2

I have a file I am trying to extract to view and I'm stuck... If I use binwalk I am able to get the gunzip file but unable to extract it... If I attempt to extract with gunzip I return the errors and if I use binwalk, when I get a file 0.gz. It will remain in a 'loop' meaning I can continue to extract it over and over again with binwalk ending up in with a 'directory loop'. Does anyone know a solution to this? am I doing it all wrong?

root@svr3:/home/monday_home_test# file testfile
testfile: VCDIFF binary diff
root@svr3:/home/monday_home_test# binwalk --extract testfile 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
465           0x1D1           gzip compressed data, from Unix, last modified: Sun Sep 28 08:49:05 2014

root@svr3:/home/monday_home_test# 
root@svr3:/home/monday_home_test/_testfile.extracted# ls
1D1.gz
root@svr3:/home/monday_home_test/_testfile.extracted# binwalk --extract 1D1.gz 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             gzip compressed data, from Unix, last modified: Sun Sep 28 08:49:05 2014

root@svr3:/home/monday_home_test/_testfile.extracted# ls
1D1.gz  _1D1.gz.extracted
root@svr3:/home/monday_home_test/_testfile.extracted# cd _1D1.gz.extracted/
root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted# ls
0.gz

root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted/_0.gz.extracted/_0.gz.extracted# ls
0.gz
root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted/_0.gz.extracted/_0.gz.extracted#  binwalk --extract 0.gz 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             gzip compressed data, from Unix, last modified: Sun Sep 28 08:49:05 2014

root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted/_0.gz.extracted/_0.gz.extracted# ls
0.gz  _0.gz.extracted
root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted/_0.gz.extracted/_0.gz.extracted#     

Gunzip Errors

root@svr3:/home/monday_home_test/_testfile.extracted# gunzip --decompress 1D1.gz         
gzip: 1D1.gz: invalid compressed data--format violated
root@svr3:/home/monday_home_test/_testfile.extracted/_1D1.gz.extracted# gunzip --decompress 0.gz 
gzip: 0.gz: invalid compressed data--format violated
2

It looks like VCDIFF is not a standalone container, but a binary patch file, intended to be applied on top of some already existing data. The results from binwalk are likely false positives.

If you don't have the original data, you're unlikely to extract anything meaningful from it. That said, you can check the RFC3284 describing the file format, or some of the tools listed in the Wikipedia article.

| improve this answer | |
  • Yes this file is used with xdelta to apply a patch to another file. xdelta -d -f -s firmware.dav testfile firmware.patched.dav What I am trying to do is the testfile should have a serial number in it and I would like to view the serial number that is in the testfile that is applied to the firmware.patched.dav – tdotr6 Sep 29 '14 at 21:28
  • I would assume the patch leaves the serial number alone. – Igor Skochinsky Sep 29 '14 at 21:54
  • Well what the patch does is change the language region variable from a 2 to a 1 , but the patch only works on a device that was the provided serial number. So without any other information other than the serial number, it must be in the patch file. You can flash the patched firmware on any device and the firmware will work, but the language will remain to be 2. I test this on the device with - VAR=dd if=/dev/mtd5ro skip=1620 bs=1 count=1 2>/dev/null ; if [ $VAR == $'\002' ]; then echo Chinese ; elif [ $VAR == $'\001' ]; then echo English ; else echo Unknown; fi – tdotr6 Sep 30 '14 at 0:25
  • Well, I guess then you'll have to parse the file (using the RFC or the tools) and see how it checks what patches to apply. – Igor Skochinsky Sep 30 '14 at 1:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.