I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite showing a default value of 1480, all interfaces are stuck at 1500 which has caused some navigation issues. Whilst I have brought this to the attention of TP-Link I would rather try to patch this quickly and wait to see if and when they release a fixed version of the firmwares.
Below you can see the gui setting and the ifconfig from Telnet
The config files also confirms it should be 1400 on the ppp0 interface:
Finally I have set my NIC to 1420 and my navigation issues are resolved. When returning back to 1500 the issue returns.
I have tried to reverse engineer the following firmware files with no luck:
I have seen the following guide which shows the process very clearly, however, this guide is for v5 and it seems in v5 they used a squash filesystem and have since changed for newer versions.
When I do a binwalk for the three files I am trying I see the same output (or close enough):
I have literally just started trying to do and learn this stuff so forgive any stupidity from here.
I have tried a few tools:
- Firmware Modification kit - extract-firmware.sh
- Firmware Modification kit - extract-ng.sh
- Firmware Modification kit - old-extract.sh
- Firmware Modification kit - tpl-tool
I have tried multiple sources of the firmware modification kit. I have also tried router tools zynos.py, but as I understand the ZynOS is not used on this device.
All either fail or result in a message stating it is unsupported.
I am presuming that from the binwalk output the file system is ecosFS from the line:
768 0x300 eCos RTOS string reference: "eCosFS"
I have done some research and I see ecosfs is a file system and possibly related to Yffs which I believe Firmware Modification Kit was capable of, but this is the first I have heard of this file system. Can anyone advise what can be done to unpack and repack a firmware like this, are there any tools specific to ecosfs that are necessary?
I have literally turned google purple trying to wrap my head around this and could do with a push in the right direction.
Update 03-08-2017 I can now see (maybe more understand), that the original extraction using binwalk gave me a 7zip file of the LZMA data 6223D.7z. I have extracted this file and I have a data file. If I run binwalk on this I see more mention of eCos, VxWorks and little/big endian. This would lead me to suspect I am getting further.
