I have a ZTE router "ZTE_ZXHN_H168N" and want to learn more about firmware reverse engineering. I managed to do the following so far:
Dump the firmware from the SPI flash.
Running strings on the bin file gave the default AP name and its PSK, and a potential boot password.
Running binwalk on the file gave the below output, and this is where I am stuck. I was expecting something like uboot header or squashfs, but I am puzzled by what I am getting.
Extracting the components with binwalk -Me gave the below result.
I made more trials and ran
binwalk -Me
andstrings
on all files and dumped the output to a text file "fw_contents.txt"fw_contentsRunning
binwalk -Me
on file "80100.7z" gave what looks like c-source files but I failed to extract any of those files.
Updates:
I tried to extract the firmware parts manually following the memory map found in the bootlog file, and compare the extracted components to what binwalk
extracted. The only part that matches was the rootfs1
and 80100.7z
I tried also exporting the config file from the router homepage, then I changed a single character in the default SSID name, then exported the config file again for comparison. The files were completely different. So, I guess the config file is also encrypted.
I tried using "unlzma" and "7za" to extract the 10000.7z and 80100.7z but the files were unrecognized.
I do not know what I am looking at here, and would really appreciate it if you could provide some guidance.
I am happy to share the firmware firmware.bin and the bootlog Normalboot.log , Testmodelog.log files if someone is interested.
Thanks
binwalk -Me firmware.bin
/home/kali/Downloads/Etisalat_FW/_etis_01.bin.extracted/80100
. I'll take a look at the firmware and bootlog files if you share them.