0

I tried to unpack binary which is SquashFS system, the file is mtd partition copied from NAND device, Root filesystem (read-only). Actually its SquashFS version, modifyed/patched by vendor. binwalk show:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, non-standard signature, version 3.1, size: 8372772 bytes, 1028 inodes, blocksize: 131072 bytes, created: 2017-08-02 06:39:51

First I tried to unsquash it use unsquashfs utility, compiled from the source, provided by vendor in their GPL release, but not works. (more precisely, the GPL source is for the previous version of F/W release, whereas I have a more recent F/W version)

./unsquashfs mtd4.bin
Parallel unsquashfs: Using 4 processors
Lseek failed because Invalid argument
sqlzma_un: ZLIB data error
Aborted

Tried also use sasquatch utility:

sasquatch mtd4.bin
SquashFS version [3.1] / inode count [1028] suggests a SquashFS image of the same endianess
Non-standard SquashFS Magic: shsq
Parallel unsquashfs: Using 1 processor
Lseek failed because Invalid argument
read_block: failed to read block @0x92e6f69dab953c47
read_fragment_table: failed to read fragment table block
FATAL ERROR:failed to read fragment table

Can anybody advice how to unpack file?

|improve this question
  • Try this: Read 0x200 data and delete 0x10. There are dummy 0x10 blocks each 0x200 bunch of data so try to make a program for this case and clean this file, then try again to deflate, just test deflate with 7zip.. – numind May 16 at 11:39
  • Can you be more detailed? You mean blocks at the end of the file, i.e. data at offset 0x83C20F, 0x83C41E, etc? I'm not sure where the actual code ends, at 0x83FFF0? – minto May 18 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.