Sign up here and you can log into the forum!

Unpack SMP firmware

Have a question about devices internals, memory layout, reverse engineering, etc---This is the place for anything so technical that it would cause a n00b's head to 'splode

Unpack SMP firmware   

Postby KAD » Wed Aug 13, 2014 11:24 am

hey just curious if anybody has been able to do this, or has a prefered way of doing this

I feel like I'm sort of cheating on this - I've generally just used rsync to copy everything directly off the SMP while it's running

but with all the dbus errors on SMP, and a few other things, I wonder if rsync is not the best way to go

old unpack tools do not work on SMP firmware
looking at tronik's script for bi2 unpack seems to be the closest to what I would need since it used unsquashfs

but I think the headers or something must be different
it appears the process is to strip the headers, etc so that we'd be left with a valid squashfs image

but how do I know how much to strip off, etc
file or stat commands just show ext3 filesystem, I know that inside is a squashfs image

or maybe this is not possible do to some encryption, etc ...

anyways, I ran rsync on WD new release and have a ext3 firmware image that works
dbus errors are gone, things like rss errors etc are gone
and I even figured out how to boot the thing on an ext2/3 flashdrive
so it looks like my guess about rsync was wrong

but I'm still curious, how would you unpack the firmware :)
If you like my work please consider a Donation. Donate
Please read the appropriate documentation before posting questions! READ ME FAQ WIKI
PM's are for private matters. Post support questions to the appropriate forum, or they will be ignored.
User avatar
KAD
Global Moderator
 
Posts: 5103
Joined: Mon Apr 12, 2010 4:59 pm
Location: Seattle, WA USA

Re: Unpack SMP firmware   

Postby recliq » Sun Aug 17, 2014 6:32 am

it's fairly easy actually... the magic tool is binwalk :ugeek:
Code: Select all
trillian wdtv # unzip wdtvlivegen3_2.02.32.zip
Archive:  wdtvlivegen3_2.02.32.zip
  inflating: wdtvlivegen3.bi2       
  inflating: wdtvlivegen3.bin       
  inflating: wdtvlivegen3.fff       
  inflating: wdtvlivegen3.ver       
  inflating: wdtvlivegen3.info       
trillian wdtv # ls -al
total 360968
drwxr-xr-x 2 root   root        4096 Aug 17 16:29 .
drwx------ 9 root   root        4096 Aug 17 16:28 ..
-rw-r--r-- 1 recliq recliq 183074467 Aug 17 16:28 wdtvlivegen3_2.02.32.zip
-rw-r--r-- 1 root   root    39043136 Aug  4 09:40 wdtvlivegen3.bi2
-rw-r--r-- 1 root   root   138483760 Aug  4 09:40 wdtvlivegen3.bin
-rw-r--r-- 1 root   root     9004032 Aug  4 09:40 wdtvlivegen3.fff
-rw-r--r-- 1 root   root        3194 Aug  8 15:11 wdtvlivegen3.info
-rw-r--r-- 1 root   root         105 Aug  4 09:40 wdtvlivegen3.ver
trillian wdtv # binwalk wdtvlivegen3.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
32            0x20            Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 138480926 bytes,  9844 inodes, blocksize: 131072 bytes, created: Mon Aug  4 09:42:58 2014

trillian wdtv # binwalk -e wdtvlivegen3.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
32            0x20            Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 138480926 bytes,  9844 inodes, blocksize: 131072 bytes, created: Mon Aug  4 09:42:58 2014

