While poking around at the headers and such from my new Simple.TV DVR, I found it downloading a file named rssflash_1035_201311211539.update00.bin. I ran binwalk to look for anything obvious, but it came up blank. I suspect it might be encrypted (?). Any thoughts about what I could do next to get more information about this?

The download link to the file, in case anyone else is interested: [redacted]



If you look at the file with a hex editor (or even a text editor), you can see that the first four bytes of the file are hsqs (0x68 0x73 0x71 0x73).

If you then Google for hsqs, the first link explains that it's the beginning of a SquashFS image.

  • 1
    It is odd though that binwalk doesn't report anything, as per OP. Jul 14 '14 at 6:57

Use a current. up to date version of binwalk, it works fine

$ binwalk rssflash_1035_201311211539.update00.bin 

0             0x0             Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 83899310 bytes,  3291 inodes, blocksize: 131072 bytes, created: Fri Nov 22 00:48:15 2013

Or you can use Firmware Mod Kit's unsquash-all to unsquash it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.