I'm reverse engineering an old TP-Link TD-W9970v3 router for fun and wanted to examine one of the executables called webWarn
. Ghidra was unable to recognise the format, which surprised me. I then tried to use the file
command on it, and it too did not recognise it, simply reporting it as data. I then opened up the file in a hex editor and was surprised to see that the first bytes in the executable are a string containing a relative path to the location of the busybox
executable on the system.
Comparing the hex of this executable with a normal ELF executable from the system shows that their headers seem to be the same size. It caught my attention that the presence of the string "/lib/ld-uClibc.so.0" in both files starts at the same offset.
There are many strings in the binary that seem to refer to C libraries and functions, so it does look like a regular compiled executable.
I uploaded it to Decompiler Explorer (see result) and only BinaryNinja was able to recognise the file apparently, although trying to upload it to BinaryNinja's own cloud service didn't work
What binary format is this?
hexdump
and it's just a normal ELF executable. Good catch! I used binwalk to extract the JFFS2 image and it has handled other symlniks just fine. Perhaps it's errors in the extracted image data, or a bug in binwalk.