search

devttys0 / sasquatch

501 stars 155 forks source link

Different-endian filesystem not extractable #13

Closed WereCatf closed 6 years ago

WereCatf commented 7 years ago

Binwalk says the following:

Squashfs filesystem, big endian, version 4.0, compression:xz, size: 15229650 bytes, 6054 inodes, blocksize: 65536 bytes, created: 1970-06-26 06:27:30

Alas, sasquatch fails at extracting the files:

sasquatch -major 4 -minor 0 -be -c xz -f ../mmcblk0p1 Non-standard SquashFS Magic: Reading a different endian SQUASHFS filesystem on ../mmcblk0p1 FATAL ERROR:Block size or block_log too large. File system is corrupt.

I know the filesystem is not corrupt, so I can only hazard a guess that sasquatch gets the endianness wrong on one or another value.

devttys0 commented 7 years ago

Sasquatch works on other big endian squashfs file systems, so it would seem unlikely that it is treating some/all of the fields incorrectly. I think it's more likely that this file system has had some custom modifications made to it.

What leads me to this conclusion is that the squashfs header claims that it is big endian and v4.0. These do not exist, as SquashFS v4.0 moved to a fixed little-endian format (even for big-endian systems). So either the header is wrong, or someone has made some customizations to the SquashFS 4.0 standard.

WereCatf commented 7 years ago

Well, I don't dispute any of that, I know nothing about Squashfs's internals. I only know the image contains a working filesystem because it comes from a live system.