Problem with analyzing a JFFS2 Filesystem

Question

I extracted the content of a NAND Flash and analyzed it with binwalk.
Binwalk showed me that the dump contains a big endian JFFS2 filesystem. My next step was extracting the files into a directory. To do so I simply used binwalk.

binwalk -Me Dump

The problem is that binwalk usually creates an other directory that should contain all the folders and files of the filesystem and this is not working.
Binwalk creates the directory but it is empty. I have Jefferson installed as well as everything that is important for it to work and I tried to do the same thing with an other Dump that I found in the internet and it worked without any problem.

Later I found out that the byte order of my CPU is little endian. I don't know if that is causing the issue and to be honest I do not know if there is a way to change the byte order of the jffs2 file to try it out. Maybe someone knows more about that.

An other thing that keeps bothering me is the fact that when I use the file command to check the jffs2 file it simply returns "data".
Again I don't know if the endianness is causing this issue. What I can tell is when I checked the other dump that I found in the internet the jffs2 fs was in little endian and binwalk could create the directory with all the files and the file command also returned "jffs2 little endian" instead of just "data".

Is it possible that the endianness is causing the issue and is there a way to change the byte order of the filesystem?

Answer 1

you can mount jffs2 file system directly

fo rmount jffs2 file system on linux

One method of mounting JFFS2 images uses the mtdram module to emulate an MTD device using system RAM. This works well for JFFS2 images that are less than approximately 32 MB but will not work for larger images since it requires allocating a large amount of system RAM. The basic steps of this process are as follows:

Load mtdram and mtdblock modules. Use the dd command to copy the JFFS2 image to /dev/mtdblock0. Mount /dev/mtdblock0 as a JFFS2 filesytem.

In order to simplify this process, EMAC has created a script which takes the JFFS2 image, mount point, and the erase block size of the image as parameters. The default erase block size for this script is 128 KiB, which is the correct value for most NOR flashes used on EMAC products and some NAND flashes. The eraseblock size can be determined from the contents of /proc/mtd from the system that the image was copied from or created for. For example, if the value of the "erasesize" parameter is 00040000, the erase block size for the device is 256 KiB (0x40000 = 262144 bytes, 262144 / 1024 = 256 KiB). The jffs2_mount_mtdram.sh script is shown below.

#!/bin/bash

## Script to mount jffs2 filesystem using mtd kernel modules.
## EMAC, Inc. 2009

if [[ $# -lt 2 ]]
then
    echo "Usage: $0 FSNAME.JFFS2 MOUNTPOINT [ERASEBLOCK_SIZE]"
    exit 1
fi

if [ "$(whoami)" != "root" ]
then
    echo "$0 must be run as root!"
    exit 1
fi

if [[ ! -e $1 ]]
then
    echo "$1 does not exist"
    exit 1
fi

if [[ ! -d $2 ]]
then
    echo "$2 is not a valid mount point"
    exit 1
fi

if [[ "$3" == "" ]]
then
    esize="128"
else
    esize="$3"
fi

# cleanup if necessary
umount /dev/mtdblock0 &>/dev/null
modprobe -r mtdram &>/dev/null
modprobe -r mtdblock &>/dev/null

modprobe mtdram total_size=32768 erase_size=$esize || exit 1
modprobe mtdblock || exit 1
dd if="$1" of=/dev/mtdblock0 || exit 1
mount -t jffs2 /dev/mtdblock0 $2 || exit 1

echo "Successfully mounted $1 on $2"
exit 0

-

**developer@ldc:~$ sudo ./jffs2_mount_mtdram.sh rootfs.jffs2 /mnt/jffs2 256**

To mount an image with 256 KiB erase block size named rootfs.jffs2 on /mnt/jffs2 using jffs2_mount_mtdram.sh