0

I am practicing (studying) hardware reverse engineering. I dumped a NAND flash (smart TV), and managed to remove OOB data and emulate NAND in my environment. I detected that NAND used UBI filesystem, and after a lot of trying, I managed to list the UBI volumes (11 in total) and mount / extract files on 10 of 11 volumes, but one of them (ubi0:0 / RFS) I failed to mount or understand the structure.

Ubinfo output:

UBI version:                    1
Count of UBI devices:           1
UBI control device major/minor: 10:57
Present UBI devices:            ubi0

ubi0
Volumes count:                           11
Logical eraseblock size:                 253952 bytes, 248.0 KiB
Total amount of logical eraseblocks:     2048 (520093696 bytes, 496.0 MiB)
Amount of available logical eraseblocks: 170 (43171840 bytes, 41.1 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  40
Current maximum erase counter value:     3
Minimum input/output unit size:          4096 bytes
Character device major/minor:            241:0
Present volumes:                         0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10

Volume ID:   0 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        34 LEBs (8634368 bytes, 8.2 MiB)
State:       OK
Name:        RFS
Character device major/minor: 241:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        471 LEBs (119611392 bytes, 114.0 MiB)
State:       OK
Name:        APP
Character device major/minor: 241:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        83 LEBs (21078016 bytes, 20.1 MiB)
State:       OK
Name:        APPCACHE
Character device major/minor: 241:3
-----------------------------------
Volume ID:   3 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        401 LEBs (101834752 bytes, 97.1 MiB)
State:       OK
Name:        MSLIB
Character device major/minor: 241:4
-----------------------------------
Volume ID:   4 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        34 LEBs (8634368 bytes, 8.2 MiB)
State:       OK
Name:        CONFIG
Character device major/minor: 241:5
-----------------------------------
Volume ID:   5 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        29 LEBs (7364608 bytes, 7.0 MiB)
State:       OK
Name:        customer
Character device major/minor: 241:6
-----------------------------------
Volume ID:   6 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        21 LEBs (5332992 bytes, 5.0 MiB)
State:       OK
Name:        customerbackup
Character device major/minor: 241:7
-----------------------------------
Volume ID:   7 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        17 LEBs (4317184 bytes, 4.1 MiB)
State:       OK
Name:        GINGA
Character device major/minor: 241:8
-----------------------------------
Volume ID:   8 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        25 LEBs (6348800 bytes, 6.0 MiB)
State:       OK
Name:        brickbackup
Character device major/minor: 241:9
-----------------------------------
Volume ID:   9 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        25 LEBs (6348800 bytes, 6.0 MiB)
State:       OK
Name:        brickreserve
Character device major/minor: 241:10
-----------------------------------
Volume ID:   10 (on ubi0)
Type:        dynamic
Alignment:   1
Size:        694 LEBs (176242688 bytes, 168.0 MiB)
State:       OK
Name:        oad
Character device major/minor: 241:11

Binwalk give me some hint about the contents, but I cant mount (mount -t ubifs) or extract the contents with binwalk or ubireader.

Binwalk output:

Scan Time:     2021-10-12 03:45:23
Target File:   redacted
MD5 Checksum:  7716f8e48400c2744b5f1c26af9a4b95
Signatures:    411

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
196           0xC4            JPEG image data, EXIF standard
208           0xD0            TIFF image data, big-endian, offset of first image directory: 8
11949         0x2EAD          Copyright string: "Copyright (c) 1998 Hewlett-Packard Company"
2978722       0x2D73A2        gzip compressed data, last modified: 2106-02-07 04:47:11 (bogus date)
3159152       0x303470        Unix path: /var/log/wtmp
3182214       0x308E86        LUKS_MAGIC
3183012       0x3091A4        LZO compressed data
3183860       0x3094F4        xz compressed data
3192220       0x30B59C        Unix path: /var/log/bX
3194510       0x30BE8E        Base64 standard index table
5479773       0x539D5D        Unix path: /home/chiaoyin.huang/opt/iconv/lib
5895921       0x59F6F1        ELF, 32-bit LSB processor-specific, (GNU/Linux)
6214206       0x5ED23E        Cisco IOS microcode, for ".L"
6232535       0x5F19D7        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 4bit
7210291       0x6E0533        SHA256 hash constants, little endian
7651339       0x74C00B        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit

Any advice?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.