6

I'm trying to unsquash a file I retrieved with binwalk.

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
43892       0xAB74      U-Boot boot loader reference
131072      0x20000     Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 818155 bytes,  712 inodes, blocksize: 131072 bytes, created: Wed Jan  8 16:01:03 2014 
1242666     0x12F62A    uImage header, header size: 64 bytes, header CRC: 0xBFAA8D79, created: Wed Jan  8 12:41:47 2014, image size: 1457340 bytes, Data Address: 0x80002000, Entry Point: 0x80006F30, data CRC: 0x81C66D08, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS Linux-2.6.32"
1242730     0x12F66A    LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4631160 bytes
2705410     0x294802    Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 22862751 bytes,  1711 inodes, blocksize: 131072 bytes, created: Wed Jan  8 16:01:06 2014 
26285890    0x1911742   LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 1393 bytes
26287433    0x1911D49   gzip compressed data, from Unix, last modified: Thu Jan  9 11:32:52 2014

When I unsquash -s file.squashfs I get:

Found a valid SQUASHFS 4:0 superblock on file.squashfs.
Creation or last append time Wed Jan  8 15:01:06 2014
Filesystem size 22326.91 Kbytes (21.80 Mbytes)
Compression gzip
Block size 131072
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Fragments are compressed
Always_use_fragments option is not specified
Xattrs are compressed
Duplicates are removed
Number of fragments 133
Number of inodes 1711
Number of ids 1

But when I try to unsquash the image:

root@kali:~# unsquashfs file.squashfs
Parallel unsquashfs: Using 3 processors
Lseek failed because Invalid argument
read_block: failed to read block @0x973e11cec35cd74d
read_uids_guids: failed to read id table block
FATAL ERROR aborting: failed to uid/gid table

So I'm a bit puzzled why it won't decompress. I have tried as well with the latest tools from squashfs. Can anyone give me some direction on how to proceed on this one and debug this problem?

4
  • Check if your image is truncated, i.e you have the SquashFS header, but the compressed data it expects might not be all there. – fileoffset Jan 14 '14 at 0:44
  • what is the size of the file you working with? – w s Jan 14 '14 at 11:55
  • I added the binwalk output as well, the total filesize is about 25,2 MB – Lucas Kauffman Jan 14 '14 at 12:16
  • @LucasKauffman can you specify which firmware this squashfs image came from, and/or provide a download link? – devttys0 Aug 20 '14 at 13:05
3

Vendors are notorious for modifying SquashFS. Historically, they have done it to patch in LZMA support, since SquashFS only officially supported gzip compression until version 4.0. Even though SquashFS 4.0 now officially supports both gzip and LZMA, many vendors still use their "hacked" versions of SquashFS. Some have even swapped the gzip/LZMA flags in the SquashFS header (e.g., the header reports that it is gzip compressed when really it is LZMA).

Try the unsquashfs tools from the firmware mod kit. There are 20 or so different unsquashfs utilities in there, one is likely to work (the included unsquashfs_all.sh script is your friend here). If none of them do work, your best bet is probably to look for GPL releases from the vendor for your device, or for other devices (vendors usually re-use code), which may contain their patched squashfs utilities.

6
  • Nope, already tried that – Lucas Kauffman Jan 14 '14 at 16:19
  • Already tried FMK? Or already tried looking for GPL code? Or both? You should probably edit you question to indicate all of the things you've attempted in order to get more helpful answers. Also, a link to the firmware image or SquashFS image might help if others want to analyze it to try and find the answer. – devttys0 Jan 14 '14 at 16:58
  • Already tried FMK, it's a Zyxel router and actually had a look at the GPL code as well, patched my squashfs before running it, no results :( – Lucas Kauffman Jan 14 '14 at 17:02
  • You patched your (i.e., the official) squashfs tools, or you patched the squashfs tools that they provided in their GPL release? You aren't getting a decompression error, which suggests that decompression may be working fine and/or they may have modified other parts of the SquashFS format. – devttys0 Jan 14 '14 at 17:12
  • I patched the official ones, any idea where I could find these tools in case of Zyxel? – Lucas Kauffman Jan 14 '14 at 17:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.