1

I am working on reversing a router for which I cannot find downloadable firmware anywhere. I managed to get a root shell on the router. I am now confused as I cannot see any persistent writeable mounts. Most are tmpfs filesystems, one is a sysfs which as far as I understand is not an actual filesystem, and /dev/mtdblock7 which is a squashfs filesystem (and is readonly). Where is the persistent storage that keeps my configurations? What am I missing here?

# mount
/dev/mtdblock7 on / type squashfs (ro,relatime)
/proc on /proc type proc (rw,relatime)
tmpfs on /var type tmpfs (rw,relatime,size=15360k)
tmpfs on /mnt type tmpfs (rw,relatime,size=16k)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,relatime,size=3096k)
none on /proc/bus/usb type usbfs (rw,relatime)

Update:

Board

This is a ZTE router, the board has a printed label that says: ZXHN H367N V1.0

The default update file that uboot looks for when booting over tftp is called H367N_image.bin

Running zcu signature on the config file gives ZXDSL 931VII V3.0

The decryption password used to decrypt and encrypt the file is the same as the one used in ZXHN H208N according to this.

Also, I remember seeing H368N somewhere, but I'm not sure where.

Finally I found paths that have the directory H367N_Develop_UGW5.4 in them.

mtdblocks

(This is a summary of what binwalk found)

mtdblock0:

  • List item crc
  • uImage header "u-boot image"
  • lzma

mtdblock1:

  • UBI erease count header

mtdblock2:

  • nothing found

mtdblock3:

  • uImage header "GPHY Firmware"
  • lzma compression
  • uImage header "GPHY Firmware"
  • lzma compression
  • zlib compressed data
  • PEM RSA private key
  • PEM certificate
  • uImage header "MIPS LTQCPE Linux-2.6.32.42"
  • lzma
  • squashfs
  • uImage header "MIPS LTQCPE Linux-2.6.32.42"
  • lzma
  • squashfs

mtdblock4:

  • uImage header "GPHY Firmware"
  • lzma
  • uImage header "GPHY Firmware"
  • lzma

mtdblock5:

  • zlib compressed data
  • PEM RSA private key
  • PEM certificate

mtdblock6:

  • uImage header "MIPS LTQCPE Linux-2.6.32.42"
  • lzma

mtdblock7:

  • squashfs

mtdblock8:

  • uImage header "MIPS LTQCPE Linux-2.6.32.42"
  • lzma

mtdblock9:

  • squashfs

mtdblock10:

  • nothing

mtdblock11:

  • nothing

mtdblock6 and mtdblock8 are identical mtdblock7 and mtdblock9 are identical mtdblock3 contains the same binary as mtdblocks 6,7,8 and 9, and likely others as well.

I tried remounting /dev/mtdblock7 but failed. Maybe I did something wrong but my understanding is that squashfs should not be writable in any case.

Improve this question
2
  • Hi and welcome to RE.SE. Please add a little more information. For starters, if it's small bits of information it may not end up in a different type of device (and specifically who says it has to be in a file system?). Also, in theory, a device could full well remount a certain file system read-write on-demand and then revert back to read only after being done saving data. What other MTD devices are there? What have you tried?
    – 0xC0000022L ♦
    Nov 28, 2020 at 21:45
  • I tried adding some information. About the filesystem question, I don't know, I assumed it would. What do you mean by "if it's small bits of information it may not end up in a different type of device"?
    – alex10791
    Nov 30, 2020 at 20:29

1 Answer 1

Reset to default
2

Some Routers use a NVRAM for storing settings. That would give you exactly this result: No writable partitions but some binary is taking care of reading and writing to that NVRAM (wherever that might be). Check if there's anything called nvread, nvconf or something like that.

If that's not successful you can always try to find a binary that uses a configurable option, load it into a Disassembler and see what's going on there.

Improve this answer
4
  • Yeah, the command nvram should exist on the device.
    – multithr3at3d
    Nov 29, 2020 at 16:01
  • ... and a device with a name containing nv probably also exists.
    – 0xC0000022L ♦
    Nov 30, 2020 at 10:48
  • there is no nvram command or device with nv in its name
    – alex10791
    Nov 30, 2020 at 19:36
  • @alex10791 by device, you mean you checked /dev? If still no, I'd suggest looking at some of the binaries to see if they load config at the beginning.
    – multithr3at3d
    Dec 1, 2020 at 23:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.