Unpack SMP firmware

[KAD]

hey just curious if anybody has been able to do this, or has a prefered way of doing this

I feel like I'm sort of cheating on this - I've generally just used rsync to copy everything directly off the SMP while it's running

but with all the dbus errors on SMP, and a few other things, I wonder if rsync is not the best way to go

old unpack tools do not work on SMP firmware
looking at tronik's script for bi2 unpack seems to be the closest to what I would need since it used unsquashfs

but I think the headers or something must be different
it appears the process is to strip the headers, etc so that we'd be left with a valid squashfs image

but how do I know how much to strip off, etc
file or stat commands just show ext3 filesystem, I know that inside is a squashfs image

or maybe this is not possible do to some encryption, etc ...

anyways, I ran rsync on WD new release and have a ext3 firmware image that works
dbus errors are gone, things like rss errors etc are gone
and I even figured out how to boot the thing on an ext2/3 flashdrive
so it looks like my guess about rsync was wrong

but I'm still curious, how would you unpack the firmware

[recliq]

it's fairly easy actually... the magic tool is binwalk

Code: Select all

trillian wdtv # unzip wdtvlivegen3_2.02.32.zip
Archive:  wdtvlivegen3_2.02.32.zip
  inflating: wdtvlivegen3.bi2       
  inflating: wdtvlivegen3.bin       
  inflating: wdtvlivegen3.fff       
  inflating: wdtvlivegen3.ver       
  inflating: wdtvlivegen3.info       
trillian wdtv # ls -al
total 360968
drwxr-xr-x 2 root   root        4096 Aug 17 16:29 .
drwx------ 9 root   root        4096 Aug 17 16:28 ..
-rw-r--r-- 1 recliq recliq 183074467 Aug 17 16:28 wdtvlivegen3_2.02.32.zip
-rw-r--r-- 1 root   root    39043136 Aug  4 09:40 wdtvlivegen3.bi2
-rw-r--r-- 1 root   root   138483760 Aug  4 09:40 wdtvlivegen3.bin
-rw-r--r-- 1 root   root     9004032 Aug  4 09:40 wdtvlivegen3.fff
-rw-r--r-- 1 root   root        3194 Aug  8 15:11 wdtvlivegen3.info
-rw-r--r-- 1 root   root         105 Aug  4 09:40 wdtvlivegen3.ver
trillian wdtv # binwalk wdtvlivegen3.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
32            0x20            Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 138480926 bytes,  9844 inodes, blocksize: 131072 bytes, created: Mon Aug  4 09:42:58 2014

trillian wdtv # binwalk -e wdtvlivegen3.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
32            0x20            Squashfs filesystem, little endian, version 4.0, compression:gzip, size: 138480926 bytes,  9844 inodes, blocksize: 131072 bytes, created: Mon Aug  4 09:42:58 2014

trillian wdtv # ls -al
total 360972
drwxr-xr-x  3 root   root        4096 Aug 17 16:29 .
drwx------ 10 root   root        4096 Aug 17 16:29 ..
-rw-r--r--  1 recliq recliq 183074467 Aug 17 16:28 wdtvlivegen3_2.02.32.zip
-rw-r--r--  1 root   root    39043136 Aug  4 09:40 wdtvlivegen3.bi2
-rw-r--r--  1 root   root   138483760 Aug  4 09:40 wdtvlivegen3.bin
drwxr-xr-x  3 root   root        4096 Aug 17 16:29 _wdtvlivegen3.bin.extracted
-rw-r--r--  1 root   root     9004032 Aug  4 09:40 wdtvlivegen3.fff
-rw-r--r--  1 root   root        3194 Aug  8 15:11 wdtvlivegen3.info
-rw-r--r--  1 root   root         105 Aug  4 09:40 wdtvlivegen3.ver
trillian wdtv # ls -al _wdtvlivegen3.bin.extracted/
total 135248
drwxr-xr-x  3 root root      4096 Aug 17 16:29 .
drwxr-xr-x  3 root root      4096 Aug 17 16:29 ..
-rw-r--r--  1 root root 138480926 Aug 17 16:29 20.squashfs
drwxrwxr-x 25 1007 1007      4096 Aug  4 09:42 squashfs-root
trillian wdtv # ls -al _wdtvlivegen3.bin.extracted/squashfs-root/
total 356
drwxrwxr-x 25 1007 1007   4096 Aug  4 09:42 .
drwxr-xr-x  3 root root   4096 Aug 17 16:29 ..
drwxrwxr-x 58 1007 1007   4096 Aug  4 09:37 apps
drwxrwxr-x  2 1007 1007  12288 Aug  4 09:42 bin
drwxrwxr-x  3 1007 1007   4096 Aug  4 09:39 built-in
lrwxrwxrwx  1 1007 1007      9 Aug 17 16:29 conf -> /tmp/conf
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 conf_src
drwxrwxr-x  5 1007 1007   4096 Aug  4 07:06 data
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 dev
drwxrwxr-x 10 1007 1007   4096 Aug  4 09:41 etc
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:42 home
-rwxrwxr-x  1 1007 1007  13504 Aug  4 09:39 init
drwxrwxr-x  3 1007 1007   4096 Mär  6  2013 ixchariot
drwxrwxr-x  8 1007 1007  24576 Aug  4 09:41 lib
-rw-rw-r--  1 1007 1007 145255 Aug  4 09:42 md5sum.txt
drwxrwxr-x  4 1007 1007   4096 Aug  4 09:40 mnt
drwxrwxr-x 10 1007 1007   4096 Aug  4 09:42 opt
drwxrwxr-x 10 1007 1007  65536 Aug  4 09:39 osd
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 proc
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:41 sbin
drwxrwxr-x  3 1007 1007   4096 Aug  4 09:36 share
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 sys
-rw-rw-r--  1 1007 1007   1193 Aug  4 09:42 sysconfig
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 system
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 tmp
drwxrwxr-x  8 1007 1007   4096 Aug  4 09:41 usr
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 usrdata
drwxrwxr-x  2 1007 1007   4096 Aug  4 09:40 var
drwxrwxr-x 11 1007 1007   4096 Aug  4 09:40 webserver


PS: Congrats to your proceedings!

[KAD]

still teaching me, that's good info, did not know that tool

[mad_ady]

Luckly, it seems to use a standard form of squashfs. For some routers, I had to find the correct binary to unsquash + unlzma the image. But otherwise, binwalk is a great tool.

[bovirus]

I tested unsquashfs 4.0 tool (under Windows) to unpack the standard wdtvlivegen3.bin file.

I stripped teh first 32bit, the I used unsquashfs 4.0 to unpack the stripepd file (original wd tv live gen3 firmware file elss the first 32bytes).