trillian wdtv # ls -al
total 360972
drwxr-xr-x  3 root   root        4096 Aug 17 16:29 .
drwx------ 10 root   root        4096 Aug 17 16:29 ..
-rw-r--r--  1 recliq recliq 183074467 Aug 17 16:28 wdtvlivegen3_2.02.32.zip
-rw-r--r--  1 root   root    39043136 Aug  4 09:40 wdtvlivegen3.bi2
-rw-r--r--  1 root   root   138483760 Aug  4 09:40 wdtvlivegen3.bin
drwxr-xr-x  3 root   root        4096 Aug 17 16:29 _wdtvlivegen3.bin.extracted
-rw-r--r--  1 root   root     9004032 Aug  4 09:40 wdtvlivegen3.fff
-rw-r--r--  1 root   root        3194 Aug  8 15:11 wdtvlivegen3.info
-rw-r--r--  1 root   root         105 Aug  4 09:40 wdtvlivegen3.ver
trillian wdtv # ls -al _wdtvlivegen3.bin.extracted/
total 135248
drwxr-xr-x  3 root root      4096 Aug 17 16:29 .
drwxr-xr-x  3 root root      4096 Aug 17 16:29 ..
-rw-r--r--  1 root root 138480926 Aug 17 16:29 20.squashfs
drwxrwxr-x 25 1007 1007      4096 Aug  4 09:42 squashfs-root
trillian wdtv # ls -al _wdtvlivegen3.bin.extracted/squashfs-root/
total 356
drwxrwxr-x 25 1007 1007   4096 Aug  4 09:42 .
drwxr-xr-x  3 root root   4096 Aug 17 16:29 ..
drwxrwxr-x 58 1007 1007   4096 Aug  4 09:37 apps
drwxrwxr-x  2 1007 1007  12288 Aug  4 09:42 bin
drwxrwxr-x  3 1007 1007   4096 Aug  4 09:39 built-in
lrwxrwxrwx  1 1007 1007      9 Aug 17 16:29 conf -> /tmp/conf
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 conf_src
drwxrwxr-x  5 1007 1007   4096 Aug  4 07:06 data
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 dev
drwxrwxr-x 10 1007 1007   4096 Aug  4 09:41 etc
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:42 home
-rwxrwxr-x  1 1007 1007  13504 Aug  4 09:39 init
drwxrwxr-x  3 1007 1007   4096 Mär  6  2013 ixchariot
drwxrwxr-x  8 1007 1007  24576 Aug  4 09:41 lib
-rw-rw-r--  1 1007 1007 145255 Aug  4 09:42 md5sum.txt
drwxrwxr-x  4 1007 1007   4096 Aug  4 09:40 mnt
drwxrwxr-x 10 1007 1007   4096 Aug  4 09:42 opt
drwxrwxr-x 10 1007 1007  65536 Aug  4 09:39 osd
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 proc
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:41 sbin
drwxrwxr-x  3 1007 1007   4096 Aug  4 09:36 share
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 sys
-rw-rw-r--  1 1007 1007   1193 Aug  4 09:42 sysconfig
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 system
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 tmp
drwxrwxr-x  8 1007 1007   4096 Aug  4 09:41 usr
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 usrdata
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 var
drwxrwxr-x 11 1007 1007   4096 Aug  4 09:40 webserver


PS: Congrats to your proceedings! ;)
­WDLXTV Project Maintainer
-:] If you like my contributions feel free to donate for a beer or a new flash drive. ...and always remember: RTFM! (README, FAQ, WIKI) [:-
User avatar
recliq
WDLXTV Team
 
Posts: 5513
Joined: Thu Apr 15, 2010 8:09 am
Location: Kiel, Germany

Re: Unpack SMP firmware   

Postby KAD » Sun Aug 17, 2014 8:49 pm

still teaching me, that's good info, did not know that tool
If you like my work please consider a Donation. Donate
Please read the appropriate documentation before posting questions! READ ME FAQ WIKI
PM's are for private matters. Post support questions to the appropriate forum, or they will be ignored.
User avatar
KAD
Global Moderator
 
Posts: 5103
Joined: Mon Apr 12, 2010 4:59 pm
Location: Seattle, WA USA

Re: Unpack SMP firmware   

Postby mad_ady » Mon Aug 18, 2014 3:22 am

Luckly, it seems to use a standard form of squashfs. For some routers, I had to find the correct binary to unsquash + unlzma the image. But otherwise, binwalk is a great tool.
User avatar
mad_ady
Developer
 
Posts: 4544
Joined: Fri Nov 05, 2010 9:08 am
Location: Bucharest, Romania

Re: Unpack SMP firmware   

Postby bovirus » Thu Jan 08, 2015 9:49 pm

I tested unsquashfs 4.0 tool (under Windows) to unpack the standard wdtvlivegen3.bin file.

I stripped teh first 32bit, the I used unsquashfs 4.0 to unpack the stripepd file (original wd tv live gen3 firmware file elss the first 32bytes).
bovirus
Global Moderator
 
Posts: 95
Joined: Thu Apr 22, 2010 11:42 pm


Return to WDTV Live

Who is online

Users browsing this forum: No registered users and 1 guest