2

We are reverse engineering a QNX system and we have found a small file that is uploaded to the system. It appears to be either a file system image or an uncompressed archive of some sort. We can't figure out the check-summing it uses hence I cannot edit the file. I have multiple versions of this file and they all start with the same magic bytes. I have run binwalk and magic over the file and neither return anything interesting.

We also tried mounting it within a QNX vmware image however it said it was an incorrect format. In case I've dumped it wrong I will next check the linux QNX source code to confirm.

Any ideas if this is a file system image? The header seems to list file paths/names with padding which with my lack of knowledge I assume is some kind of resource manifest.

The magic header is 0x77FA77FA

Does anyone know what this file format is?

You can download the binary here: http://s000.tinyupload.com/index.php?file_id=81688472369674028404

enter image description here enter image description here enter image description here

Improve this question
4
  • What version of QNX? Did you find the binary which works with this file?
    – Igor Skochinsky ♦
    Oct 20, 2019 at 16:33
  • Unsure and unsure at this stage.
    – rollsch
    Oct 22, 2019 at 8:35
  • Well, what do you know then? Why do you need to extract this specific file?
    – Igor Skochinsky ♦
    Oct 22, 2019 at 8:38
  • We want to modify the config files and repack the file. Currently we can edit it, but the checksums don't match and it rejects it. We don't have access to the QNX system yet, only access to upload this file and nothing else so far. The QNX system is inside a dash cluster in a vehicle and costs a few $k to purchase one to pull apart and attempt to get root access so we are attempting to crack it this way before buying one.
    – rollsch
    Oct 23, 2019 at 12:40

1 Answer 1

Reset to default
5

Although some clues on the file's origin could be useful, the format seems to be pretty simple so can be deduced from the sample. It is not a full-fledged filesystem but a simple archive/package.

First, the file's header:

struct Header
{
  uint32 signature;  // 0xFA77FA77
  uint32 data_start; // offset of the start of file's data
  uint32 timestamp;  // possibly file's creation time.649953358 corresponds to August 6, 1990 2:35:58 PM
  uint32 data_end;   // offset of the end of file's data
  uint32 checksum;   // possibly checksum (CRC-32?)
  uint32 num_files;  // number of file entries following the header (52)
  uint32 field_18;   // unknown (0)
  uint32 field_1C;   // unknown (0xFFFF)
};

It is followed by num_files records for the files, 0x100 bytes each:

struct FileRecord
{
  char name[224]; //file path (0-padded)
  uint32 offset;  // offset to data(from header.data_start)
  uint32 size;       // size of data
  uint32 field_E8;   // unknown (0); possibly high half of 64-bit size
  uint32 checksum;   // possibly checksum (CRC-32?)
  uint32 field_F0;   // unknown (0)
  uint32 field_F4;   // unknown (0)
  uint32 field_F8;   // unknown (1)
  uint32 field_FC;   // unknown (2)
};

Based on this, creating an extractor should be trivial.

Improve this answer
2
  • Thanks. The issue is not so much unpacking (as you showed it is fairly trivial) but rather repacking the file. As we don't have the client binary which reads this file in we don't know how to regenerate the checksum. We could try a bunch of common checksumming routines, but I was hoping there was a simple answer to the 0xFA77FA77 magic number. As it seems it is some proprietary format we will have to attempt to get the client executable or brute force the checksum routine until we find what it uses (might be a simple CRC).
    – rollsch
    Oct 23, 2019 at 12:37
  • 1
    I would try to search through QNX binaries for 0xFA77FA77 magic number. The file must be processed by something, thus there must be the code, which verifies the signature. That BMW Infotainment system must somehow parse this KAFAS configuration package.
    – Anton Kukoba
    Oct 24, 2019 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.