0

I have been investigating some routers by desoldering their nand flash and dumping them using a flash programmer.

However when I use binwalk on these dumps I end up with fragments of files mixed in with corrupted JFFS2 file systems. I have done this on 2 different routers so far. Anyone have any ideas what might be happening here?

Here is an example of the binwalk output on one of the dumps:

❯ binwalk NAND512W3A@TSOP48_5603.BIN
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
64084         0xFA54          JFFS2 filesystem, big endian
227856        0x37A10         HTML document header
227956        0x37A74         JFFS2 filesystem, big endian
503556        0x7AF04         JFFS2 filesystem, big endian
1970268       0x1E105C        JFFS2 filesystem, big endian
3057708       0x2EA82C        Zlib compressed data, compressed
3136556       0x2FDC2C        JFFS2 filesystem, big endian
3380404       0x3394B4        JFFS2 filesystem, big endian
3405000       0x33F4C8        JFFS2 filesystem, big endian
4878860       0x4A720C        JFFS2 filesystem, big endian
5263164       0x504F3C        Zlib compressed data, compressed
5263228       0x504F7C        JFFS2 filesystem, big endian
5555588       0x54C584        JFFS2 filesystem, big endian
6068892       0x5C9A9C        Zlib compressed data, compressed
6069200       0x5C9BD0        JFFS2 filesystem, big endian
6086316       0x5CDEAC        Unix path: /var/wlansrom/bcm4331_map.bin
6086348       0x5CDECC        JFFS2 filesystem, big endian
6316000       0x605FE0        Zlib compressed data, compressed
6316412       0x60617C        JFFS2 filesystem, big endian
7022464       0x6B2780        Zlib compressed data, compressed
-- SNIP --

Some of the zlib compressed data does compress to fragments of actual files on the router. The HTML documents are also fragments of the router's HTML webpages but truncated The JFFS2 filesystems are all corrupted and yield nothing no matter what I try.

I would love to be able to extract the file system/s present on this thing, but I just cant see a way to do it. Any help would be very much appreciated :D

| improve this question | |
  • Here's the zipped upload of one of the dumps: mediafire.com/file/nsx1shsnb75e11f/… – Plasma_000 Oct 19 at 8:07
  • I think your .bin file is corrupted. if you open it with a hex editor and search for <html> (in 0x37A10), a few bytes later in 0x37A74, there are 41 bytes which have nothing to do in an html file. <br> This prevents binwalk from functioning properly. <br> There are many instances of the presence of "spurious" bytes in this file. – Gordon Freeman Oct 22 at 10:27
  • @GordonFreeman this is more likely because they are compressed / part of a file system though no? – Plasma_000 Oct 22 at 10:29
  • Compressed : no. – Gordon Freeman Oct 22 at 11:13
  • It’s a dump right from the flash, but the files should be stored in a file system which may be compressed no? – Plasma_000 Oct 22 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.