1

TL;DR:

Trying to mount extracted ubi file system onto /dev/mtd0 gives me the error:

libscan: scanning eraseblock 323 -- 100 % complete  
ubiformat: 324 eraseblocks are supposedly empty
ubiformat: error!: file "340D04.ubi" (size 42467348 bytes) is not multiple of eraseblock size (131072 bytes)
           error 0 (Success)

How do I get that thing flashed?

Longer version:

I am looking to reverse the firmware for an Arris modem firmware, comparing older versions of the firmware to newer ones. I want to get access to the webroot of the little web server that runs the firmware because I think there is a bug in it.

In this older version, binwalk gives me this:

> binwalk spTurquoise210-700_1.6.9.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
544           0x220           Certificate in DER format (x509 v3), header length: 4, sequence length: 985
1533          0x5FD           Certificate in DER format (x509 v3), header length: 4, sequence length: 1246
3332          0xD04           JFFS2 filesystem, little endian
3411204       0x340D04        UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x800, data offset: 0x1000

Extracting this binwalk -e spTurquoise210-700_1.6.9.bin yields:

total 166M
drwxr-xr-x 3 root    root    4.0K Mar  5 16:10 .
drwxr-xr-x 4 michael michael 4.0K Mar  5 16:10 ..
-rw-r--r-- 1 root    root     43M Mar  5 16:10 220.crt
-rw-r--r-- 1 root    root     39M Mar  5 16:10 340D04.ubi
-rw-r--r-- 1 root    root     43M Mar  5 16:10 5FD.crt
-rw-r--r-- 1 root    root     43M Mar  5 16:10 D04.jffs2
drwxr-xr-x 3 root    root    4.0K Mar  5 16:10 jffs2-root

The contents of jffs2-root don't reveal the webroot. I have mounted the D04.jffs2 image, and it appears to be identical to the extracted jffs2-root directory contents. It appears to be the upgrader that flashes the firmware.

So, I figure I'll check the 340D04.ubi image. To mount that and check it, I:

> rmmod mtdram
> du -sk 340D04.ubi
39812   340D04.ubi
> modprobe mtdram total_size=39812
> flash_erase /dev/mtd0 0 0
> ubiformat /dev/mtd0 -f 340D04.ubi

That's where I've hit a problem. The output of the ubiformat command is:

libscan: scanning eraseblock 323 -- 100 % complete  
ubiformat: 324 eraseblocks are supposedly empty
ubiformat: error!: file "340D04.ubi" (size 42467348 bytes) is not multiple of eraseblock size (131072 bytes)
           error 0 (Success)

I cannot figure out how to flash the ubi file system onto the mtd0 device so I can (later) mount it.

Images:

2

ubireader_extract_files from https://github.com/jrspruitt/ubi_reader can extract the UBI if it is padded with zeroes to the expected size.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.