search

matthias-deu / ubift

The UBI Forensic Toolkit (UBIFT) is a Python command-line interface tool that aims to provide various functionalities to assist an IT forensic evaluation of the UBIFS file system.
MIT License
4 stars 3 forks source link

Incorrect data length when stripping OOB #2

Open swappart opened 3 months ago

swappart commented 3 months ago

Not sure what's happening here, but if I strip the OOB, I get an incorrect data length. Is this a bug, or am I doing something wrong?

python3 ubift.py fls ../OriginalNand.bin -o 0 --pagesize 4096 --blocksize 524288 --oob 224 -n data --verbose INFO ubift.framework.mtd: [!] Stripping OOB with size 224 from every page. ERROR ubift.framework.mtd: [-] Invalid block_size (data_len: 4392578240 not divisible by block_size 524288) INFO ubift.framework.mtd: [!] Initialized Image (block_size:524288, page_size:4096, oob_size:224, data_len:4392578240)

If I don't strip the OOB, I get the correct data length, but it doesn't find the UBI because of the OOB. python3 ubift.py fls ../OriginalNand.bin -o 0 --pagesize 4096 --blocksize 524288 --oob 0 -n data --verbose INFO ubift.framework.mtd: [!] Initialized Image (block_size:524288, page_size:4096, oob_size:-1, data_len:2264924160)

matthias-deu commented 3 months ago

Hello swappart,

sorry for the late answer. It's very hard to answer your question without having access to the nand dump you are referring to. It could be some random bit flips or errors in your dump. Under normal circumstances such errors should not occur, but in my experience every dump has its own little problems :) What you can try if nothing works out for you is using the --scan parameter, which ignores all structure of UBIFS and just tries to find as much data as possible

If you want i could take a closer look at it, let me know