# How to extract N150R firmware from .img file

I'm trying to mount an img file for my wireless router firmware but I can't seem to do it successfully.

When I fun the file command on that .img it returns the following:

$file file.img file.img: data  When I try to use mount on it I get the following: $ sudo mount file.img test/
mount: you must specify the filesystem type


When I try to tell to use "-t auto" I get the same output:

$sudo mount -t auto file.img test mount: you must specify the filesystem type  xxd returns the following: $ xxd -a N150R-V1.0.0.5_1.0.1.img | head
0000000: 6465 7669 6365 3a4e 3135 3052 0a76 6572  device:N150R.ver
0000010: 7369 6f6e 3a56 312e 302e 302e 355f 312e  sion:V1.0.0.5_1.
0000020: 302e 310a 7265 6769 6f6e 3a0a 0000 0000  0.1.region:.....
0000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
*
0000070: 0000 0000 0000 0000 0000 0000 0000 1232  ...............2
0000080: 3036 3132 d9cf 3fc1 5297 2c87 0033 eed0  0612..?.R.,..3..
0000090: 9f05 0000 9f05 0000 9b63 9e62 0505 0700  .........c.b....
00000a0: 4e31 3530 522d 5631 2e30 2e30 2e35 5f31  N150R-V1.0.0.5_1
00000b0: 2e30 2e31 0000 0000 0000 0000 0000 0000  .0.1............


binwalk gives the following:

$binwalk N150R-V1.0.0.5_1.0.1.img DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 192 0xC0 Squashfs filesystem, big endian, version 3.0, size: 3403472 bytes, 1024 inodes, blocksize: 65536 bytes, created: 2013-11-28 11:44:07  fdisk (on OS X) returns: $ fdisk N150R-V1.0.0.5_1.0.1.img
Disk: N150R-V1.0.0.5_1.0.1.img  geometry: 26/4/63 [6656 sectors]
Signature: 0x95EB
Starting       Ending
#: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
1: 02  648  41  48 -  107 220  28 [ 275573942 - 2530152094] XENIX /
2: C9  165 158   8 -  311  15  40 [1825336399 - 3160300718] <Unknown ID>
3: 12  606 153  51 -  988 164  42 [3547124620 - 4171149652] Compaq Diag.
4: BD  479 182  60 -  173 155  40 [2642289636 - 1573814809] <Unknown ID>


Could I get some guidance on how to extract the files from the img? I have access to both OS X and Ubuntu.

EDIT 1: Result of sasquatch:

$sasquatch N150R-V1.0.0.5_1.0.1.img SquashFS version [24373.11825] / inode count [1312449891] suggests a SquashFS image of a different endianess Non-standard SquashFS Magic: devi Reading a different endian SQUASHFS filesystem on N150R-V1.0.0.5_1.0.1.img Filesystem on N150R-V1.0.0.5_1.0.1.img is (13663:12590), which is a later filesystem version than I support!  ## 2 Answers The SquashFS image is version 3.0 with LZMA compression; LZMA compression was not officially added to SquashFS until version 4.0, so standard SquashFS tools won't recognize it. However, sasquatch extracts it just fine for me. In fact, if you have sasquatch installed, the latest version of binwalk will use it to auto-extract the file system if you run binwalk with the -e option. UPDATE: You need to give sasquatch the SquashFS image, not the raw firmware image. First, extract it with dd and then run sasquash against the extracted file: $ dd if=N150R-V1.0.0.5_1.0.1.img bs=192 skip=1 of=fs.squashfs
$sasquatch fs.squashfs  The latest version of binwalk does this for you automatically with the -e option: $ binwalk -e N150R-V1.0.0.5_1.0.1.img


You can force older versions of binwalk to use sasquatch as well:

\$ binwalk --dd='squashfs:squashfs:sasquatch %e' N150R-V1.0.0.5_1.0.1.img

• I have updated the main post with the output from sasquatch. It didn't work =/ – RNikoopour Nov 28 '14 at 22:44
• You need to give sasquatch the SquashFS image, not the raw firmware image. I've updated my answer above with details. – devttys0 Nov 29 '14 at 23:29
• Thank you so much. I really appreciate your help! Could you explain how the dd command extracts the file image? – RNikoopour Nov 30 '14 at 18:44
• The dd command above just copies data from the input file ('if=N150R-V1.0.0.5_1.0.1.img') to some output file of your choosing ('of=fs.squashfs'). You want to start copying bytes at offset 192, which is where the squashfs image starts, according to binwalk. So, just set the copy block size to 192 bytes ('bs=192'), and tell dd to skip the first block, i.e., skip the first 192 bytes ('skip=1'). – devttys0 Nov 30 '14 at 19:43
• That explanation was perfect. Thank you so much for your help! – RNikoopour Nov 30 '14 at 19:58

If you don't want to install yet another tool, it will probably mount if you strip off the header (the first 192 Bytes that binwalk talks about):

dd if=file.img of=file.squashfs bs=192 skip=1
sudo mount file.squashfs test/


EDIT:

Since the router seems to have a big-endian Mips processor, mounting didn't work for me either. The following worked on Ubuntu 14.04 however:

apt-get install liblzo2-dev
git clone https://github.com/devttyS0/sasquatch
make
sasquatch /path/to/file.squashfs


(Obviously, you need git, make, gcc installed as well. liblzo2-dev was the only dependency i hadn't installed before. I had to used the file prepared with dd as shown above, not the original .img).

In case you can't get it to work, here's the extracted file:

https://mega.co.nz/#!xFoQkZRB!lcdUdDVGKsgEeu8Q5HnL3BSBXJKCHe0jZkGwOyTSxlQ

• This didn't work for me. Thank you though – RNikoopour Nov 28 '14 at 22:41
• Even if the image was little endian, it unfortunately would still likely not mount due to the non-standard compression. Embedded SquashFS images tend to be a PITA unfortunately. – devttys0 Nov 29 '14 at 23:31