How to extract the OS files from this firmware bin file

Question

I am trying to change settings of one modem we have in work. I tried binwalk and FMK and they cannot extract anything. The output of binwalk seems false positive:

binwalk modem.bin 

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------
1226103     0x12B577    LZMA compressed data, properties: 0x04, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
1403399     0x156A07    LZMA compressed data, properties: 0x01, dictionary size: 33554432 bytes, uncompressed size: 67108864 bytes
1403495     0x156A67    LZMA compressed data, properties: 0x88, dictionary size: 33554432 bytes, uncompressed size: 553648128 bytes

binwalk -e modem.bin 

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------
WARNING: Extractor.execute failed to run '7zr e -y '12B577.7z'': [Errno 2] No such file or directory
1226103     0x12B577    LZMA compressed data, properties: 0x04, dictionary size: 16777216 bytes, uncompressed size: 33554432 bytes
WARNING: Extractor.execute failed to run '7zr e -y '156A07.7z'': [Errno 2] No such file or directory
1403399     0x156A07    LZMA compressed data, properties: 0x01, dictionary size: 33554432 bytes, uncompressed size: 67108864 bytes
WARNING: Extractor.execute failed to run '7zr e -y '156A67.7z'': [Errno 2] No such file or directory
1403495     0x156A67    LZMA compressed data, properties: 0x88, dictionary size: 33554432 bytes, uncompressed size: 553648128 bytes

And FMK gave me: No supported file system found! Aborting...

I do not think it is encrypted because strings gave many words. All I know about this firmware is that it is operating system is pSOS 2.1 and runs on Motorola/Freescale PowerQUICC MPC860....

Can some one look at the file and help me extract it?

The BIN File

Also I have a .map file for the modem which may be sent by mistake and it it is listing files Do not know what is the knid of this file??!! .map file

Answer 1

The firmware file is a raw binary image probably ment to be directly written to flash. It is uncompressed. To load it into IDA simply select ppc processor (PowerQUICC is a type of Power Architecture and thus is supported by the ppc disassembler) As for the map file - it's debug info. wiki explains..

Debugging maps. These are typically plain text files that indicate the relative offsets of functions for a given version of a compiled binary.

in order to properly view it in IDA you must find the correct loading address (many ways to find it, read about the processor memory map).

---

keep in mind that since this is a raw binary image IDA does a poor job decompiling it by itself (no headers to tell it where the code is..). You need to help (preferably) using IDAPython to manually define the function. The functions can be identified by the call and return convention: one possible calling convention for this architecture:

stwu      r1, -0x18(r1)
mflr      r0

*0x18 will change from function to function based on the required stack size. and return:

blr

Answer 2

Uncompressed size of 553 MB on a 1.4 MB file suggests it's probably a false positive.

Non-uniform entropy and a lot of strings also mean this file isn't packed at all:

$ strings modem.bin | tail
tcp_output
tcp_output REXMT
tcp_usrreq
pNA+ NI Loopback Driver
33333
~(JEN
UUUUU>
>f7ir
shutdown requested
Libra - unknown destination instrument ID

This file likely contains machine code, try loading it into a disassembler as is.