I am able to telnet into a router that's running a customized linux firmware. It was compiled using 'buildroot'.

I was able to dig out some specs of the router. I intend to clone the router's firmware for further study. 'dd' is not available so I tried using cat to throw the entire contents of the flash drive (mtdblock0) to my pc using netcat:


cat /dev/mtdblock0 | nc ip port


nc -lp port > routerFirmware

Then on my PC I used 'binwalk' to examine the downloaded file. The result is:

0             0x0             Squashfs filesystem, little endian, non-standard signature, version 4.0, compression:gzip, size: xxxxxxx bytes, xxx inodes, blocksize: xxxxxx bytes, created: xxxx-xx-xx xx:xx:xx

Seems good so far. But '# unsquash routerFlash' results in:

Can't find a SQUASHFS superblock on routerFlash

The most probable reason I think is that 'cat' and 'nc' are not able to clone the entire flash as I intend. I am stuck here. Any help would be appreciated!

1 Answer 1


Turns out the 'cloning' step was not the problem. My router vendor had used non-standard 'magic number' to create the squashfs system. I was advised to give sasquatch a shot. Fortunately, sasquatch correctly read and understood the file compression and other details, which unsquash didn't report correctly.

Result: I have a replica of my router firmware on my PC which I can study and analyze, just as I wanted. Looks good so far.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.