backup from ZynOS but, can not be decompressed with LZS

Question

So I have this rom-0 file from Zyxel router P-660HW-T3 v3 and I would like to decompress it, I tried many tools, one of them you can find here the tool using lzs for decompression which works for some rom-0 files (smaller ones around 16 kB), but on mine it does not, mine has around 50 kB and has few differences.Here is "normal" file


00000000  01 01 00 01 19 48 64 62  67 61 72 65 61 00 00 00  |.....Hdbgarea...|
00000010  00 00 00 00 18 00 00 00  01 48 00 00 00 00 00 00  |.........H......|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000160  00 00 00 00 00 00 00 00  52 ca c0 ea de ad be af  |........R.......|
00000170  00 00 00 0e 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000180  05 03 00 ad 52 c9 a4 e5  80 46 e7 50 ff ff a1 f4  |....R....F.P....|
00000190  00 00 00 19 00 00 00 00  05 03 00 d4 52 c9 a4 e5  |............R...|
000001a0  80 46 e7 50 ff ff 9e 08  00 00 00 64 80 09 89 ac  |.F.P.......d....|
000001b0  04 03 00 d5 52 c9 bb 21  80 46 eb b8 ff ff a2 30  |....R..!.F.....0|
000001c0  00 09 3a c9 00 00 00 00  04 03 00 d6 52 c9 bb 21  |..:.........R..!|
000001d0  80 46 eb b8 ff ff a2 2f  00 09 3a c9 00 00 00 00  |.F...../..:.....|
000001e0  04 03 00 d7 52 c9 ba 49  80 46 eb b8 ff ff a2 35  |....R..I.F.....5|
000001f0  52 c9 ba 49 00 00 00 00  04 03 00 d8 52 c9 ba 49  |R..I........R..I|

and


00000410  80 46 e7 50 ff ff 9e 08  00 00 00 64 80 09 8b 3c  |.F.P.......d...<|
00000420  55 55 55 55 00 00 00 00  00 00 00 00 00 00 00 00  |UUUU............|
00000430  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000006d0  00 00 00 00 55 55 55 55  00 00 00 00 80 41 00 00  |....UUUU.....A..|
000006e0  00 00 00 00 00 00 00 0e  00 00 00 00 00 00 00 01  |................|
000006f0  00 00 00 00 ff ff ff fe  00 00 ff 14 00 00 00 01  |................|
00000700  00 00 00 30 00 00 00 01  80 45 cc f0 00 00 00 01  |...0.....E......|
00000710  00 00 00 01 00 00 00 63  80 41 4c 78 00 00 00 01  |.......c.ALx....|

and


00002000  02 94 00 03 1f fc 62 6f  6f 74 00 00 00 00 00 00  |......boot......|
00002010  00 00 00 00 00 20 00 0c  01 48 73 70 74 2e 64 61  |..... ...Hspt.da|
00002020  74 00 00 00 00 00 00 00  1a b0 13 52 01 68 61 75  |t..........R.hau|
00002030  74 6f 65 78 65 63 2e 6e  65 74 00 00 01 f4 01 dc  |toexec.net......|
00002040  1c 18 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00002050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Here is mine


00000000  01 01 00 01 00 00 19 48  64 62 67 61 72 65 61 00  |.......Hdbgarea.|
00000010  00 00 00 00 00 00 00 00  18 00 00 00 00 00 00 00  |................|
00000020  01 48 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |.H..............|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000150  00 00 00 00 00 00 00 05  00 00 00 01 00 00 00 02  |................|
00000160  00 00 00 03 00 00 00 01  00 00 00 00 de ad be af  |................|
00000170  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000180  03 03 00 30 38 6d 46 1a  00 00 00 18 ff ff a1 f4  |...08mF.........|
00000190  00 00 00 01 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001b0  00 00 00 00 00 00 00 00  05 03 00 5c 38 6d 46 1a  |...........\8mF.|
000001c0  00 00 00 18 ff ff 9e 08  00 00 00 64 80 09 e0 5c  |...........d...\|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001f0  05 03 00 32 38 6d 46 2a  00 00 00 20 ff ff a1 f4  |...28mF*... ....|
00000200  00 00 00 03 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000210  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000220  00 00 00 00 00 00 00 00  04 03 00 5d 38 6d 46 2a  |...........]8mF*|
00000230  00 00 00 20 ff ff a2 29  00 00 00 00 00 00 00 00  |... ...)........|
00000240  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|


00000ea0  04 03 00 2e 38 6d 45 ee  00 00 00 20 ff ff a1 f4  |....8mE.... ....|
00000eb0  00 00 00 0b 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000ec0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000ed0  00 00 00 00 00 00 00 00  04 03 00 59 38 6d 45 ee  |...........Y8mE.|
00000ee0  00 00 00 20 ff ff a2 33  00 00 00 00 00 00 00 00  |... ...3........|
00000ef0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000f10  04 03 00 5a 38 6d 45 ee  00 00 00 20 ff ff a2 2e  |...Z8mE.... ....|
00000f20  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000f40  00 00 00 00 00 00 00 00  03 03 00 5b 38 6d 45 f7  |...........[8mE.|
00000f50  00 00 00 15 ff ff a5 fc  ff ff f4 47 80 9a e2 98  |...........G....|
00000f60  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000f80  55 55 55 55 00 00 00 00  00 00 00 00 00 00 00 00  |UUUU............|
00000f90  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001b90  00 00 00 00 55 55 55 55  00 00 00 00 ff ff ff ff  |....UUUU........|
00001ba0  00 00 00 02 00 00 00 00  00 00 00 00 00 00 00 00  |................|


