Zip archive data, at least v2.0 to extract
ron@vpsXXXXXX:~/firmware$ unzip CH-sys-48.53.64.67.zip
Archive:  CH-sys-48.53.64.67.zip
  inflating: CH-sys-48.53.64.67.bin

Binwalk without extracting :

ron@vpsXXXXXX:~/firmware$ binwalk CH-sys-48.53.64.67.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
172           0xAC            Zip archive data, at least v2.0 to extract, compressed size: 8969, uncompressed size: 19091, name: system/system/lib/libsns_gc1004.so
9337          0x2479          End of Zip archive
9499          0x251B          Zip archive data, at least v2.0 to extract, compressed size: 7813, uncompressed size: 16341, name: system/system/lib/libsns_ov9712_plus.so
17518         0x446E          End of Zip archive
17680         0x4510          Zip archive data, at least v2.0 to extract, compressed size: 90121, uncompressed size: 353248, name: system/system/lib/libOnvif.so
107987        0x1A5D3         End of Zip archive
108149        0x1A675         Zip archive data, at least v2.0 to extract, compressed size: 43603, uncompressed size: 84480, name: system/system/lib/libvoice_arm.so
151946        0x2518A         End of Zip archive
152108        0x2522C         Zip archive data, at least v2.0 to extract, compressed size: 130, uncompressed size: 227, name: system/init/ipcam.sh
152406        0x25356         End of Zip archive
152568        0x253F8         Zip archive data, at least v2.0 to extract, compressed size: 402383, uncompressed size: 886168, name: system/system/bin/encoder
555129        0x87879         End of Zip archive
555291        0x8791B         Zip archive data, at least v2.0 to extract, compressed size: 35394, uncompressed size: 74200, name: system/system/bin/wifidaemon
590869        0x90415         End of Zip archive
591031        0x904B7         Zip archive data, at least v2.0 to extract, compressed size: 1852, uncompressed size: 9692, name: system/system/bin/grade.sh
593063        0x90CA7         End of Zip archive
593225        0x90D49         Zip archive data, at least v2.0 to extract, compressed size: 8704, uncompressed size: 20212, name: system/system/bin/updata
602105        0x92FF9         End of Zip archive
602267        0x9309B         Zip archive data, at least v2.0 to extract, compressed size: 1874, uncompressed size: 4522, name: system/system/bin/gpio_aplink.ko
604333        0x938AD         End of Zip archive
604495        0x9394F         Zip archive data, at least v2.0 to extract, compressed size: 7241, uncompressed size: 16802, name: system/system/bin/motogpio.ko
611922        0x95652         End of Zip archive
612084        0x956F4         Zip archive data, at least v1.0 to extract, compressed size: 8, uncompressed size: 8, name: system/system/bin/fwversion.bin
612282        0x957BA         End of Zip archive
612444        0x9585C         Zip archive data, at least v1.0 to extract, compressed size: 9, uncompressed size: 9, name: system/system/bin/sysversion.txt
612645        0x95925         End of Zip archive

Binwalk extraction : 

ron@vpsXXXXXX:~/firmware$ binwalk -Mer CH-sys-48.53.64.67.bin

Scan Time:     2016-01-19 00:36:12
Target File:   /home/ron/firmware/CH-sys-48.53.64.67.bin
MD5 Checksum:  58df9214226cfe46760215bfca0c496c
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
172           0xAC            Zip archive data, at least v2.0 to extract, compressed size: 8969, uncompressed size: 19091, name: system/system/lib/libsns_gc1004.so
9337          0x2479          End of Zip archive
9499          0x251B          Zip archive data, at least v2.0 to extract, compressed size: 7813, uncompressed size: 16341, name: system/system/lib/libsns_ov9712_plus.so
17518         0x446E          End of Zip archive
17680         0x4510          Zip archive data, at least v2.0 to extract, compressed size: 90121, uncompressed size: 353248, name: system/system/lib/libOnvif.so
107987        0x1A5D3         End of Zip archive
108149        0x1A675         Zip archive data, at least v2.0 to extract, compressed size: 43603, uncompressed size: 84480, name: system/system/lib/libvoice_arm.so
151946        0x2518A         End of Zip archive
152108        0x2522C         Zip archive data, at least v2.0 to extract, compressed size: 130, uncompressed size: 227, name: system/init/ipcam.sh
152406        0x25356         End of Zip archive
152568        0x253F8         Zip archive data, at least v2.0 to extract, compressed size: 402383, uncompressed size: 886168, name: system/system/bin/encoder
555129        0x87879         End of Zip archive
555291        0x8791B         Zip archive data, at least v2.0 to extract, compressed size: 35394, uncompressed size: 74200, name: system/system/bin/wifidaemon
590869        0x90415         End of Zip archive
591031        0x904B7         Zip archive data, at least v2.0 to extract, compressed size: 1852, uncompressed size: 9692, name: system/system/bin/grade.sh
593063        0x90CA7         End of Zip archive
593225        0x90D49         Zip archive data, at least v2.0 to extract, compressed size: 8704, uncompressed size: 20212, name: system/system/bin/updata
602105        0x92FF9         End of Zip archive
602267        0x9309B         Zip archive data, at least v2.0 to extract, compressed size: 1874, uncompressed size: 4522, name: system/system/bin/gpio_aplink.ko
604333        0x938AD         End of Zip archive
604495        0x9394F         Zip archive data, at least v2.0 to extract, compressed size: 7241, uncompressed size: 16802, name: system/system/bin/motogpio.ko
611922        0x95652         End of Zip archive
612084        0x956F4         Zip archive data, at least v1.0 to extract, compressed size: 8, uncompressed size: 8, name: system/system/bin/fwversion.bin
612282        0x957BA         End of Zip archive
612444        0x9585C         Zip archive data, at least v1.0 to extract, compressed size: 9, uncompressed size: 9, name: system/system/bin/sysversion.txt
612645        0x95925         End of Zip archive


