8

I am trying to reverse engineer a TDw8960 v7 TP-Link router. Currently the router has a bug, whereby setting the MTU via the GUI has no affect. It seems regardless of the value placed here despite showing a default value of 1480, all interfaces are stuck at 1500 which has caused some navigation issues. Whilst I have brought this to the attention of TP-Link I would rather try to patch this quickly and wait to see if and when they release a fixed version of the firmwares.

Below you can see the gui setting and the ifconfig from Telnet MTU Gui

MTU Ifconfig

The config files also confirms it should be 1400 on the ppp0 interface: Config MTU

Finally I have set my NIC to 1420 and my navigation issues are resolved. When returning back to 1500 the issue returns. NIC MTU

I have tried to reverse engineer the following firmware files with no luck:

TD-W8960N(EU)_V7_160614.zip

TD-W8960N(EU)_V7_160118.zip

TD-W8960N(EU)_V8_170106.zip

I have seen the following guide which shows the process very clearly, however, this guide is for v5 and it seems in v5 they used a squash filesystem and have since changed for newer versions.

Inforge.net

When I do a binwalk for the three files I am trying I see the same output (or close enough): Binwalk

I have literally just started trying to do and learn this stuff so forgive any stupidity from here.

I have tried a few tools:

  • Firmware Modification kit - extract-firmware.sh
  • Firmware Modification kit - extract-ng.sh
  • Firmware Modification kit - old-extract.sh
  • Firmware Modification kit - tpl-tool

I have tried multiple sources of the firmware modification kit. I have also tried router tools zynos.py, but as I understand the ZynOS is not used on this device.

Router Tools

All either fail or result in a message stating it is unsupported.

I am presuming that from the binwalk output the file system is ecosFS from the line:

768           0x300           eCos RTOS string reference: "eCosFS"

I have done some research and I see ecosfs is a file system and possibly related to Yffs which I believe Firmware Modification Kit was capable of, but this is the first I have heard of this file system. Can anyone advise what can be done to unpack and repack a firmware like this, are there any tools specific to ecosfs that are necessary?

I have literally turned google purple trying to wrap my head around this and could do with a push in the right direction.

Update 03-08-2017 I can now see (maybe more understand), that the original extraction using binwalk gave me a 7zip file of the LZMA data 6223D.7z. I have extracted this file and I have a data file. If I run binwalk on this I see more mention of eCos, VxWorks and little/big endian. This would lead me to suspect I am getting further.

Ecos Binwalk

  • I have the same router and I notice I have the same issue for the MTU. I see that there was a firmware release 2 months ago (TD-W8960N(EU)_V7_170920), which doesn't list this MTU issue as resolved but I will try it anyway. – ldam Nov 13 '17 at 18:24
  • @Logan if my memory serves me correctly either this firmware or one supplied to me direct by Tp-Link support did eventually fix the issue. However, they had set the MTU to 1492 and this could not be changed, therefore whilst it fixed my problem the bug still exists. Unfotrunately every unit I have worked with seems to have problems. – The Humble Rat Nov 14 '17 at 11:23
  • It wouldn't let me flash the updated firmware last night, it kept saying "illegal image" so I haven't got anywhere with it. Ironically, 1492 is the correct MTU for my network. – ldam Nov 14 '17 at 11:59
  • @Logan just had a quick look through old emails and the firmware was provided by TP-Link support team and they had hardcoded the value to 1480 which should resolve your issue. I have put the file here: ufile.io/2e5hx as with any firmware file load this at your own risk. – The Humble Rat Nov 14 '17 at 12:15
  • Well, i had a first dirty look on TD-W8960N(EU)_V7_160614.zip After a few binwalk rounds it end up with few .tar files, which contain kernel image [I assume] and bunch of html files that related to WEB GUI. GUI that on first screenshot you posted related to pppoe.html file. This HTML page aggregate all nesessary parameters for /ifcgateway.cgi or /ntwksum2.cgi and parameter you looking for is 'pppMtu'. Worth to look at those more closely [grab them with telnet&&tftp] to understand how to handle the MTU problem. But this will require RE them at least :) – Denis Laskov Sep 3 '18 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.