devttys0 / sasquatch

501 stars 155 forks source link

Unable to extract squashfs #52

Open agoodm88 opened 1 year ago

agoodm88 commented 1 year ago

I am attempting to recover data from a flash chip removed from a proprietary device. I've dumped the chip and stripped out the OOB data.

Binwalk finds multiple squashfs partitions.

Sasquatch -s looks hopeful:

SquashFS version [4.0] / inode count [334] suggests a SquashFS image of the same endianess Found a valid SQUASHFS 4:0 superblock on FF00000.squashfs. Creation or last append time Mon Aug 9 13:01:47 2021 Filesystem size 15832.95 Kbytes (15.46 Mbytes) (16212941 [0xF763CD] bytes) Compression lzma Block size 262144 Filesystem is exportable via NFS Inodes are compressed Data is compressed Fragments are compressed Always-use-fragments option is specified Xattrs are compressed Duplicates are removed Number of fragments 78 Number of inodes 334 Number of ids 1 sBlk.s.inode_table_start 0xf7430a sBlk.s.directory_table_start 0xf75081 sBlk.s.fragment_table_start 0xf760ea sBlk.s.lookup_table_start 0xf763b7 sBlk.s.id_table_start 0xf763c5 sBlk.s.xattr_id_table_start 0xffffffffffffffff

However attempting to extract files is failing: sasquatch FF00000.squashfs SquashFS version [4.0] / inode count [334] suggests a SquashFS image of the same endianess Parallel unsquashfs: Using 1 processor Trying to decompress using default lzma decompressor... Trying to decompress with lzma-adaptive... Trying to decompress with lzma-alt... Trying to decompress with lzma-ddwrt... Trying to decompress with lzo... Trying to decompress with xz... read_block: failed to read block @0xf75ef2 read_fragment_table: failed to read fragment table index FATAL ERROR:failed to read fragment table

Any tips or pointers would be welcomed?