Scan Time:     2016-01-19 00:36:12
Target File:   /home/ron/firmware/_CH-sys-48.53.64.67.bin.extracted/system/system/bin/sysversion.txt
MD5 Checksum:  3e98d83fbced8eb62c79542f5df5a14f
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

Only one target file extracted...

A quick look to headers :

ron@vpsXXXXXX:~/firmware$ head -n1 CH-sys-48.53.64.67.bin | hexdump -C
00000000  77 77 77 2e 6f 62 6a 65  63 74 2d 63 61 6d 65 72  |www.object-camer|
00000010  61 2e 63 6f 6d 2e 62 79  2e 68 6f 6e 67 7a 78 2e  |a.com.by.hongzx.|
00000020  73 79 73 74 65 6d 2f 73  79 73 74 65 6d 2f 6c 69  |system/system/li|
00000030  62 2f 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |b/..............|
00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000060  6c 69 62 73 6e 73 5f 67  63 31 30 30 34 2e 73 6f  |libsns_gc1004.so|
00000070  2e 7a 69 70 00 00 00 00  00 00 00 00 00 00 00 00  |.zip............|
00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000a0  e3 23 00 00 43 40 35 30  00 00 00 00 50 4b 03 04  |.#[email protected]..|
000000b0  14 00 00 00 08 00 fa 8b  5d 47 89 42 30 43 09 23  |........]G.B0C.#|
000000c0  00 00 93 4a 00 00 22 00  1c 00 73 79 73 74 65 6d  |...J.."...system|
000000d0  2f 73 79 73 74 65 6d 2f  6c 69 62 2f 6c 69 62 73  |/system/lib/libs|
000000e0  6e 73 5f 67 63 31 30 30  34 2e 73 6f 55 54 09 00  |ns_gc1004.soUT..|
000000f0  03 88 e7 31 56 88 e7 31  56 75 78 0b 00 01 04 ed  |...1V..1Vux.....|
00000100  03 00 00 04 ed 03 00 00  e5 7c 0b 78 53 55 d6 f6  |.........|.xSU..|
00000110  3e b9 b4 69 9a cb 69 cf  29 96 8b 92 0a           |>..i..i.)....|
0000011d

Any idea why I'm not able to extract everything ?

Thank you !

Ronan

Improve this question

1 Answer 1

Reset to default
6

Although my binwalk version extracted the files correctly to the system folder along with the zip files containing only the sysversion.txt, I shortly describe why you see only the sysversion.txt in the archive files. It is because the firmware file contain multiple PKZIP archives and the binwalk does not know the exact size of these files. So, it can identify the start of the PKZIP file correctly based on the PK magic, but without knowing the correct file size, it extracts the remaining bytes to the created ZIP file. Because the central directory structure in PKZIP format stored at the end of the ZIP file, after the compressed data and the extracted ZIP file ends with the sysversion.txt.zip, the file viewer or decompressor may found the central directory of the last ZIP file.

To solve this problem, you may check the system folder in the same folder you found the ZIP files, or you can extract the files manually.
If you take a look at the start of the CH-sys-48.53.64.67.bin file, you will find that it has a simple structure. It starts with a magic string (marked with blue in the picture). The next element is a 0x40 bytes long directory name (marked with yellow) followed by a 0x40 bytes long file name entry (marked with green). After the file name you will find the size of the file (marked with purple), some flags and the binary content (start of the binary file marked with grey).

enter image description here

Based on these information you can write a simple script, which extracts the files correctly, for example:

import sys
import struct

if (len(sys.argv) < 2):
    print 'usage: parse binary'
    sys.exit(1)

b = open(sys.argv[1], 'rb').read()
o = 0x20
while(o < len(b)-0x20):
    dir = b[o:o+0x40].strip('\x00')
    fname = b[o+0x40:o+0x80].strip('\x00')
    size = struct.unpack('L', b[o+0x80:o+0x84])[0]
    unk1 = struct.unpack('L', b[o+0x84:o+0x88])[0]
    unk2 = struct.unpack('L', b[o+0x88:o+0x8c])[0]
    print '%x, %s, %s: %x, %x, %x'%(o, dir, fname, size, unk1, unk2)
    open(fname, 'wb').write(b[o+0x8c:o+0x8c+size])
    o += 0x8c+size
Improve this answer
2
  • 1
    Binwalk 2.0.0 did the job perfectly where the 2.1.1 fails.
    – Ronan
    Jan 21, 2016 at 23:44
  • Hi, just want to say that I use Binwalk 2.1.1 to extract similar firmware and it worked just fine, only oddity was that it added a bunch of hexadecimal named zip files that have nothing in them, and are actually just the header to each of the packed zip files. Thank you for reversing the header though, very helpful!
    – redcodefinal
    Mar 19, 2019 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.