I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer.
However when I use binwalk on these dumps I end up with fragments of files mixed in with corrupted JFFS2 file systems. I have done this on 2 different routers so far. Anyone have any ideas what might be happening here?
Here is an example of the binwalk output on one of the dumps:
❯ binwalk NAND512W3A@TSOP48_5603.BIN
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
64084 0xFA54 JFFS2 filesystem, big endian
227856 0x37A10 HTML document header
227956 0x37A74 JFFS2 filesystem, big endian
503556 0x7AF04 JFFS2 filesystem, big endian
1970268 0x1E105C JFFS2 filesystem, big endian
3057708 0x2EA82C Zlib compressed data, compressed
3136556 0x2FDC2C JFFS2 filesystem, big endian
3380404 0x3394B4 JFFS2 filesystem, big endian
3405000 0x33F4C8 JFFS2 filesystem, big endian
4878860 0x4A720C JFFS2 filesystem, big endian
5263164 0x504F3C Zlib compressed data, compressed
5263228 0x504F7C JFFS2 filesystem, big endian
5555588 0x54C584 JFFS2 filesystem, big endian
6068892 0x5C9A9C Zlib compressed data, compressed
6069200 0x5C9BD0 JFFS2 filesystem, big endian
6086316 0x5CDEAC Unix path: /var/wlansrom/bcm4331_map.bin
6086348 0x5CDECC JFFS2 filesystem, big endian
6316000 0x605FE0 Zlib compressed data, compressed
6316412 0x60617C JFFS2 filesystem, big endian
7022464 0x6B2780 Zlib compressed data, compressed
-- SNIP --
Some of the zlib compressed data does compress to fragments of actual files on the router. The HTML documents are also fragments of the router's HTML webpages but truncated The JFFS2 filesystems are all corrupted and yield nothing no matter what I try.
I would love to be able to extract the file system/s present on this thing, but I just cant see a way to do it. Any help would be very much appreciated :D