2

I want to unpack the fortigate firmware - FGT_110C-v400-build0092-FORTINET.out. binwalk only gives a hint about gzip compressed data.

~/Documents# binwalk -i FGT_110C-v400-build0092-FORTINET.out 

DECIMAL     HEXADECIMAL    DESCRIPTION
--------------------------------------------------------------------------------
  0            0x0         gzip compressed data, has original file name: 
                           "FG110C-4.00-FW-build092-090220-patch00", from Unix,
                           last modified: Fri Feb 20 18:00:29 2009

These is no other output. How can I unpack the firmware?

I uploaded the firmware here.

Improve this question
3
  • With gzip? It looks like you're on Windows, so you could also try 7z which supports gzip decompression too.
    – Rup
    Sep 13, 2017 at 7:30
  • it is on linux,with the binwalk, and the binwalk output is gzip compressed data. I upload the bin these www52.zippyshare.com/v/7RyFqBJy/file.html
    – Devid Lee
    Sep 14, 2017 at 2:35
  • How does the patch00 file relate to the .out file you are talking about. I downloaded it, it seems very regular, if you make a hexdump of 64 bytes wide, you will notice. Probably it is xorred with a fixed 64 byte string.
    – Willem Hengeveld
    Sep 14, 2017 at 7:26

2 Answers 2

Reset to default
1

Main part of fortigate firmware is a /bin/init executable, most of other files are just symbolic links to it. So, you can obtain this file (or any other file of interest) from device or VM using fnsysctl and exec backup commands, together with the configured tftp-server. In my case it looks like this:

#> fnsysctl cp /bin/init /var/log/root/mlog.0
#> exec backup disk log tftp AA.BB.CC.DD anomaly

Then, rename the received file on the tftp-server.

Improve this answer
-1

binwalk -e extracts it just fine.

You'll need https://github.com/sviehb/jefferson though, later.

Improve this answer
3
  • Could you elaborate a little more? why is the -e flag useful? etc.
    – NirIzr
    Jul 22, 2018 at 19:41
  • Because it tells binwalk to extract? These are basics: -e, --extract Automatically extract known file types
    – binaryanomaly
    Jul 23, 2018 at 13:14
  • 2
    Can you include that as part of your answer?
    – NirIzr
    Jul 23, 2018 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.