3

After following the tutorial here, I decided I would try and reverse engineer my router's firmware. My router is the TP-Link TD-W8961N and the firmware version is V2.

I have been trying to figure this out for a while now, but have had no luck. The firmware does not contain any obvious filesystem, bootloader or kernel that can be extracted.

From the binwalk analysis, it seems that the router is running ThreadX on MIPS architecture.

Executing binwalk -eM TDW8961N, I get

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
63643         0xF89B          ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
63892         0xF994          ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
85043         0x14C33         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66696 bytes
118036        0x1CD14         Unix path: /usr/share/tabset/vt100:\
118804        0x1D014         ZyXEL rom-0 configuration block, name: "spt.dat", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
118824        0x1D028         ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16
128002        0x1F402         GIF image data, version "89a", 200 x 50
136194        0x21402         GIF image data, version "89a", 560 x 50
253333        0x3DD95         Neighborly text, "neighbor of your ADSL Router that will forward the packet to the destination. On the LAN, the gateway </font>e destination. On the LAN, the gateway </font>"
349586        0x55592         Copyright string: "Copyright (c) 2001 - 2015 TP-LINK TECHNOLOGIES CO., LTD."
386471        0x5E5A7         Copyright string: "Copyright &copy; 2015 TP-LINK Technologies Co., Ltd. All rights reserved."
386489        0x5E5B9         TP-Link firmware header, firmware version: 17256.26992.22113, image version: " Co., Ltd. All rights reserved.", product ID: 0x6E42746E, product version: 1131375727, kernel load address: 0x72002223, kernel entry point: 0x46463939, kernel offset: 4475203, kernel length: 1347765096, rootfs offset: 1768969317, rootfs length: 2020868163, bootloader offset: 1347747908, bootloader length: 1229148245
806847        0xC4FBF         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2853276 bytes


Scan Time:     2016-10-07 22:29:27
Target File:   /home/aaron/Desktop/tools/firmware/TD-W8961N/_TD-W8961N-0.extracted/14C33
MD5 Checksum:  feac8e40efcca119826f811501b36502
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------


Scan Time:     2016-10-07 22:29:27
Target File:   /home/aaron/Desktop/tools/firmware/TD-W8961N/_TD-W8961N-0.extracted/C4FBF
MD5 Checksum:  78c0c10cba8fba3ce1c194461ac40fa4
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
2141288       0x20AC68        Neighborly text, "neighbor loss) fail"
2144380       0x20B87C        ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 8313
2157896       0x20ED48        Neighborly text, "neighbordown: can't shutdown OSPF task completely"
2168474       0x21169A        ZyXEL rom-0 configuration block, name: "spt.dat", compressed size: 769, uncompressed size: 259, data offset from start of block: 28805
2249704       0x2253E8        HTML document footer
2250021       0x225525        HTML document header
2253724       0x22639C        XML document, version: "1.0"
2320029       0x23669D        Base64 standard index table
2332534       0x239776        ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 131
2332646       0x2397E6        Copyright string: "Copyright (c) 1994 - 2004 ZyXEL Communications Corp."
2332699       0x23981B        Copyright string: "Copyright (c) 2001 - 2006 TrendChip Technologies Corp."
2332754       0x239852        Copyright string: "Copyright (c) 2001 - 2006 "
2333095       0x2399A7        ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
2344978       0x23C812        eCos RTOS string reference: "ecost"
2393676       0x24864C        SHA256 hash constants, big endian
2395752       0x248E68        Base64 standard index table
2436753       0x252E91        ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 135
2454640       0x257470        ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 131
2495500       0x26140C        Base64 standard index table
2537620       0x26B894        XML document, version: "1.0"
2544124       0x26D1FC        XML document, version: "1.0"
2545312       0x26D6A0        XML document, version: "1.0"
2546280       0x26DA68        XML document, version: "1.0"
2551100       0x26ED3C        XML document, version: "1.0"
2555276       0x26FD8C        XML document, version: "1.0"
2558548       0x270A54        XML document, version: "1.0"
2563936       0x271F60        XML document, version: "1.0"
2569916       0x2736BC        XML document, version: "1.0"
2572052       0x273F14        XML document, version: "1.0"
2579160       0x275AD8        XML document, version: "1.0"
2595692       0x279B6C        XML document, version: "1.0"
2605172       0x27C074        XML document, version: "1.0"
2613932       0x27E2AC        XML document, version: "1.0"
2615368       0x27E848        XML document, version: "1.0"
2627752       0x2818A8        XML document, version: "1.0"
2648491       0x2869AB        Copyright string: "copyright"
2658067       0x288F13        Copyright string: "copyright" >"
2759380       0x2A1AD4        CRC32 polynomial table, big endian
2827145       0x2B2389        Unix path: /wifi_uni_mac/ROM/nic/hal/MT7603/hal_rom.c
2827593       0x2B2549        Unix path: /wifi_uni_mac/ROM/nic/hal/MT7603/hal_pwr_mgt_rom.c
2828329       0x2B2829        Unix path: /wifi_uni_mac/mgmt/mt7603/rlm_phy.c
2828385       0x2B2861        Unix path: /wifi_uni_mac/mgmt/mt7603/rlm_sensor.c
2852324       0x2B85E4        Copyright string: "Copyright (c) 1996-2010 Express Logic Inc. * ThreadX MIPS32_34Kx/Green Hills Version G5.4.5.0 SN: 3182-197-0401 *"

This creates two files 14C33 which, when running binwalk, gives no results and C4FBF which gives a similar output as binwalk TDW8961N. It also creates lots of xml files which are similar.

I opened the files 14C33 and C4FBF in a hex editor and noticed that the first two bytes were 3C 08. Running file on these two files returns

14C33: data
C4FBF: data

I Googled these two bytes and came to this page where I found that a zlib stream can start with 08 3C, although not common. After reading this, I changed the first two bytes so that they read 08 3C and file 14C33 returned

14C33: zlib compressed data

I did the same thing with the file C4FBF and when I try to decompress it, it fails. Using gzip, I get unknown suffix -- ignored. I also tried with uncompress and pigz, but they gave similar errors.

Is there something wrong with the zlib compressed data, is file giving a false positive or is there a custom compression algorithm? Also, I don't understand why there is a reference to both eCos and ThreadX OSes. And for the bootloader and kernel offset, is it the offset when the bootloader and kernel are loaded into memory?

The firmware can be downloaded at tp-link.com/en/download/TD-W8961N_V2.html#Firmware

3

I found the answer.

The router runs ZynOS and needed to be extracted using router-tools

Once downloaded, I ran the command

python zynos.py unpack TDW8961N to unpack the router frimware. All I had to do now was use binwalk -Y file to find out the architecture and then load the files into IDA and disassemble using

https://wiki.openwrt.org/doku.php?id=oldwiki:openwrtdocs:hardware:zyxel:p_335wt to figure out where to start the ROM.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.