The next step is extraction of the kernel and squashfs filesystem using the -e option when using binwalk. These extracted files can then be further analyzed. Running binwalk with the -A option on the bootloader and kernel files will provide clues about the instruction set architecture of the firmware. Performing an entropy scan with -E can be done to gain insight into the structure of the extracted files and is useful for identifying compressed or encrypted regions.
A variety of tools exist for the purpose of squashfs filesystem extraction, such as squashfs-tools and sasquatch
.
A good example of the methodology employed in firmware analysis can be found here: Reverse Engineering Firmware: Linksys WAG120N
Update after firmware download link was made available:
To ensure that binwalk can properly extract SquashFS filesystem images, follow these steps:
Install squashfs-tools:
sudo apt-get install squashfs-tools
In ~, clone sasquatch from github:
git clone https://github.com/devttys0/sasquatch.git
In ~/sasquatch, execute build.sh (check README.md to make sure all the dependencies are installed)
Also check the version of binwalk installed locally:
$ binwalk
Binwalk v2.1.2b
Craig Heffner, http://www.binwalk.org
Extraction
Compute md5sum of firmware binary:
$ md5sum FW_E1200v2.0.7.005_US_20160713_code.bin
eb3752a5b72ccb0c9a92079fab88663e FW_E1200v2.0.7.005_US_20160713_code.bin
Run binwalk signature scan to confirm output:
$ binwalk FW_E1200v2.0.7.005_US_20160713_code.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
32 0x20 TRX firmware header, little endian, image size: 7684096 bytes, CRC32: 0xB533F216, flags: 0x0, version: 1, header size: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x14FF20, rootfs offset: 0x0
60 0x3C gzip compressed data, maximum compression, has original file name: "piggy", from Unix, last modified: 2016-07-13 03:17:53
1376064 0x14FF40 Squashfs filesystem, little endian, non-standard signature, version 3.0, size: 6307458 bytes, 1721 inodes, blocksize: 65536 bytes, created: 2016-07-13 03:23:19
Output appears to match output in the original post.
Extraction:
$ binwalk -e FW_E1200v2.0.7.005_US_20160713_code.bin
Files are extracted to directory _FW_E1200v2.0.7.005_US_20160713_code.bin.extracted/:
$ file *
14FF40.squashfs: data
piggy: FoxPro FPT, blocks size 0, next free block index 15993608
squashfs-root: directory
Inside squashfs-root is the extracted filesystem:
$ ll squashfs-root/
total 88
drwxrwxrwx 13 user01 user01 4096 Jul 12 2016 ./
drwxr-xr-x 3 user01 user01 4096 Jun 26 15:16 ../
drwxr-xr-x 2 user01 user01 4096 Jul 12 2016 bin/
drwxr-xr-x 2 user01 user01 4096 Jul 12 2016 dev/
drwxrwxrwx 4 user01 user01 4096 Jul 12 2016 etc/
drwxr-xr-x 3 user01 user01 4096 Jul 12 2016 lib/
drwxr-xr-x 2 user01 user01 4096 Jul 12 2016 mnt/
drwxr-xr-x 2 user01 user01 4096 Jul 12 2016 proc/
drwxr-xr-x 2 user01 user01 12288 Jul 12 2016 sbin/
drwxr-xr-x 2 user01 user01 4096 Jul 12 2016 sys/
drwxr-xr-x 2 user01 user01 4096 Jul 12 2016 tmp/
drwxrwxrwx 6 user01 user01 4096 Jul 12 2016 usr/
lrwxrwxrwx 1 user01 user01 7 Jun 26 15:16 var -> tmp/var
drwxr-xr-x 32 user01 user01 28672 Jul 12 2016 www/
piggy
Running file against piggy produces a false positive:
piggy: FoxPro FPT, blocks size 0, next free block index 15993608
Running binwalk against piggy suggests that it contains Linux kernel code:
$ binwalk piggy
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
2617344 0x27F000 Linux kernel version "2.6.22 (zhang@sw3) (gcc version 4.2.3) #5 Tue Jun 7 18:33:13 HKT 2016"
2641040 0x284C90 CRC32 polynomial table, little endian
2656556 0x28892C CRC32 polynomial table, little endian
2852300 0x2B85CC Unix path: /usr/gnemul/riscos/
2854956 0x2B902C Unix path: /usr/lib/libc.so.1
2927975 0x2CAD67 Neighborly text, "NeighborSolicitsts"
2927999 0x2CAD7F Neighborly text, "NeighborAdvertisementsmp6OutDestUnreachs"
2928200 0x2CAE48 Neighborly text, "NeighborSolicitsirects"
2928228 0x2CAE64 Neighborly text, "NeighborAdvertisementssponses"
2930275 0x2CB663 Neighborly text, "neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)"
An entropy plot produced by binwalk -EJ piggy reveals a large contiguous area with an entropy of roughly .68:
This level of entropy is consistent with what is expected of regions containing object code.
We can make an educated guess about what the instruction set architecture of the binary is by running binwalk with the -A argument:
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
1788 0x6FC MIPSEL instructions, function epilogue
2636 0xA4C MIPSEL instructions, function epilogue
4540 0x11BC MIPSEL instructions, function epilogue
4932 0x1344 MIPSEL instructions, function epilogue
6092 0x17CC MIPSEL instructions, function epilogue
6476 0x194C MIPSEL instructions, function epilogue
6952 0x1B28 MIPSEL instructions, function epilogue
7040 0x1B80 MIPSEL instructions, function epilogue
8024 0x1F58 MIPSEL instructions, function epilogue
8392 0x20C8 MIPSEL instructions, function epilogue
9532 0x253C MIPSEL instructions, function epilogue
9840 0x2670 MIPSEL instructions, function epilogue
12552 0x3108 MIPSEL instructions, function epilogue
12682 0x318A MIPS instructions, function epilogue
12836 0x3224 MIPSEL instructions, function epilogue
13364 0x3434 MIPSEL instructions, function epilogue
The ISA is likely MIPS little-endian.
