I'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200.
I've decompiled it successfully with FMK v0.99 and got the
rootfs.img and the
footer.img image parts.
This is the binwalk of rootfs.img:
Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: 2764423 bytes, 1145 inodes, blocksize: 65536 bytes, created: Fri Mar 15 00:33:08 2013
I decompiled the rootfs.img with unsquashfs succesfully and got the system folders. I made some changes (enabled a shell on telnet) and tried to repack everything with the tools provided (the
The final firmware size was bigger than the original one. Tried to falsh, nothing happened. I analyzed the firmware and especially the upgrade method to learn how to properly build the firmware.
I found the
update.sh file which handles the upgrade process (analyzes the file provided by the user and flashes only if everything is correct, in order to prevent brick)
I'm pretty sure that the original firmware files are parsed through the
parse_yaps_image() function, so I tried adapting on my own to check the files but I noticed that there was an external check with a binary file called
If the files doesn't exists another function is invoked, the problem is that the function provided isn't correct (it return a
wrong validation token error even with original firmwares!)
My goal is to analyze the
sig_verify file and look for the algorithm, in order to understand the composition method and in order to flash my router in the proper way and finally get the root shell (and make modification on everything I want)
I uploaded all files on a Mega folder so the interesed guys who wanna help me could access any file needed.
I included in the folder 60208 the two scripts I used to check the files.
The result of the script I wrote (it's just the adaptation of the script in the router) is this:
denys@denys-pc:~/Documents/router/Vx226N1/images/modified/60208$ ./check_upgrade_yaps.sh Parsing YAPS format... 16+0 records in 16+0 records out 16 bytes (16 B) copied, 0.000843843 s, 19.0 kB/s Error: wrong validation token (5b445d3b251d59753031c9d7a94ba4ab, 7d98668859855f1b9459256257fc3262)
And here is the binwalk of
denys@denys-pc:~/Documents/router/Vx226N1/images/modified/60208$ binwalk sig_verify DECIMAL HEX DESCRIPTION ------------------------------------------------------------------------------------------------------- 0 0x0 ELF 32-bit MSB executable, MIPS, version 1 1921 0x781 LZMA compressed data, properties: 0x01, dictionary size: 16777216 bytes, uncompressed size: 16777472 bytes
As you can notice it's a MIPS executable.
I tried to run it under a MIPS envirronment (virtual machine,
qemu-system-mips) without any success.
qemu-system-mips -M mips -kernel ./vmlinux-2.6.18-6-qemu -initrd ./initrd.gz -hda hda.img -append "root=/dev/ram console=ttyS0" -nographic
The kernel and the initrd were downloaded by http://archive.debian.org/debian/dists/etch/main/installer-mips/current/images/qemu/netboot/
Any help would be appreciated. If someting isn't clear just let me know :)
--- EDIT ---
Decompiled... Anyone that could translate machine language into human-comprehensible code?