2

This is not my expertise so forgive stupidity. I have the following Firmware.

I am trying to extract the file sytem with binwalk, which results in a few extracted files and directories. Specifically I have a directory called jffs2-root/fs_1. When looking at the folder I see three files:

version - Plain Text

version.list - Plain Text

The final file is vmlinux.lz. This appears tio be where the file system should be, however I cannot se how I can read this file.

I have checked the file with the file command and the output I get is:

vmlinux.lz: 8086 relocatable (Microsoft)

I have read that this means it is virtual memory, but I am unsure as to how to proceed. I have tried the vmlinux read on git by Linus, but this fails. Can anyone give me any pointers.

Edit

Here is a hex dump of the file vmlinux.lz Hexdump

  • Can you add a hex dump of some bytes at the beginning? I suspect “lz” may refer to some kind of compression. – Igor Skochinsky Oct 2 '18 at 21:15
  • @IgorSkochinsky I have provided an image of a hexdump, hopefully this is both corrcet and sufficient – The Humble Rat Oct 3 '18 at 10:04
  • The link to the firmware file is dead – julian Oct 3 '18 at 12:35
  • 1
    @SYS_V I have put a new link with another provider. Should be permanent. – The Humble Rat Oct 3 '18 at 14:47
1

vmlinuz.lz contains the kernel image.

$ binwalk vmlinux.lz 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
12            0xC             LZMA compressed data, properties: 0x6D, dictionary size: 4194304 bytes, uncompressed size: 5227488 bytes

It is compressed, as Igor Skochinsky noted. Conveniently, we can use binwalk to decompress this file via binwalk -e vmlinux.lz.

In the newly created directory, there will be a file called C, named after the offset at which the LZMA signature was found (this is a file naming convention binwalk uses to name decompressed files). We can run a signature scan on file C:

$ binwalk C

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
3887212       0x3B506C        Linux kernel version "3.4.11-rt19 (huangyiran@dev198.sh.gj.com) (gcc version 4.6.2 (Buildroot 2011.11) ) #1 SMP PREEMPT Thu Jul 27 10:17:17 CST 2017"
3905080       0x3B9638        gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
4130388       0x3F0654        CRC32 polynomial table, big endian
4132556       0x3F0ECC        CRC32 polynomial table, big endian
4491592       0x448948        xz compressed data
4572996       0x45C744        Unix path: /home/huangyiran/BCM/bcm96838_416L03/bcmdrivers/broadcom/char/bpm/bcm96838/bpm.c
4576196       0x45D3C4        Unix path: /home/huangyiran/BCM/bcm96838_416L03/shared/opensource/drivers/bcm_misc_hw_init_impl3.c
4607028       0x464C34        Neighborly text, "NeighborSolicits6InDatagrams"
4607048       0x464C48        Neighborly text, "NeighborAdvertisementsorts"
4610379       0x46594B        Neighborly text, "neighbor %.2x%.2x.%pM losttime expired for %s -- IGNORING!"
4818896       0x4987D0        CRC32 polynomial table, little endian

According to this output, this file is a kernel binary. Let's check a few things just to be sure.

Running an entropy scan on file C shows that it likely contains a great deal of object code:

Zyxel kernel

Running a signature scan try to identify the architecture produces over 13,000 hits for MIPS:

$ binwalk -A C | cat -n | tail
 13075  5219200       0x4FA380        MIPS instructions, function epilogue
 13076  5219256       0x4FA3B8        MIPS instructions, function epilogue
 13077  5219564       0x4FA4EC        MIPS instructions, function epilogue
 13078  5219720       0x4FA588        MIPS instructions, function epilogue
 13079  5219796       0x4FA5D4        MIPS instructions, function epilogue
 13080  5220040       0x4FA6C8        MIPS instructions, function epilogue
 13081  5220296       0x4FA7C8        MIPS instructions, function epilogue
 13082  5220724       0x4FA974        MIPS instructions, function epilogue
 13083  5220812       0x4FA9CC        MIPS instructions, function epilogue
 13084

Additional inforation can be attained by running binwalk -e C to extract the gzip compressed data at offset 0x3B9638 and examine it:

# Automatically generated file; DO NOT EDIT.
# Linux/mips 3.4.11 Kernel Configuration            <---------------
CONFIG_MIPS=y                                       <--------------- 
# Machine selection
CONFIG_ZONE_DMA=y
# CONFIG_MIPS_ALCHEMY is not set
# CONFIG_AR7 is not set
# CONFIG_ATH79 is not set
# CONFIG_BCM47XX is not set
# CONFIG_BCM63XX is not set
CONFIG_MIPS_BCM963XX=y                              <-- This looks interesting
# CONFIG_MIPS_COBALT is not set
# CONFIG_MACH_DECSTATION is not set
# CONFIG_MACH_JAZZ is not set
# CONFIG_MACH_JZ4740 is not set
.
.
<snip>

Some of the strings in the kernel binary (file "C") are interesting as well:

$ strings -n 9 C | head -25
"X`&DXd$B
&L  P&K X&J `&I h&H 
B* &R* $P
0!%JUU%)33%
initcall_debug
%s version %s (huangyiran@dev198.sh.gj.com) (gcc version 4.6.2 (Buildroot 2011.11) ) %s
Linux version 3.4.11-rt19 (huangyiran@dev198.sh.gj.com) (gcc version 4.6.2 (Buildroot 2011.11) ) #1 SMP PREEMPT Thu Jul 27 10:17:17 CST 2017
pause_on_oops
<2>BUG: recent printk recursion!
printk.console_suspend
printk.always_kmsg_dump
printk.time
printk.ignore_loglevel
deprecated_sysctl_warning
print_dropped_signal
orderly_poweroff
7select_fallback_rq
K?xpm_qos_update_request_timeout
sys_init_module
3.4.11-rt19 SMP preempt mod_unload MIPS32_R1 32BIT        <---- architecture info
]\iIgS1)Y
spurious.irqfixup
spurious.noirqdebug
rcutree.rcu_cpu_stall_timeout
rcutree.rcu_cpu_stall_suppress
.
.
<snip>
  • This is more info that I could have hoped for. Whilst I don't understand some of it, I will certainly enjoy figuring it out. Many thanks for taking the time to help. – The Humble Rat Oct 4 '18 at 9:58
  • @TheHumbleRat you are welcome. Good luck – julian Oct 4 '18 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.