Dumping firmware through mtdblock device

Question

This is my first attempt at doing some reverse engineering. I'm trying to dump the filesystem off a huawei hg523a TalkTalk router.

The problem is its quite limited in the amount of programs that are on the device. Below are a list of programs i can use.

BusyBox vv1.9.1 (2012-03-05 00:16:52 CST) multi-call binary
Currently defined functions:
        [, [[, arp, ash, cat, chmod, chown, cp, date, echo, ftpget,
        ftpput, halt, ifconfig, init, kill, killall, linuxrc,
        ln, ls, mcast, mkdir, mknod, mount, netstat, nslookup,
        ping, poweroff, ps, reboot, rm, route, sh, sleep, test,
        top, traceroute, umount, vconfig, wget

So im trying to extract the filesystem to another linux machine so i can go through it more eaisely. I can upload single files with the ftpput command.

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00010000 00001000 "boot"
mtd1: 00001000 00001000 "flag"
mtd2: 003c0000 00001000 "main"
mtd3: 0002d000 00001000 "config"

What im trying to do is upload mtdblock0-3 and then mount this on my other machine to explore the folder structure etc.. It looks like from /proc/mounts that it is a squashfs file system.

cat /proc/mounts
rootfs / rootfs rw 0 0
/dev/root / squashfs ro 0 0
none /dev tmpfs rw 0 0
/proc /proc proc rw 0 0
none /var tmpfs rw 0 0
none /tmp tmpfs rw 0 0
none /mnt tmpfs rw 0 0

So basically i upload the mtdblock0.

ftpput -s -v -u james -p password -l /dev/mtdblock0 -r ftpdir/mtdblock0 192.168.1.64

and mount it on the other computer with:

root@kali:~/Desktop/talktalk/blocks# mount -t squashfs mtdblock0 /mnt
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

Could anyone guide me in the right direction as to what i might be doing wrong? So it not possible to transfer the filesystem in this way?

thank you in advance for your help.

Answer 1

As the names in /proc/mtd suggest, mtd0 is probably not a file system, but more likely is the boot loader. Likewise, the name of mtd3 suggests that it contains the saved configuration settings (admin password, wireless settings etc).

The "flags" and "main" names for mtd1 and mtd2 respectively are a bit ambiguous, but I would expect, due to the name and the size, that mtd2 contains the file system. It also probably contains the Linux kernel as well, so the file system may not start at the beginning of mtd2; once you've ftp'd off a copy of mtd2 you'll have to find the start of the file system and dd it out in order to extract/mount it.

As a side note, don't be surprised if once you find the squashfs file system, your Linux host can't mount it. There are many hacked up versions of squashfs, and you may need to find the right squashfs tools for that particular version and run unsquashfs on the image to extract the files.

Answer 2

I found the solution with devttys0's comment.

mtdblock2 contained the file system. This is obvious by the fact that it is larger in size than the other mtd devices. I ftpd this file and I then downloaded the firmware mod kit which has a script which goes through all the unsquashfs versions and attempts to extract the firmware. In this case it worked using version quashfs-3.2-r2-hg612-lzma.

Answer 3

You can do cat /proc/mtd for the exact "image"

cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 01000000 00001000 "whole_flash"
mtd1: 00020000 00001000 "bootloader"
mtd2: 00060000 00001000 "userconfig"
mtd3: 004c0000 00001000 "filesystem1"
mtd4: 00300000 00001000 "kernel1"
mtd5: 00300000 00001000 "kernel2"
mtd6: 004c0000 00001000 "filesystem2"