4

I am able to telnet into a router that's running a customized linux firmware. It was compiled using 'buildroot'.

I was able to dig out some specs of the router. I intend to clone the router's firmware for further study. 'dd' is not available so I tried using cat to throw the entire contents of the flash drive (mtdblock0) to my pc using netcat:

Router:

cat /dev/mtdblock0 | nc ip port

PC:

nc -lp port > routerFirmware

Then on my PC I used 'binwalk' to examine the downloaded file. The result is:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: xxxxxxx bytes, xxx inodes, blocksize: xxxxxx bytes, created: xxxx-xx-xx xx:xx:xx

Seems good so far. But '# unsquash routerFlash' results in:

Can't find a SQUASHFS superblock on routerFlash

The most probable reason I think is that 'cat' and 'nc' are not able to clone the entire flash as I intend. I am stuck here. Any help would be appreciated!

migrated from serverfault.com Dec 14 '17 at 14:39

This question came from our site for system and network administrators.

2

Turns out the 'cloning' step was not the problem. My router vendor had used non-standard 'magic number' to create the squashfs system. I was advised to give sasquatch a shot. Fortunately, sasquatch correctly read and understood the file compression and other details, which unsquash didn't report correctly.

Result: I have a replica of my router firmware on my PC which I can study and analyze, just as I wanted. Looks good so far.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.