3

Ok, so I have been trying to dump the contents of a Technicolor TG799vac.

So far I have removed the flash chip and read out the chip using the DumpFlash.py utility and used binwalk to locate the Squashfs File system

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
39436         0x9A0C          SHA256 hash constants, big endian
31764480      0x1E4B000       JFFS2 filesystem, big endian
32013764      0x1E87DC4       JFFS2 filesystem, big endian
32242272      0x1EBFA60       JFFS2 filesystem, big endian
36765696      0x2310000       Squashfs filesystem, little endian, version 4.0, compression:xz, size: 14928222 bytes, 3253 inodes, blocksize: 262144 bytes, created: 2016-06-28 03:08:22
51709334      0x3150596       xz compressed data
51855814      0x31741C6       xz compressed data
51922474      0x318462A       xz compressed data
52004354      0x3198602       xz compressed data
52046150      0x31A2946       xz compressed data
52047662      0x31A2F2E       xz compressed data
52091472      0x31ADA50       xz compressed data
52093306      0x31AE17A       xz compressed data
52095388      0x31AE99C       xz compressed data
52097286      0x31AF106       xz compressed data
52099504      0x31AF9B0       xz compressed data
52101750      0x31B0276       xz compressed data
52103748      0x31B0A44       xz compressed data
52106574      0x31B154E       xz compressed data
52108628      0x31B1D54       xz compressed data
52110506      0x31B24AA       xz compressed data
52112416      0x31B2C20       xz compressed data
52114650      0x31B34DA       xz compressed data
52116652      0x31B3CAC       xz compressed data
52118514      0x31B43F2       xz compressed data
52118772      0x31B44F4       xz compressed data
52122718      0x31B545E       xz compressed data
52126772      0x31B6434       xz compressed data
52131218      0x31B7592       xz compressed data
52135620      0x31B86C4       xz compressed data
52138550      0x31B9236       xz compressed data
52141480      0x31B9DA8       xz compressed data
52144930      0x31BAB22       xz compressed data
52148772      0x31BBA24       xz compressed data
52152506      0x31BC8BA       xz compressed data
52153220      0x31BCB84       xz compressed data
52153882      0x31BCE1A       xz compressed data
52155856      0x31BD5D0       xz compressed data
52157758      0x31BDD3E       xz compressed data
52159824      0x31BE550       xz compressed data
137234956     0x82E0A0C       SHA256 hash constants, big endian

I used dd to extract the Image:

$ dd  if=Modem.img bs=1 skip=36765696 count=14928222 of=Modem.squashfs
14928222+0 records in
14928222+0 records out
14928222 bytes (15 MB) copied, 22.0777 s, 676 kB/s

I tried to unsuqashfs the image:

$ unsquashfs -s Modem.squashfs
Found a valid SQUASHFS 4:0 superblock on Modem.squashfs.
Creation or last append time Tue Jun 28 13:08:22 2016
Filesystem size 14578.34 Kbytes (14.2 Mbytes)
Compression xz
xz: error reading stored compressor options from filesystem! 
Block size 262144 
Filesystem is exportable via NFS                                                                           Inodes are compressed
Data is compressed                                                                    Fragments are compressed                                                                  Always-use-fragments option is not specified                                                                     Xattrs are not stored                                                                        Duplicates are Removed                                                                       Number of fragments 85                                                                            Number of inodes 3253                                                                         Number of ids 1

$ unsquashfs -d squash-root1  Modem.squashfs
Parallel unsquashfs: Using 4 processors
Lseek failed because Invalid argument
read_block: failed to read block @0x71eed2525ee8f30e
read_uids_guids: failed to read id table block
FATAL ERROR:failed to uid/gid table

But, it failed. So, I tried to extract with firmware-mod-kit:

$ ./unsquashfs_all.sh ~/projects/Telstra/DumpFlash/Modem.squashfs ~/projects/Telstra/DumpFlash/Squashfs/

Attempting to extract SquashFS .X file system...

