can't extract a lzma compressed file

Question

hello i want to do the reverse engineering. for tp linkTD-W8961ND_V3 firmware here is the output

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
61191         0xEF07          ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
61440         0xF000          ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
85043         0x14C33         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66696 bytes
118036        0x1CD14         Unix path: /usr/share/tabset/vt100:\
118804        0x1D014         ZyXEL rom-0 configuration block, name: "spt.dat", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
118824        0x1D028         ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16
128002        0x1F402         GIF image data, version "89a", 200 x 50
136194        0x21402         GIF image data, version "89a", 560 x 50
252286        0x3D97E         Neighborly text, "neighbor of your ADSL Router that will forward the packet to the destination. On the LAN, the gateway </font>e destination. On the LAN, the gateway </font>"
340223        0x530FF         Copyright string: "Copyright (c) 2001 - 2015 TP-LINK TECHNOLOGIES CO., LTD."
377616        0x5C310         Copyright string: "Copyright &copy; 2015 TP-LINK Technologies Co., Ltd. All rights reserved."
377634        0x5C322         TP-Link firmware header, firmware version: 28780.26990.27501, image version: " Co., Ltd. All rights reserved.", product ID: 0x6E42746E, product version: 1131375727, kernel load address: 0x72002223, kernel entry point: 0x46463939, kernel offset: 4411461, kernel length: 1215263604, rootfs offset: 1315007845, rootfs length: 1400140358, bootloader offset: 1869756214, bootloader length: 808517748
391219        0x5F833         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3711356 bytes

root@soyalk:~/Desktop/router-tools# dd if=firmware.bin bs=1 skip=377634 of=firmware.lzma
dd: failed to open 'firmware.bin': No such file or directory
root@soyalk:~/Desktop/router-tools# dd if=ras bs=1 skip=377634 of=firmware.lzma
1245832+0 records in
1245832+0 records out
1245832 bytes (1.2 MB, 1.2 MiB) copied, 17.4058 s, 71.6 kB/s
root@soyalk:~/Desktop/router-tools# binwalk firmware.lzma 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             TP-Link firmware header, firmware version: 28780.26990.27501, image version: " Co., Ltd. All rights reserved.", product ID: 0x6E42746E, product version: 1131375727, kernel load address: 0x72002223, kernel entry point: 0x46463939, kernel offset: 4411461, kernel length: 1215263604, rootfs offset: 1315007845, rootfs length: 1400140358, bootloader offset: 1869756214, bootloader length: 808517748
13585         0x3511          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3711356 bytes

root@soyalk:~/Desktop/router-tools# lzma -d firmware.lzma 
lzma: Decoder error

how to extract that lzma file?

Answer 1

binwalk easily finds the beginning of the lzma file but not the end.
It is necessary to modify the files extracted with a Hexadecimal editor.
I don't have the same version as you but for TD-W8961ND_V3_140305.bin:
The first extracted file (in 0x14C33) contains from the offset 0x41cf many 0x00,
all the following bytes must be deleted.
In my version the file ends with 4A FC A7 00.
The second extracted file is easier because it is the last of the .bin, I simply delete the last byte (0x00).