1

I have managed to get a root shell on my web filtering router by plugging into a UART on the PCB which allowed me to see a process (lockbox.bin - ELF executable) running which handles most of the filtering functions. After extracting the lockbox.bin file and analyzing it with IDA pro, I've made some modifications to the file. I now need to get it back on the device to see if the changes worked, but when I try to make changes to the filesystem I get a message saying that the file system is read only. I suppose it's only a matter of mounting the filesystem as read/write, but I'm not sure how to do that (Access the boot loader?). The Busybox instance on the device is missing the mount command. The router in question is a re-branded realtek rtl8196b.

Any Suggestions?

Disclaimer: This is the first time that I've have done something like this so I may be missing a very basic step. Any help would be appreciated.

Improve this question

1 Answer 1

Reset to default
1

It's very probable that the firmware is stored in a squashfs image, which is compressed (and supposed to be read-only - it can't be mouted read-write, but must be created through external means), The squashfs image will probably be stored in some piece of flash ram, which can be accessed as /dev/mtbn on many linux embedded devices, which multiple values of n refering to different parts of the firmware (boot loader etc.).

Often, the boot loader itself is in /dev/mtb0, and has commands to write to the other /dev/mtb blocks.

So, your course of action would be

  • dump the various /dev/mtb blocks to files, check which is a squashfs, or maybe different type of file system, that contains your lockbox.bin
  • rebuild that filesystem with your different version of lockbox.bin, and hope it doesn't grow significantly larger to exceed the size of the /dev/mtb block
  • check how to boot to the boot loader from outside, without starting linux
  • use some boot loader to flash that filesystem to the router
  • reboot the router, and hope you didn't brick it in the process.

As you say

This is the first time that I've have done something like this

the chance of

brick it in the process.

is certainly non-zero, so proceed with caution.

Improve this answer
1
  • Thanks for the information and Advice. Step 1: I did that and found the file system under /dev/mtd. I has a squashFS files sytem (also under the device as /dev/mtdblock1) Step 2: Do you just rebuild the file system using the directory structure of the host that you are working on? Step 3: Any suggestions on where to start looking? Step 4: Same. Once again, thanks for your help.
    – Nopslide
    Oct 26, 2014 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.