0

hello i want to do the reverse engineering. for tp linkTD-W8961ND_V3 firmware here is the output

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
61191         0xEF07          ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
61440         0xF000          ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
85043         0x14C33         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66696 bytes
118036        0x1CD14         Unix path: /usr/share/tabset/vt100:\
118804        0x1D014         ZyXEL rom-0 configuration block, name: "spt.dat", compressed size: 0, uncompressed size: 0, data offset from start of block: 16
118824        0x1D028         ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 25972, uncompressed size: 11886, data offset from start of block: 16
128002        0x1F402         GIF image data, version "89a", 200 x 50
136194        0x21402         GIF image data, version "89a", 560 x 50
252286        0x3D97E         Neighborly text, "neighbor of your ADSL Router that will forward the packet to the destination. On the LAN, the gateway </font>e destination. On the LAN, the gateway </font>"
340223        0x530FF         Copyright string: "Copyright (c) 2001 - 2015 TP-LINK TECHNOLOGIES CO., LTD."
377616        0x5C310         Copyright string: "Copyright &copy; 2015 TP-LINK Technologies Co., Ltd. All rights reserved."
377634        0x5C322         TP-Link firmware header, firmware version: 28780.26990.27501, image version: " Co., Ltd. All rights reserved.", product ID: 0x6E42746E, product version: 1131375727, kernel load address: 0x72002223, kernel entry point: 0x46463939, kernel offset: 4411461, kernel length: 1215263604, rootfs offset: 1315007845, rootfs length: 1400140358, bootloader offset: 1869756214, bootloader length: 808517748
391219        0x5F833         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3711356 bytes

root@soyalk:~/Desktop/router-tools# dd if=firmware.bin bs=1 skip=377634 of=firmware.lzma
dd: failed to open 'firmware.bin': No such file or directory
root@soyalk:~/Desktop/router-tools# dd if=ras bs=1 skip=377634 of=firmware.lzma
1245832+0 records in
1245832+0 records out
1245832 bytes (1.2 MB, 1.2 MiB) copied, 17.4058 s, 71.6 kB/s
root@soyalk:~/Desktop/router-tools# binwalk firmware.lzma 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             TP-Link firmware header, firmware version: 28780.26990.27501, image version: " Co., Ltd. All rights reserved.", product ID: 0x6E42746E, product version: 1131375727, kernel load address: 0x72002223, kernel entry point: 0x46463939, kernel offset: 4411461, kernel length: 1215263604, rootfs offset: 1315007845, rootfs length: 1400140358, bootloader offset: 1869756214, bootloader length: 808517748
13585         0x3511          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3711356 bytes

root@soyalk:~/Desktop/router-tools# lzma -d firmware.lzma 
lzma: Decoder error

how to extract that lzma file?

3
  • Why have you chosen the offset 377634 which points to the TP-Link firmware header? The LZMA compressed data starts at offset 391219.
    – Robert
    Oct 29 '20 at 18:04
  • cause i saw rootfs on it i thinked it contain filesystem .but anyway when extracting 391219 it give a lzma when i extract it it give binary file
    – soyalk
    Oct 30 '20 at 20:05
  • If you want to load the LZMA section you need it without additional data before and after, hence you can only process the root fs xor the LZMA section. Extract each of them and process them separately.
    – Robert
    Oct 30 '20 at 20:08
1

binwalk easily finds the beginning of the lzma file but not the end.
It is necessary to modify the files extracted with a Hexadecimal editor.
I don't have the same version as you but for TD-W8961ND_V3_140305.bin:
The first extracted file (in 0x14C33) contains from the offset 0x41cf many 0x00,
all the following bytes must be deleted.
In my version the file ends with 4A FC A7 00.
The second extracted file is easier because it is the last of the .bin, I simply delete the last byte (0x00).

3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.