1

I need some assistance in reverse engineering this dumped nor flash image. binwalk yields this after norflash has been dumped (removed the flash chip, dumped it with CH341a and flashrom)

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
154192        0x25A50         CRC32 polynomial table, big endian
245762        0x3C002         PEM certificate
249501        0x3CE9D         PEM certificate
250882        0x3D402         PEM RSA private key
251906        0x3D802         PEM certificate
256542        0x3EA1E         PEM certificate
258050        0x3F002         PEM RSA private key
262144        0x40000         JFFS2 filesystem, big endian
9849380       0x964A24        JFFS2 filesystem, big endian
9863608       0x9681B8        JFFS2 filesystem, big endian
9863852       0x9682AC        Zlib compressed data, compressed
9864052       0x968374        JFFS2 filesystem, big endian
9865340       0x96887C        Zlib compressed data, compressed
9870836       0x969DF4        JFFS2 filesystem, big endian
9876384       0x96B3A0        Zlib compressed data, compressed
9878400       0x96BB80        Zlib compressed data, compressed
9880236       0x96C2AC        Zlib compressed data, compressed
9881684       0x96C854        Zlib compressed data, compressed
9882988       0x96CD6C        Zlib compressed data, compressed
9883992       0x96D158        Zlib compressed data, compressed
9885124       0x96D5C4        Zlib compressed data, compressed
9886064       0x96D970        Zlib compressed data, compressed
9887200       0x96DDE0        Zlib compressed data, compressed
9887672       0x96DFB8        Zlib compressed data, compressed
9893276       0x96F59C        Zlib compressed data, compressed
9894424       0x96FA18        JFFS2 filesystem, big endian
9894896       0x96FBF0        JFFS2 filesystem, big endian
9895936       0x970000        JFFS2 filesystem, big endian
10028120      0x990458        JFFS2 filesystem, big endian
10041496      0x993898        Zlib compressed data, compressed
10044320      0x9943A0        JFFS2 filesystem, big endian
10048664      0x995498        JFFS2 filesystem, big endian
10049940      0x995994        JFFS2 filesystem, big endian
21233664      0x1440000       uImage header, header size: 64 bytes, header CRC: 0xD3221C35, created: 2018-04-09 21:38:35, image size: 1399199 bytes, Data Address: 0x80002000, Entry Point: 0x80224EB0, data CRC: 0x296FC3A7, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: gzip, image name: "Linux Kernel Image"
21233728      0x1440040       gzip compressed data, maximum compression, has original file name: "vmlinux.bin", from Unix, last modified: 2018-04-09 21:38:35

From the above, it appears that between the RSA key, and the uImage, there's a filesystem. Why it is split into smaller parts, I don't know.

I logged in via the serial port using "admin" and got the following:

rooter # cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 01400000 00010000 "rootfs"
mtd2: 00400000 00010000 "uImage"
mtd3: 007b0000 00010000 "reserved"
mtd4: 00010000 00010000 "caldata"

rooter # ls /dev/ | grep mtdblock
mtdblock0
mtdblock1
mtdblock2
mtdblock3
mtdblock4
mtdblock5
mtdblock6

rooter # mount
rootfs on / type rootfs (rw)
/dev/root on / type jffs2 (rw,relatime)
/proc on /proc type proc (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,mode=622)
none on /tmp type ramfs (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)

From the mtdblock info, I can probably safely assume that the "rootfs" filesystem is on the second block.

I also dumped the "mtdblocks" one by one using tftp, and binwalk yields this on the "rootfs" mtdblock:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JFFS2 filesystem, big endian
9587236       0x924A24        JFFS2 filesystem, big endian
9601464       0x9281B8        JFFS2 filesystem, big endian
9601708       0x9282AC        Zlib compressed data, compressed
9601908       0x928374        JFFS2 filesystem, big endian
9603196       0x92887C        Zlib compressed data, compressed
9608692       0x929DF4        JFFS2 filesystem, big endian
9614240       0x92B3A0        Zlib compressed data, compressed
9616256       0x92BB80        Zlib compressed data, compressed
9618092       0x92C2AC        Zlib compressed data, compressed
9619540       0x92C854        Zlib compressed data, compressed
9620844       0x92CD6C        Zlib compressed data, compressed
9621848       0x92D158        Zlib compressed data, compressed
9622980       0x92D5C4        Zlib compressed data, compressed
9623920       0x92D970        Zlib compressed data, compressed
9625056       0x92DDE0        Zlib compressed data, compressed
9625528       0x92DFB8        Zlib compressed data, compressed
9631132       0x92F59C        Zlib compressed data, compressed
9632280       0x92FA18        JFFS2 filesystem, big endian
9632752       0x92FBF0        JFFS2 filesystem, big endian
9633792       0x930000        JFFS2 filesystem, big endian
9765976       0x950458        JFFS2 filesystem, big endian
9779352       0x953898        Zlib compressed data, compressed
9781400       0x954098        JFFS2 filesystem, big endian
9782176       0x9543A0        JFFS2 filesystem, big endian

I tried to get the rootfs mtdblock converted to a jffs2 image, but does show "empty" on the terminal, after using this script to mount it: https://reverseengineering.stackexchange.com/a/22433

Any assistance to get it to show some contents?

I am trying to use this dumped nor flash image, for use to create a OpenWRT image for a router.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.