4

I'm a newbie to reverse engineering, so pardon my ignorance. I am trying to extract the complete filesystem from a Netgear router's firmware. Using binwalk, I was able to extract the kernel and a squashfs file system. So far so good. The issue is that the file system is incomplete. Many directories (e.g. /etc, /mnt, /var, /www) are only symbolic links to non-existent directories in /tmp, which itself is empty.

I'm guessing that (as I've seen on other routers) the contents of /tmp will be another filesystem that is created on startup and stored in RAM. Am I correct? And is there some way of determining the contents of the temporary filesystem from the firmware?

Improve this question
3
  • You might find that it populates the tempfs on boot via an init script. I'd normally suggest looking in /etc/init.d but you mention that path lives in the tempfs itself. If you could link to the download page for the firmware, it could help in getting more specific information.
    – booto
    Commented Mar 24, 2015 at 2:56
  • @booto: There is an init file, and I'd already suspected it might be what I was looking for, but being new to all this, I wasn't sure how to get into it. (BTW it's just a link to busybox, so it may be a red herring).
    – P Jones
    Commented Apr 6, 2015 at 0:36
  • @booto: the router model number is WNR1000v3. The Netgear support site is here.
    – P Jones
    Commented Apr 6, 2015 at 0:38

3 Answers 3

Reset to default
4

I checked the newest firmware of WNR1000v3 and I could extract /etc and /www folders without any problem using binwalk v2.0.0.

You can get a lot of useful information about the whole system if you download the GPL codes http://kb.netgear.com/app/answers/detail/a_id/2649/~/netgear---open-source-code-for-programmers-(gpl).
As I see from the GPL code, the router starts with the /sbin/rc file, which initializes the mounts, networks, etc and starts services. The tmp folder is generally a ramfs, which is mounted from rc with the following line:

mount("ramfs", "/tmp", "ramfs", MS_MGC_VAL, NULL);
Improve this answer
2

Try the extract-firmware.sh from the firmware-mod-kit ->

https://code.google.com/p/firmware-mod-kit/wiki/Documentation?tm=6

Improve this answer
2
  • Thanks! I wI'll try it out tonight and let you know how it goes.
    – P Jones
    Commented Mar 23, 2015 at 13:05
  • Sorry for the delay. Busy, busy, busy. Although I'm happy to have been shown a new tool (with seems to have some features that I'd like to play with) the firmware mod kit got me essentially the same result as binwalk. I've already extracted the firmware and a filesystem. What I need is to know how to get the temp filesystem that's written at startup.
    – P Jones
    Commented Apr 6, 2015 at 0:22
0

If you have access to the model, pickup a cheep JTAG interface, and get hacking. Now If that's not possible, I'd check out QEMU for vitalizing the firmware. and getting a shell to play with.

I highly recommend checking out devttys0 blog series "exploiting embedded systems" parts 1 to 4. http://www.devttys0.com/2011/09/exploiting-embedded-systems-part-1/

In part 4 he's using QEMU as an exploit dev environment. Great stuff!

Improve this answer
1
  • The JTAG interface is a bit out of my skill set at the moment, but I may work to change that, As for QEMU and devttys0 I will look into that right away. His blog has been very helpful so far. Thanks for your help!
    – P Jones
    Commented Apr 6, 2015 at 0:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.