Extract/Repack EEPROM Dump

Question

I want to get more information from this dump I have:

http://s000.tinyupload.com/index.php?file_id=42095249658483515063

binwalk dump.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
56368         0xDC30          U-Boot version string, "U-Boot 1.1.4-2  (Jun 10 2016)"
56400         0xDC50          CRC32 polynomial table, big endian
65536         0x10000         uImage header, header size: 64 bytes, header CRC: 0x4FD6C064, created: 2016-10-12 09:53:26, image size: 3729430 bytes, Data Address: 0x80060000, Entry Point: 0x80064CE0, data CRC: 0x6B3A6FD3, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "runtime"
65600         0x10040         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 12767476 bytes

I already used binwalk -Me dump.bin and got _10040.extracted/cpio-root/ with the main content. But it looks somehow incomplete.

After reading around in the files eg init I see, that there are multiple mtd "partitions" which would be nice to separate them from the dump. I hope that it will help me to understand the firmware and how update process works.

Also I found in the hexdump some PRIVATE information about the device like device_pass, device_wpapass and so on, which I replaced all with a 1. But it is also niceto know where this information's are stored on the device to see how they are queried.

The problem for me is to separate all partitions/information from this dump. At least I want to see, if it is possible to disconnect the device from the cloud and only use it locally - but it looks like the firmware builds only a connection between the interface (connected to the heater) and the cloud server - so all logic is on the cloud.

Maybe it is possible to mod the firmware with a remote shell or make a MITM possible to investigate on runtime state.

Answer 1

There is a cpio archive in the lzma compressed section

Layout of the dump.bin file:

00000000 - 00010000  bootloader, baseaddress = 0x9f000000
0000f120 - 0000f194 "bootargs=flash_part=1 uboot_version=1.1.4-2", "bootcmd=bootm 0x9F010000", "bootdelay=0", "baudrate=115200", "loadaddr=0x80800000"
0000f5c0 - 00010000   '0xff'
00010000 - 00010040  uImage header  ( the system partition )
00010040 - 0039e856   LZMA compressed data
0039e856 - 007f1000   '0xff'
007f1000 - 007f1440  The 'art' data partition
007f1440 - 007f9000   '0xff'
007f9000 - 007f9142   JSON: 
007f9142 - 00800000   '0xff'

extract the lzma section:

dd bs=1 skip=$[0x00010040] count=$[0x38E816] if=dump.bin  | lzcat > dump-10040.bin

Layout of the lzma compressed data:

00000400 - 002D14CC   probably all linux kernel.
002D14CC - 00c2ced0   cpio archive

list the files in the cpio archive

dd bs=1 skip=$[0x2D14CC] if=dump-10040.bin | cpio -ivt 

I found 104 files and 183 symlinks in the cpio section.

The vitoconnect-ol binary handles the web interface.

The init scripts tells you everything it does when booting - not very much, basically: run the vitoconnect binary.

And, if you are wondering why there are not that many tools: busybox has all the standard unix commandline tools packaged in one binary.

From the string AR9331 bootldr, i assume your device has a ar9331 chip, which has plenty of documentation available on openwrt, including the full datasheet.

about flash partitions

/dev/mdt1    system1
/dev/mdt2    system2

/dev/mtd4    user config
/dev/mtd5    json config

/dev/mtd1 and /dev/mtd2 both contain the system, alternating between upgrades.

quote from openwrt:

Requires a WiFi firmware called “ART” (Atheros Radio Test). It holds device specific wireless calibration data, thus using a generic or the wrong firmware causes FCC incompliance and poor wireless performance. Usually the firmware is stored in an ART partition located at the last 64KiB of the flash. If the ART partition is missing or corrupt, ath9k (wireless driver) won't come up anymore.