Extracting firmware BIN file

Question

I'm trying to extract this firmware to check whats inside, but can't find how to tackle this file. I was only able to extract and read PNG image.

Binwalk scan:

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------
199536      0x30B70     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 392072 bytes
348272      0x55070     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 10362880 bytes
994916      0xF2E64     LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 10211328 bytes
3911705     0x3BB019    LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 220534 bytes
4078426     0x3E3B5A    LZMA compressed data, properties: 0x03, dictionary size: 65536 bytes, uncompressed size: 1 bytes
4078457     0x3E3B79    LZMA compressed data, properties: 0x03, dictionary size: 65536 bytes, uncompressed size: 1 bytes
4092314     0x3E719A    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes
4098794     0x3E8AEA    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes
4100954     0x3E935A    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes
4103114     0x3E9BCA    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes
4105274     0x3EA43A    LZMA compressed data, properties: 0x40, dictionary size: 4194304 bytes, uncompressed size: 16384 bytes
4121895     0x3EE527    LZMA compressed data, properties: 0x0C, dictionary size: 4194304 bytes, uncompressed size: 50 bytes
4141086     0x3F301E    TIFF image data, big-endian
4141279     0x3F30DF    LZMA compressed data, properties: 0x04, dictionary size: 16777216 bytes, uncompressed size: 196608 bytes
4141359     0x3F312F    LZMA compressed data, properties: 0x04, dictionary size: 16777216 bytes, uncompressed size: 520683520 bytes
4145070     0x3F3FAE    LZMA compressed data, properties: 0x0C, dictionary size: 16777216 bytes, uncompressed size: 61503 bytes
4263936     0x411000    PNG image, 924 x 520, 8-bit/color RGBA, non-interlaced

How to tackle this binary? Is it even possible to get everything from it?

Firmware file is here if someone what to try it.

Answer 1

Binwalk performed a good work in this firmware file, but found too much parts. It worth to know, that Binwalk identifies types based on magic IDs and some other properties. In a typical firmware the parts are stored in compressed and may be in encrypted form. It means, there are some high entropy parts, which possible will not contain any known file type magic ID.

If you see the firmware file with a hex editor, you may see that it contains distinct parts (separated by a lots of 00 or FF bytes):

0x1000-0x55000: Seems to be a bootloader started with an executable part, which was followed by a compressed part from 0x8000.
0x55000-0x3B984F: Main program
0x3B99EC: Various data parts

In general firmware parts starts with a header, so let's see the header of the main program:

I marked the part name with blue, the size of the part with green and the LZMA header with yellow. As you can see the LZMA header contains the decompressed size (0x9e2000 = 10362880), but does not contain the compressed size. So, without any knowledge of the header, you can not determine the end of the compressed data, but only guess (for example from the entropy).

We found the main program part, but Binwalk gave a lot more results, so let's check whether other LZMA parts are valid (I changed the description in the original result).

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------
199536      0x30B70     Valid LZMA compressed data containing part of the bootloader or OTA loader
348272      0x55070     Valid LZMA compressed data containing part of the main program
994916      0xF2E64     Valid LZMA compressed data containing other part of the main program
3911705     0x3BB019    Valid LZMA compressed data
4078426     0x3E3B5A    Not LZMA compressed data
4078457     0x3E3B79    Not LZMA compressed data
4092314     0x3E719A    Not LZMA compressed data
4098794     0x3E8AEA    Not LZMA compressed data
4100954     0x3E935A    Not LZMA compressed data
4103114     0x3E9BCA    Not LZMA compressed data
4105274     0x3EA43A    Not LZMA compressed data
4121895     0x3EE527    Not LZMA compressed data
4141086     0x3F301E    TIFF image data, big-endian
4141279     0x3F30DF    Not LZMA compressed data
4141359     0x3F312F    Not LZMA compressed data
4145070     0x3F3FAE    Not LZMA compressed data
4263936     0x411000    PNG image, 924 x 520, 8-bit/color RGBA, non-interlaced

So, Binwalk identified correctly the first four LZMA compressed part and I think it extracted correctly also. Other parts marked with LZMA compressed data are false positives, because it is an uncompressed data area, which contains low entropy data, which sometimes similar to an LZMA header.

I'd like to draw your attention to the part started at 0xf2e64. As I stated previously this area should be in the main part based on the header analysis. However, there is a separated compressed part after the first compressed image. If you check the header again, there is the offset of this second part at 0x55028. So, it seems that the main image contains at least two separate parts.