4

I've been working on reversing the slingbox firmware. I didn't get anywhere trying to get into a current firmware file (see my other question - appears to be encrypted), so I found a download for an older slingbox firmware at http://autoupdate.sling.com/tinybird/200.00.US.99/ Using http://autoupdate.sling.com/tinybird/200.00.US.99/SlingboxSoloFwV2_1_110HwV1_0_3Current.bin as a place to start I noticed with binwalk the following:

$ binwalk -D 'filesystem:d' SlingboxSoloFwV2_1_110HwV1_0_3Current.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
2947692       0x2CFA6C        YAFFS filesystem
2948896       0x2CFF20        YAFFS filesystem
2948980       0x2CFF74        YAFFS filesystem
2949096       0x2CFFE8        YAFFS filesystem
2949244       0x2D007C        YAFFS filesystem
2949424       0x2D0130        YAFFS filesystem
2950196       0x2D0434        YAFFS filesystem
2950288       0x2D0490        YAFFS filesystem
2950412       0x2D050C        YAFFS filesystem
2950568       0x2D05A8        YAFFS filesystem
2950756       0x2D0664        YAFFS filesystem
2971856       0x2D58D0        SHA256 hash constants, little endian
3000600       0x2DC918        Base64 standard index table
3088905       0x2F2209        Unix path: /services.sling.com/configservices/rest/v2/configuration/product
3302671       0x32650F        HTML document header
3302714       0x32653A        HTML document footer
3344945       0x330A31        Unix path: /www.w3.org/XML/1998/namespace
3358301       0x333E5D        XML document, version: "1.0"
3368469       0x336615        Unix path: /www.w3.org/XML/1998/namespace
3376275       0x338493        XML document, version: ""1."
3376594       0x3385D2        Unix path: /www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd
3385025       0x33A6C1        Unix path: /www.adobe.com/xml/dtds/cross-domain-policy.dtd

This yielded 11 different files (different based on md5). I tried the unyaffs tool on each of them, but got errors for each of them:

Can't determine flash layout, perhaps not a yaffs2 image

Repeating the same binwalk command on one of the resultant files yields 11 (smaller) files, also appearing to be YAFFS. Same error as before when I try unyaffs.

So at this point I'm stuck and out of ideas. Any assistance? Thanks!

Improve this question
2
  • binwalk output should be consider a guess. I really doubt you have multiples YAFFS that are distant by 18 bytes, it does not make any sense.
    – tibar
    Mar 22, 2017 at 9:33
  • Entropy of file "SlingboxSoloFwV2_1_110HwV1_0_3Current.bin" does not show a kind of compressed filesystem, rather shows plain data with code structure, strings and so on...
    – numind
    Jan 16, 2018 at 16:43

1 Answer 1

Reset to default
1

you have to use the latest binwalk 2.1.1, download the zip file from GitHub, binwalk support extracting yaffs now but I don't advise using binwalk like that, just use binwalk -e <img.bin> then scan the result files till you find your target yaffs image, then use yaffshiv to extract the image and don't forget to use the -a parameter for yaffshiv to try to guess the config of the image,

yaffshiv -a -f <image file> -d <output directory>

I'm trying to repack the Huawei E5172 firmware but the router refuses to accept the modified firmware, I hope this helps anyway and if you have any other ideas for packing such firmware please let me know.

Improve this answer
3
  • Thanks for the advice - didn't work though. Err.. formatting in comments is impossible(!) sorry. Basically, it had the same output as in my original question with binwalk. Created 1 file. Yaffshiv said Auto-detection failed: Could not locate start of spare data section. Found 0 file objects with the following YAFFS settings: Page size: 2048 Spare size: 64 ECC layout: True Endianess: Little
    – justin
    Jan 21, 2017 at 12:58
  • what version of binwalk do you use? I've scanned the bin file with a different output: 2971856 0x2D58D0 SHA256 hash constants, little endian 3000600 0x2DC918 Base64 standard index table 3302671 0x32650F HTML document header 3302714 0x32653A HTML document footer 3358301 0x333E5D XML document, version: "1.0" 3376275 0x338493 XML document, version: ""1." so there is no yaffs image (unless in the SHA256 section which I don't know how to decrypt).
    – M-Dahab
    Jan 22, 2017 at 13:49
  • Binwalk v2.1.1. Not a big deal though, I've moved on.
    – justin
    Jan 22, 2017 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.