0

When I run binwalk on a abs firmware that I'm trying to unpack, the output shows several "Unix path" entries

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
8661260       0x84290C        Certificate in DER format (x509 v3), header length: 4, sequence length: 14208
8757216       0x859FE0        Base64 standard index table
8808844       0x86698C        Base64 standard index table
8827264       0x86B180        SHA256 hash constants, little endian
8832168       0x86C4A8        SHA256 hash constants, little endian
8951496       0x8896C8        Base64 standard index table
9010196       0x897C14        SHA256 hash constants, little endian
9091512       0x8AB9B8        Base64 standard index table
9123428       0x8B3664        CRC32 polynomial table, little endian
9151395       0x8BA3A3        Copyright string: "Copyright 1995-2003 Jean-loup Gailly "
9151564       0x8BA44C        CRC32 polynomial table, little endian
9201972       0x8C6934        Copyright string: "Copyright (C) 2013, Thomas G. Lane, Guido Vollbeding"
9253344       0x8D31E0        Unix path: /usr/app/.vpn.key
9282390       0x8DA356        Copyright string: "Copyrights   : %s"
9342840       0x8E8F78        Unix path: /etc/Wireless/RT2870STA/e2p.bin
9354428       0x8EBCBC        Unix path: /etc/Wireless/RT2870AP/RT2870AP.dat
9357504       0x8EC8C0        XML document, version: "1.0"
9359180       0x8ECF4C        Unix path: /var/lib/share/MT7601/MT7601EEPROM.bin
9385369       0x8F3599        Copyright string: "copyright (c) 2001-8 by D.I. Management Services Pty Limited <www.di-mgt.com.au>, and is used with permission."
9400932       0x8F7264        HTML document header
9401331       0x8F73F3        HTML document footer
9403016       0x8F7A88        XML document, version: "1.0"
9440752       0x900DF0        Unix path: /usr/local/ssl/private
9450924       0x9035AC        Ubiquiti firmware header, third party, ~CRC32: 0x6974730A, version: "SSL_init"
9526724       0x915DC4        XML document, version: "1.0"
9528496       0x9164B0        XML document, version: "1.0"
9530608       0x916CF0        XML document, version: "1.0"
9531916       0x91720C        XML document, version: "1.0"
9534644       0x917CB4        XML document, version: "1.0"
9541444       0x919744        XML document, version: "1.0"
9545824       0x91A860        XML document, version: "1.0"
9547748       0x91AFE4        XML document, version: "1.0"
9552720       0x91C350        XML document, version: "1.0"
9557152       0x91D4A0        XML document, version: "1.0"
9573672       0x921528        XML document, version: "1.0"
9579428       0x922BA4        XML document, version: "1.0"
9611684       0x92A9A4        XML document, version: "1.0"
9613432       0x92B078        HTML document footer
9613440       0x92B080        HTML document header
9618912       0x92C5E0        XML document, version: "1.0"
10022232      0x98ED58        CRC32 polynomial table, little endian
10046884      0x994DA4        CRC32 polynomial table, little endian
10243368      0x9C4D28        JPEG image data, JFIF standard 1.01
10243398      0x9C4D46        TIFF image data, big-endian, offset of first image directory: 8
10249176      0x9C63D8        JPEG image data, JFIF standard 1.01
10249206      0x9C63F6        TIFF image data, big-endian, offset of first image directory: 8
10251812      0x9C6E24        PNG image, 120 x 120, 8-bit/color RGB, non-interlaced
10251903      0x9C6E7F        Zlib compressed data, compressed
10258248      0x9C8748        PNG image, 48 x 48, 8-bit/color RGB, non-interlaced

How to go about unpacking or mounting this filesystem, binwalk doesn't seem to be able to give a good result

binwalk --dd='.*' maincode.abs

Is there a way to mount this abs file?

abs file

1 Answer 1

4

The abs file seems to contain an RTOS (real-time OS) image. In this case the code and the resources are compiled into a one large image without a real file system. So, you can't unpack or mount any file system. But, you can extract some resources by reversing the image with a disassembler or using binwalk.

The unix paths found by binwalk are just strings in the image, which may are not used at all.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.