5

im having trouble to extract a file system of a ZTE zxv10 h201 router. Im a beginner in reverse engineering so I am probably doing something wrong. This is what I have done so far. I got the admin username and password for the web interface and enabled telnet. I connected to the router using telnet 

BusyBox v1.01 (2012.01.29-08:14+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

# cat proc/mtd 
dev:    size   erasesize  name
mtd0: 00800000 00010000 "whole_flash"
mtd1: 00020000 00010000 "bootloader"
mtd2: 00040000 00010000 "userconfig"
mtd3: 00150000 00010000 "kernel"  
mtd4: 00650000 00010000 "filesystem"
# 
# help

Built-in commands:
-------------------
    . : break cd chdir continue eval exec exit export false hash
    help local pwd read readonly return set shift times trap true
    type ulimit umask unset wait [ ash brctl busybox cat cp date
    df echo free fuser getty hostname ifconfig init insmod kill killall
    linuxrc ln login ls lsmod mkdir mknod mount mv passwd ping ps
    pwd reboot rm rmdir rmmod setmac sh test tftp top traceroute
    umount wget

#

Then I used

# cat /dev/mtdblock4 > /mnt/usb1_1/filesystem
# cat /dev/mtdblock0 > /mnt/usb1_1/whole_flash

To transfer the binary to the usb plugged in the router. This is what i got with binwalk whole_flash 

    DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1288          0x508           CFE boot loader
7204          0x1C24          LZMA compressed data, properties: 0x5D, dictionary size: 4194304 bytes, missing uncompressed size
131708        0x2027C         Zlib compressed data, compressed
148092        0x2427C         Zlib compressed data, compressed
184956        0x2D27C         PEM RSA private key
185919        0x2D63F         PEM certificate
197244        0x3027C         Zlib compressed data, compressed
262780        0x4027C         Zlib compressed data, compressed
328316        0x5027C         Zlib compressed data, compressed
328640        0x503C0         Zlib compressed data, compressed
328844        0x5048C         Zlib compressed data, compressed
             .....
346480        0x54970         Zlib compressed data, compressed
346956        0x54B4C         Zlib compressed data, compressed
347388        0x54CFC         Zlib compressed data, compressed
347820        0x54EAC         Zlib compressed data, compressed
348252        0x5505C         Zlib compressed data, compressed
348684        0x5520C         Zlib compressed data, compressed
393484        0x6010C         LZMA compressed data, properties: 0x5D, dictionary size: 4194304 bytes, missing uncompressed size
1769472       0x1B0000        Squashfs filesystem, big endian, version 2.0, size: 5866724 bytes, 638 inodes, blocksize: 65536 bytes, created: Sun Jan 29 09:31:45 2012

Im having issues with the filesystem binary because non of the unsquashfs versions in the firmware modification kit "works" properly for me because all I get is 307,0 kB worth of files.

Improve this question
2

2 Answers 2

Reset to default
-1

I have same device, you can try this busybox which I compiled for that device, just type ./busybox_unstripped dd in order to use dd

./busybox_unstripped 
BusyBox v1.13.4 (2017-03-09 17:30:22 CET) multi-call binary
Copyright (C) 1998-2008 Erik Andersen, Rob Landley, Denys Vlasenko
and others. Licensed under GPLv2.
See source distribution for full notice.

Usage: busybox [function] [arguments]...
   or: function [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use and BusyBox
        will act like whatever it was invoked as!

Currently defined functions:
        ash, bunzip2, bzcat, cat, cp, cut, date, dd, echo, expr, false, free,
        grep, halt, head, hostname, ifconfig, init, ip, kill, killall, klogd,
        ln, ls, mkdir, mount, ping, poweroff, ps, reboot, renice, rm, route,
        sh, sleep, syslogd, tail, true, umount, wc

I also found firmware on internet for that device which you could download here

Improve this answer
-3

You should not be using "cat". "cat" was made thinking about printable characters and it is very likely that THAT is your problem. Something might be messed up after "cat", causing the trouble with filesystem recognition.

Use "dd" for reliable byte-by-byte copies.

Improve this answer
5
  • I dont have dd. I pasted all the built in commands in my question. Maybe cat is the problem idk.
    – tehcereal
    Nov 4, 2014 at 19:17
  • Did you look inside the system folders to see if you have any extra binaries? Vendors compile their own version of programs to be used with the firmware.
    – DarkLighting
    Nov 4, 2014 at 19:35
  • 4
    Sorry, but this is nonsense. 'cat' does a byte by byte copy. The advantage of dd is that i/o can be blocked, with variable block sizes, and it does a better job at error checking.
    – Guntram Blohm
    Jun 3, 2015 at 18:25
  • So, if you said yourself that cat's error checking might be the failing point, why do you tell it is nonsense?
    – DarkLighting
    Jun 5, 2015 at 18:44
  • @DarkLighting because your claim was that cat only can deal with printable characters (or was designed only with those in mind). Which simply is untrue, as Guntram correctly pointed out.
    – 0xC0000022L ♦
    Dec 15, 2021 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.