Trying ./src/squashfs-2.1-r2/unsquashfs-lzma... 
Trying ./src/squashfs-2.1-r2/unsquashfs... 
Trying ./src/squashfs-3.0/unsquashfs-lzma... 
Trying ./src/squashfs-3.0/unsquashfs... 
Trying ./src/squashfs-3.0-lzma-damn-small-variant/unsquashfs-lzma... 
Trying ./src/others/squashfs-2.0-nb4/unsquashfs... 
Trying ./src/others/squashfs-3.0-e2100/unsquashfs-lzma... 
Trying ./src/others/squashfs-3.0-e2100/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-hg612-lzma/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-wnr1000/unsquashfs... 
Trying ./src/others/squashfs-3.2-r2-rtn12/unsquashfs... 
Trying ./src/others/squashfs-3.3/unsquashfs... 
Trying ./src/others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools/unsquashfs... 
Trying ./src/others/squashfs-3.3-grml-lzma/squashfs3.3/squashfs-tools/unsquashfs... 
Trying ./src/others/squashfs-3.4-cisco/unsquashfs... 
Trying ./src/others/squashfs-3.4-nb4/unsquashfs-lzma... 
Trying ./src/others/squashfs-3.4-nb4/unsquashfs... 
Trying ./src/others/squashfs-4.2-official/unsquashfs... Parallel unsquashfs: Using 4 processors
Trying ./src/others/squashfs-4.2/unsquashfs... Parallel unsquashfs: Using 4 processors
Trying ./src/others/squashfs-4.0-lzma/unsquashfs-lzma... Parallel unsquashfs: Using 4 processors
Trying ./src/others/squashfs-4.0-realtek/unsquashfs... Skipping others/squashfs-hg55x-bin (wrong version)...
File extraction failed!

I also tried sasquatch:

$ sasquatch  -trace Modem.squashfs 
squashfs: read_bytes: reading from position 0x0, bytes 32
SquashFS version [4.0] / inode count [3253] suggests a SquashFS image of the same endianess
squashfs: read_bytes: reading from position 0x0, bytes 96
squashfs: read_bytes: reading from position 0x60, bytes 2
squashfs: read_block: block @0x60, 12 uncompressed bytes
squashfs: read_bytes: reading from position 0x62, bytes 12
Parallel unsquashfs: Using 1 processor
squashfs: read_uids_guids: no_ids 1
squashfs: read_bytes: reading from position 0xe3c956, bytes 8
squashfs: read_bytes: reading from position 0x71eed2525ee8f30e, bytes 2
Lseek failed because Invalid argument
read_block: failed to read block @0x71eed2525ee8f30e
read_uids_guids: failed to read id table block
FATAL ERROR:failed to uid/gid table

But still no joy. :-(

Can anyone offer any advice or maybe point out any mistakes as I am new to this all and still learning any tips or pointers would be a great help.

2 Answers 2

1

Ok I managed to get it to extract.... Yay

As it turns out when I did the NAND dump I also dumped the OOB part of the NAND.
So I had to run it through Jean-Michel Picod's Nand-dump-tool.py program to separate out the OOB area.

$ python Nand-dump-tool.py  -i ModemRaw.img -o Split_seperate.img -I
01f1801d  --layout separate

[*] Using given ID code ID code  : 01f1801d
Manufacturer                     : AMD / Spansion
Device                           : NAND 128MiB 3,3V 8-bit
Die/Package                      : 1
Cell type                        : 2 Level Cell
Simultaneously programmed paged  : 1
Interleave between multiple chips: False
Write cache                      : True
Page size                        : 2048 bytes (2 K)
Spare area size                  : 16 bytes / 512 byte
Block size                       : 131072 bytes (128 K)
Organization                     : X16
Serial access time               : 29 ns
OOB size                         : 64 bytes

[*] Start dumping...
[*] Finished

Total: 138412032 bytes (132.00 MB)
Data : 134217728 bytes (128.00 MB)
OOB  : 4194304 bytes (4.00 MB)
Clear: 86.69% of the flash is empty (56813 pages out of 65536)

Once that was done running it through binwalk again gave me a much more sensible output and a extracted File System...

1
  • Could you please add URL to the python script, thanks.
    – tibar
    Jun 12, 2017 at 18:45
0

I recommend you to try to find out, why unsquashing does fail. As you can read in sasquatch README:

The sasquatch project is a set of patches to the standard unsquashfs utility (part of squashfs-tools) that attempts to add support for as many hacked-up vendor-specific SquashFS implementations as possible.

So you might just found an unsupported implementation. Try to find, why sasquatch is failing to Lseek. Read the squashfs design papers. Maybe the structures was adjusted, and you just need to change the offset to some pointer.

This is what reverse engineering is about. Digging in the code. Not blindly using someone else's tools :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.