Are we able to get the file system in the firmware?

e-m-b-a / emba

EMBA - The firmware security analyzer

https://www.securefirmware.de

GNU General Public License v3.0

2.49k stars 223 forks source link

Are we able to get the file system in the firmware? #1174

Closed zut-zyq closed 1 month ago

zut-zyq commented 1 month ago

When using the EMBA tool to analyze the firmware, I saw that after the analysis was completed, the first thing I wanted was some relevant information about the firmware, including the firmware architecture, operating system, big and small endian, file system, etc. Among them, I checked All execution results show that no file system is found. Is it possible to add this function or did I not find it? Thanks

github-actions[bot] commented 1 month ago

Thank you for contributing an issue!

Welcome to the EMBA firmware analysis community!

We are glad you are here and appreciate your contribution. Please keep in mind our contributing guidelines here and here. Also, please check existing open issues and consider to open a discussion in the dedicated discussion area. Additionally, we have collected a lot of details around EMBA, the installation and the usage of EMBA in our Wiki.

If you like EMBA you have the chance to support us by becoming a Sponsor or buying some beer here.

To show your love for EMBA with nice shirts or other merch you can check our Spreadshop.

This is an automatic message. Allow for time for the EMBA community to be able to read the issue and comment on it.

BenediktMKuehne commented 1 month ago

We need more info to be able to help you. Please follow this Issue template

What command did you run& Which firmware file?

zut-zyq commented 1 month ago

I used EMBA to detect a D-Link device and ran the command ./emba -l /log -f /firmware/DIR820LA1_FW100KRB08.bin -c to perform the detection. I want to find in the results what file system the firmware belongs to. For example, the file system of the firmware is squashfs. Does our tool have the function to specifically identify the file system of the firmware? Because I found that using tools such as binwalk cannot ensure that the file system of the firmware can be obtained.

m-1-k-3 commented 1 month ago

Usually in /log/firmware

m-1-k-3 commented 1 month ago

this DIR820 firmware looks quite good:

zut-zyq commented 1 month ago

this DIR820 firmware looks quite good:

Why does it execute the p40 module?

m-1-k-3 commented 1 month ago

Why does it execute the p40 module?

just for logging as it has not detected DIJ firmware image