1

I have a ZTE router "ZTE_ZXHN_H168N" and want to learn more about firmware reverse engineering. I managed to do the following so far:

  1. Dump the firmware from the SPI flash.

  2. Running strings on the bin file gave the default AP name and its PSK, and a potential boot password.

  3. Running binwalk on the file gave the below output, and this is where I am stuck. I was expecting something like uboot header or squashfs, but I am puzzled by what I am getting. binwalk analysis

  4. Extracting the components with binwalk -Me gave the below result.

binwalk extraction results

  1. I made more trials and ran binwalk -Me and strings on all files and dumped the output to a text file "fw_contents.txt"fw_contents

  2. Running binwalk -Me on file "80100.7z" gave what looks like c-source files but I failed to extract any of those files. 80100.7z with binwalk

Updates: I tried to extract the firmware parts manually following the memory map found in the bootlog file, and compare the extracted components to what binwalk extracted. The only part that matches was the rootfs1 and 80100.7z

I tried also exporting the config file from the router homepage, then I changed a single character in the default SSID name, then exported the config file again for comparison. The files were completely different. So, I guess the config file is also encrypted.

I tried using "unlzma" and "7za" to extract the 10000.7z and 80100.7z but the files were unrecognized.

I do not know what I am looking at here, and would really appreciate it if you could provide some guidance.

I am happy to share the firmware firmware.bin and the bootlog Normalboot.log , Testmodelog.log files if someone is interested.

Thanks

5
  • 1
    Please post the full command used to extract the firmware and the version of binwalk being used. Typically the -M argument is specified together with -e, in order to extract everything in one shot. You may also wish to try unblob. Note that the ReFirmLabs binwalk repo is no longer maintained, there is a community-maintained fork here: OSPG/binwalk
    – julian
    Commented Aug 13 at 15:25
  • @Julian, My binwalk version is V2.4.2+3dd13v7 The complete command I used is: binwalk -e firmware.bin
    – snabil
    Commented Aug 14 at 11:50
  • Please edit your post to include this info. Consider re-running the extraction with the -M option specified in addition to -e, as I mentioned -> binwalk -Me firmware.bin
    – julian
    Commented Aug 14 at 14:18
  • There's no need to run binwalk again on 80100.7z, it has already been extracted to /home/kali/Downloads/Etisalat_FW/_etis_01.bin.extracted/80100. I'll take a look at the firmware and bootlog files if you share them.
    – julian
    Commented Aug 19 at 17:20
  • 1
    @julian firmware and boot logs were uploaded. Thanks
    – snabil
    Commented Aug 20 at 22:02

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.