Unpacking a ZTE ZXV10 H108L router firmware
Posted
by
v3ng3ful
on Super User
See other posts from Super User
or by v3ng3ful
Published on 2012-09-03T08:52:49Z
Indexed on
2012/09/03
9:40 UTC
Read the original article
Hit count: 2274
I binwalked a firmware of a ZTE ZXV10 H108L, and got some encouraging results of uImage uboot, and LZMA compression, as well as a Squashfs 3.0 LZMA compressed filesystem.
256 0x100 uImage header, header size: 64 bytes, header CRC: 0xE70BCBB9, created: Thu Nov 10 04:54:54 2011, image size: 804172 bytes, Data Address: 0x80002000, Entry Point: 0x80266000, data CRC: 0x6EFE90F1, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: MIPS Linux-2.6.20
320 0x140 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2637958 bytes
851968 0xD0000 Squashfs filesystem, big endian, lzma signature, version 3.0, size: 2543403 bytes, 632 inodes, blocksize: 65536 bytes, created: Thu Nov 10 04:56:12 2011
Now what I did is, to test several portions of the file (320byte-end, 851968byte-end, and many more) using dd, and trying with certain tools to uncompress/unpack the filesystem of the firmware. After some digging I found out the best tool to do this is the firmware_mod_kit, that understands a squashfs-lzma v3 filesystem. Although I ended up really frustrated as unsquashfs-lzma v3 reported a cold "zlib::uncompress failed, unknown error -3". Do you have any ideas? Could it be that, the firmware is corrupted on purpose to discourage attempts like this? Router file
Thanks
© Super User or respective owner