ReFirmLabs / binwalk

Firmware Analysis Tool
MIT License
10.77k stars 1.54k forks source link

Failures in extractors are ignored #580

Closed AndrewFasano closed 1 week ago

AndrewFasano commented 2 years ago

Jefferson is used by binwalk to extract JFFS2 file systems. However, the head of jefferson is currently broken (https://github.com/sviehb/jefferson/issues/33) so when binwalk tries to use it, the filesystem isn't extracted.

The current behavior is that no files are extracted when you run binwalk on a JFFS2 filesystem (or a file which contains a JFFS2 filesystem). I think binwalk would be better if it detected and raised these sorts of errors by default.

The error can be seen if you run binwalk in debug mode python3 -Om binwalk --run-as=root -e A3.jffs2:

...
DEBUG: Extractor callback for A3.jffs2 @0 [JFFS2 filesystem, little endian]
DEBUG: Found 1/42 matches for 'jffs2 filesystem, little endian'
DEBUG: Found 1 matching extraction rules
DEBUG: Changing directory to: /fw/_A3.jffs2-0.extracted
DEBUG: Processing extraction rule #0 (jefferson -d '%%jffs2-root%%' '%e')
DEBUG: Extracting /fw/A3.jffs2[0:] to None
DEBUG: Carved data block 0x0 - 0xD49907 from '/fw/A3.jffs2' to '0.jffs2'
DEBUG: Executing extraction command jefferson -d '%%jffs2-root%%' '%e'
DEBUG: Running extractor 'jefferson -d '%%jffs2-root%%' '%e''
DEBUG: subprocess.call(jefferson -d 'jffs2-root' '0.jffs2', stdout=None, stderr=None)
Traceback (most recent call last):
  File "/usr/local/bin/jefferson", line 513, in <module>
    main()
  File "/usr/local/bin/jefferson", line 484, in main
    fs_list = list(scan_fs(content, cstruct.BIG_ENDIAN, verbose=args.verbose))
  File "/usr/local/bin/jefferson", line 271, in scan_fs
    set_endianness(endianness)
  File "/usr/local/bin/jefferson", line 262, in set_endianness
    Jffs2_device_node_new.__fmt__ = endianness + Jffs2_device_node_new.__fmt__[1:]
AttributeError: type object 'Jffs2_device_node_new' has no attribute '__fmt__'
DEBUG: External extractor command "jefferson -d 'jffs2-root' '%e'" completed with return code 1 (success: False)
DEBUG: Ran extraction command: jefferson -d 'jffs2-root' '0.jffs2'
DEBUG: Extraction successful: False

Perhaps this could be improved by simply printing a warning when there's only a single external extractor available and it fails.