16

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it:

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------
52          0x34        uImage header, header size: 64 bytes, header CRC: 0x1A27096C, created: Tue Nov 27 06:52:32 2012, image size: 3448768 bytes, Data Address: 0x80000000, Entry Point: 0x8023A000, data CRC: 0x584BBD98, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
116         0x74        LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2445108 bytes
983092      0xF0034     Squashfs filesystem, little endian, non-standard signature,  version 3.0, size: 2463170 bytes,  637 inodes, blocksize: 65536 bytes, created: Tue Nov 27 06:51:11 2012

Once extracted the file and checking it with hexdump I found the folowing magic number shsq:

00000000  73 68 73 71 7d 02 00 00  00 00 00 54 03 00 00 08  |shsq}......T....|
00000010  1c 71 b7 a0 12 71 b7 19  1f 73 00 18 03 00 00 00  |.q...q...s......|
00000020  38 72 10 00 c0 02 01 cf  54 b4 50 d4 0c 1f 10 00  |8r......T.P.....|
00000030  00 00 00 00 00 01 00 2c  00 00 00 02 00 a2 bf c2  |.......,........|
00000040  95 25 00 00 00 00 00 b6  95 25 00 00 00 00 00 be  |.%.......%......|

This is not the first time I found this header, but I couldn't find a solution for extract it.

Things I tried so far:

You can find further information of this issue in this link but without solution:

http://forums.modem-help.co.uk/viewtopic.php?t=9668

Anyone has idea about how to achieve this?

Improve this question
6
  • 1
    SquashFS has been hacked to support LZMA by many a vendor, so without more information on the vendor/model, it's hard to point to a definitive answer. Have you looked to see if the vendor has any GPL code released for this device (or others)? FWIW, the firmware-mod-kit was able to extract the squashfs image from the link in Igor Skochinsky's answer, which has the same magic bytes.
    – devttys0
    Jun 8, 2013 at 1:28
  • Actually firmware-mod-kit does support LZMA. I ran into a similar problem with a Zyxel router which also used a modified version of squashfs and managed to get around it, but the respective libs need to be available at compile time, IIRC.
    – 0xC0000022L ♦
    Jun 8, 2013 at 2:51
  • 1
    @Nucklear: are you trying to extract this on a 32 or 64 bit system? I've had issues with hacked up unsquashfs tools not working properly on 64 bit systems.
    – devttys0
    Jun 8, 2013 at 13:50
  • @devttys0 Hi, this is the vendor website for this model: buffalotech.com/products/wireless/single-band-routers/… I don't see any GPL code there, and I'm using a 64bits kali distro. I'm going to test it on a 32bits system and post here the result. Regards
    – Nucklear
    Jun 8, 2013 at 14:03
  • @devttys0 Yes, you were right the problem was doing it in a 64bits system, I prepared a 32bits VM and uncompresed it with squashfs-3.2-r2-lzma included on the last version of firmware-mod-kit
    – Nucklear
    Jun 8, 2013 at 14:41

2 Answers 2

Reset to default
6

0x73687371 is apparently a magic value used to indicate LZMA compression by some vendors.

I can't test it since I don't have the image but here's a blog post with some description and source code links which is supposed to handle it:

http://www.poppopret.org/?p=204

EDIT: after some struggle with the download site I was able to get the decrypted shsq binary. I could open it easily with 7-Zip 9.21 beta:

enter image description here

Presumably any later versions will work too.

You can find the source code for handling SquashFS in 7z922.tar.bz2, file CPP/7zip/Archive/SquashfsHandler.cpp so you can try to figure out why it works and what's wrong with other approaches.

Improve this answer
1
  • Hi Igor, thanks for your response but as you can see I posted a comment in that blog (Last comment) but that solution didn't work for me.
    – Nucklear
    Jun 8, 2013 at 9:41
1

Try the patch from: http://sourceforge.net/p/squashfs/patches/20/

It seems to work ok on an X86_64 Debian installation.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.