1

I have a stock Netgear switch firmware file: https://www.downloads.netgear.com/files/GDC/GS316EP/GS316EP_GS316EPP_V1.0.3.7.zip

When I do binwalk, it gives me at position 0x769BDC a description as "LZ4 compressed data, legacy".

$ binwalk GS316EP_GS316EPP_V1.0.3.7-runtime.image

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x4BF2DD44, created: 2022-11-15 06:39:14, image size: 8717639 bytes, Data Address: 0x80000000, Entry Point: 0x80270DF0, data CRC: 0x63E75FAB, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: gzip, image name: "GS316EP"
64            0x40            gzip compressed data, maximum compression, has original file name: "vmlinux.bin", from Unix, last modified: 2022-11-15 06:39:13
7773148       0x769BDC        LZ4 compressed data, legacy

When I try to uncompress it trow me an error:

~$ dd if=GS316EP_GS316EPP_V1.0.3.7-runtime.image of=mystery.lz4 bs=1 skip=7773148
~$ lz4 -d mystery.lz4
Decoding file mystery
Stream followed by undecodable data at position 8
mystery.lz4          : decoded 0 bytes

This page: General Structure of LZ4 Frame format shows what to expect as magic number for LZ4 file.

The magic number doesn't seem to correspond to lz4 compressed data format:

~$ xxd -C mystery.lz4 | head -n 2
00000000: 0221 4c18 4d3c 0d32 73c9 7704 37e0 ec21  .!L.M<.2s.w.7..!
00000010: 81d5 98ca a0e6 bea0 12c7 b3bb 51d5 1499  ............Q...

What can I do to correctly identify which kind of data this part is and eventually extract it ?

EDIT

See answer below.

1
  • you should probably post your edit as an answer...
    – Igor Skochinsky
    Commented Feb 12 at 13:34

1 Answer 1

1

I just found out that binwalk report an image size of "8717639 bytes" in uImage header. It brings me at the very end of the file as file size is 8717703 bytes (8717639 which is my uImage kernel compressed data + 64 which is my header_size = 8717703) :

~$ ls -la GS316EP_GS316EPP_V1.0.3.7-runtime.image
-rwxrwxrwx 1 user user 8717703 Apr 17  2023 GS316EP_GS316EPP_V1.0.3.7-runtime.image

And uImage kernel compressed data is indeed 8717639 bytes long,I double checked by uncompressing it correctly.

So somehow, binwalk found random data in my uImage kernel compressed data, that he refered wrongly to lz4 compressed data. It's a false positive then.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.