Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm just new to these field. So bare with me.
These is the result when I run binwalk.
When I try to extract it using binwalk, it just give endless archives and files to analyse.
Any ideas if it is a false positive? I just want to access one web file on the filesystem. Can anybody help?
This is the firmware file: https://www.mediafire.com/download/mc5as6tf357enxx/firmware.BIN
Well, the files and archives aren't endless, but there are a lot of them. :)
If you run binwalk with just the -e option (no -M), it will only extract files from the firmware.BIN image and not scan any other files, or, as @user3119546 mentioned, you can limit the recursion depth.
All the gzip files that binwalk found appear to be valid (except for one). What you are seeing is not uncommon, mostly because two of the extracted gzip files (at offsets 0xC77C94 and 0x21CA97A) are uncompressed YAFFS file systems, thus when binwalk scans them, binwalk sees all the files in the YAFFS file systems (which in this case is a lot):
$ binwalk C77C94
DECIMAL HEX DESCRIPTION
------------------------------------------------------------------------------------------------------------------------------------------------------
0 0x0 YAFFS filesystem
4112 0x1010 YAFFS filesystem
8224 0x2020 YAFFS filesystem
16448 0x4040 YAFFS filesystem
98688 0x18180 XML document, version: "1.0"
98738 0x181B2 Copyright string: " 2006, Google Inc.ed under the Apache License, Version 2.0 (the "License");"
111024 0x1B1B0 PEM RSA private key
172704 0x2A2A0 XML document, version: "1.0"
180928 0x2C2C0 XML document, version: "1.0"
189152 0x2E2E0 XML document, version: "1.0"
197376 0x30300 XML document, version: "1.0"
209712 0x33330 XML document, version: "1.0"
267280 0x41410 XML document, version: "1.0"
275504 0x43430 XML document, version: "1.0"
283728 0x45450 XML document, version: "1.0"
291952 0x47470 XML document, version: "1.0"
308400 0x4B4B0 XML document, version: "1.0"
320736 0x4E4E0 XML document, version: "1.0"
357744 0x57570 PEM RSA private key
370080 0x5A5A0 gzip compressed data, maximum compression, from Unix, NULL date: Wed Dec 31 19:00:00 1969
407088 0x63630 PEM RSA private key
423536 0x67670 PEM RSA private key
431790 0x696AE LZMA compressed data, properties: 0x40, dictionary size: 16777216 bytes, uncompressed size: 6144 bytes
464656 0x71710 PEM certificate
505776 0x7B7B0 Zip archive data, at least v2.0 to extract, compressed size: 943, uncompressed size: 1675, name: "testkey.x509.pem"
506879 0x7BBFF End of Zip archive
...
This is a situation where just extracting the original image then doing separate scans on each the extracted files is perhaps more informative.
A cursory glance at strings / binwalk scans of the other uncompressed gzip files, this appears to be a Huawei device running VxWorks, but the HTML file you're looking for is probably in one of those two YAFFS file systems.
You can limit the amount of levels it will scan. BinWalk defaults at 8 levels but this can be modified by giving the following command line switch:
-M, --matryoshka=[n] Recursively scan extracted files, up to n levels deep (default: 8)
For further information on binwalk usage, as well as other extraction options try following up here.