00001fd0  80 7a 00 00 bf c0 5f 90  80 66 00 00 00 00 00 00  |.z...._..f......|
00001fe0  80 5e 05 b4 80 40 11 c8  00 00 00 00 00 00 00 00  |.^...@..........|
00001ff0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00002000  02 c8 00 03 00 00 9f fc  62 6f 6f 74 00 00 00 00  |........boot....|
00002010  00 00 00 00 00 00 00 00  00 20 00 00 00 0c 00 00  |......... ......|
00002020  01 48 73 70 74 2e 64 61  74 00 00 00 00 00 00 00  |.Hspt.dat.......|
00002030  00 00 9a b0 00 00 3f 6c  00 00 01 68 61 75 74 6f  |......?l...hauto|
00002040  65 78 65 63 2e 6e 65 74  00 00 00 00 01 f4 00 00  |exec.net........|
00002050  01 52 00 00 9c 18 00 00  00 00 00 00 00 00 00 00  |.R..............|
00002060  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

I separated some parts of the files as u may see above, so what Binwalk says on "normal" file


$ binwalk rom-0

DECIMAL       HEXADECIMAL     DESCRIPTION
------------------------------------------------------------------------------------------------------------------------------------------------------
0             0x0             ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 0, uncompressed size: 6144, data offset from start of block: 344
8212          0x2014          ZyXEL rom-0 configuration block, name: "spt.dat", compressed size: 4946, uncompressed size: 6832, data offset from start of block: 376
8232          0x2028          ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 476, uncompressed size: 500, data offset from start of block: 7208

and what on mine


$ binwalk rom-4.51 

DECIMAL       HEXADECIMAL     DESCRIPTION
------------------------------------------------------------------------------------------------------------------------------------------------------
2             0x2             ZyXEL rom-0 configuration block, name: "dbgarea", compressed size: 6144, uncompressed size: 0, data offset from start of block: 16
7319          0x1C97          LZMA compressed data, properties: 0xD0, dictionary size: 33554432 bytes, uncompressed size: 31360 bytes
8220          0x201C          ZyXEL rom-0 configuration block, name: "spt.dat", compressed size: 39600, uncompressed size: 0, data offset from start of block: 16
8246          0x2036          ZyXEL rom-0 configuration block, name: "autoexec.net", compressed size: 500, uncompressed size: 0, data offset from start of block: 16

LZMA header is "incorrect" it cant be decompressed, maybe its modified do not know, so file has dbgarea, spt.dat, autoexec.net standard block but is it comoressed with "modified" lzs can u tell ?

Here are some notes from RE of "old" rom-0

so I see that righnt now there "is no help" so I will post whole file so u can see whole picture

Heh I have limitation to 30000 chars so here is link of file http://pastebin.com/2X00B6rJ Can any one help me to "reveal" what they did (changed) to lzs compresion, I asume its lzs

Many tnx in advice, cheers

It's been a while since the last time I played with ZynOS roms but they commonly used the old LZMA algorithm for ARM devices (depending on which LZMA version you're using to decompress it may fail, try downloading + building + using the official LZMA version, not the one that comes with your Linux distro) or BZ2 for the MIPS ones. Or may be it was the other way around; sorry, I do not remember now :/ — joxeankoret, Feb 11, 2014 at 8:31
You think its modified or old version of LZMA ? Interesting I will try it for sure, tnx on advice — Vido, Feb 11, 2014 at 13:17
Uhm... by the way, I downloaded the firmware for this device but, in my case, it isn't LZMA but BZ :? Is yours P-660HW-T3_340UU7C0? — joxeankoret, Feb 11, 2014 at 15:23
I cant find that number behind :D Model Number:P-660HW-T3 v3 ZyNOS Firmware Version:V3.70(BYO.0) If u like to see it, I can send it to you — Vido, Feb 11, 2014 at 20:58

internety · Accepted Answer · 2014-03-08 20:09:14Z

it's compressed with LZS ( Lempel-Ziv-Stack ).

I was trying to do the password extraction the pythonic way, it's enought to take a look at this shell script and small piece of c code:

shell + C solution

way of extraction LZS with python

and to replace 'dd' usage in same python script:

def romcutter(fname): import sys fpos=8568 fend=8788 fhandle=file(fname) fhandle.seek(fpos) chunk="*" amount=221 while fpos < fend: if fend-fpos < amount: amount = fend-fpos chunk = fhandle.read(amount) fpos += len(chunk) return chunk

take rom-0, cut it with cutter, and extract result LZS....

internety · Accepted Answer · 2014-03-08 20:14:01Z

it's compressed with LZS ( Lempel-Ziv-Stack ).

I was trying to do the password extraction the pythonic way, it's enought to take a look at this shell script and small piece of c code:

shell + C solution

way of extraction LZS with python

and to replace 'dd' usage in same python script:

    def romcutter(fname):
        import sys
        fpos=8568
        fend=8788
        fhandle=file(fname)
        fhandle.seek(fpos)
        chunk="*"
        amount=221
        while fpos < fend:
            if fend-fpos < amount:
                amount = fend-fpos
                chunk = fhandle.read(amount)
                fpos += len(chunk)
                return chunk

Stack Exchange Network

backup from ZynOS but, can not be decompressed with LZS

2 Answers 2

take rom-0, cut it with cutter, and extract result LZS....

take rom-0, cut it with cutter, and extract result LZS....

Your Answer

Not the answer you're looking for? Browse other questions tagged
static-analysis
unpacking
or ask your own question.

Hot Network Questions

backup from ZynOS but, can not be decompressed with LZS

2 Answers 2

take rom-0, cut it with cutter, and extract result LZS....

take rom-0, cut it with cutter, and extract result LZS....

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged static-analysisunpacking or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
static-analysis
unpacking
or ask your own question.