Closed GoogleCodeExporter closed 8 years ago
Did you try the *-ng.sh scripts written by Craig on this image? They utilize
Binwalk and might be successful if the older scripts are not.
Original comment by jeremy.collake@gmail.com
on 1 Aug 2012 at 12:36
sudo binwalk webupload.img
DECIMAL HEX DESCRIPTION
--------------------------------------------------------------------------------
-----------------------
72 0x48 LZMA compressed data, properties: 0x6F, dictionary size:
8388608 bytes, uncompressed size: 5342024 bytes
Original comment by timeisfl...@gmail.com
on 1 Aug 2012 at 12:49
I mean extract-ng.sh ... did you try that script?
Original comment by jeremy.collake@gmail.com
on 1 Aug 2012 at 12:52
i tried Craig in written scripts not working
Original comment by timeisfl...@gmail.com
on 1 Aug 2012 at 12:57
sudo ./extract-ng.sh webupload.img
Firmware Mod Kit (build-ng) 0.77 beta, (c)2011 Craig Heffner, Jeremy Collake
http://www.bitsum.com
Scanning firmware...
DECIMAL HEX DESCRIPTION
--------------------------------------------------------------------------------
-----------------------
Extracting 0 bytes of header image at offset 0
ERROR: No supported file system found! Aborting...
Original comment by timeisfl...@gmail.com
on 1 Aug 2012 at 12:58
this image lzma packed as the diameter, which increases encryption
Original comment by timeisfl...@gmail.com
on 1 Aug 2012 at 12:59
Ok, thanks. It looks like custom support would need to be added to handle the
encryption layer then. Is this a firmware whose source code has been release
publicly, and/or is based on linux?
Original comment by jeremy.collake@gmail.com
on 1 Aug 2012 at 1:02
z00::k1ll3r { ~/firmware-mod-kit }-> dd if=webupload.img of=cracked/webupload
bs=1 skip=72
1582352+0 records in
1582352+0 records out
1582352 bytes (1.6 MB) copied, 2.26619 s, 698 kB/s
z00::k1ll3r { ~/firmware-mod-kit }-> cd cracked/
z00::k1ll3r { ~/firmware-mod-kit/cracked }-> ls
webupload
z00::k1ll3r { ~/firmware-mod-kit/cracked }-> mv webupload webupload.lzma
z00::k1ll3r { ~/firmware-mod-kit/cracked }-> lzma -d webupload.lzma
z00::k1ll3r { ~/firmware-mod-kit/cracked }-> ls
webupload
z00::k1ll3r { ~/firmware-mod-kit/cracked }-> sudo binwalk webupload
DECIMAL HEX DESCRIPTION
--------------------------------------------------------------------------------
-----------------------
1079 0x437 LZMA compressed data, properties: 0x88, dictionary size:
554696704 bytes, uncompressed size: 16777874 bytes
5499 0x157B LZMA compressed data, properties: 0x9B, dictionary size:
558366720 bytes, uncompressed size: 402662030 bytes
20386 0x4FA2 LZMA compressed data, properties: 0xA0, dictionary size:
409075712 bytes, uncompressed size: 6460453 bytes
119856 0x1D430 LZMA compressed data, properties: 0x80, dictionary size:
1056964608 bytes, uncompressed size: 128 bytes
219297 0x358A1 LZMA compressed data, properties: 0x80, dictionary size:
125829120 bytes, uncompressed size: 56368 bytes
316481 0x4D441 LZMA compressed data, properties: 0xB6, dictionary size:
125829120 bytes, uncompressed size: 4130887 bytes
465191 0x71927 LZMA compressed data, properties: 0x9C, dictionary size:
16777216 bytes, uncompressed size: 16777216 bytes
465219 0x71943 LZMA compressed data, properties: 0xA0, dictionary size:
16777216 bytes, uncompressed size: 16777216 bytes
465247 0x7195F LZMA compressed data, properties: 0xA4, dictionary size:
16777216 bytes, uncompressed size: 16777216 bytes
465275 0x7197B LZMA compressed data, properties: 0xA8, dictionary size:
16777216 bytes, uncompressed size: 16777216 bytes
465723 0x71B3B LZMA compressed data, properties: 0xA0, dictionary size:
16777216 bytes, uncompressed size: 33554432 bytes
465779 0x71B73 LZMA compressed data, properties: 0xA8, dictionary size:
16777216 bytes, uncompressed size: 33554432 bytes
466199 0x71D17 LZMA compressed data, properties: 0x9C, dictionary size:
16777216 bytes, uncompressed size: 16777216 bytes
466227 0x71D33 LZMA compressed data, properties: 0xA0, dictionary size:
16777216 bytes, uncompressed size: 50331648 bytes
466255 0x71D4F LZMA compressed data, properties: 0xA4, dictionary size:
16777216 bytes, uncompressed size: 16777216 bytes
473169 0x73851 LZMA compressed data, properties: 0xC9, dictionary size:
92274688 bytes, uncompressed size: 40192 bytes
481564 0x7591C LZMA compressed data, properties: 0x80, dictionary size:
889192448 bytes, uncompressed size: 1962857 bytes
1653573 0x193B45 JFFS2 filesystem (old) data big endian, JFFS node length:
128
2364155 0x2412FB LZMA compressed data, properties: 0xC9, dictionary size:
557842432 bytes, uncompressed size: 50060 bytes
4054997 0x3DDFD5 LZMA compressed data, properties: 0x81, dictionary size:
662700032 bytes, uncompressed size: 50365 bytes
4058393 0x3DED19 LZMA compressed data, properties: 0x9B, dictionary size:
524288 bytes, uncompressed size: 7 bytes
4174634 0x3FB32A LZMA compressed data, properties: 0xB5, dictionary size:
1048576 bytes, uncompressed size: 4603905 bytes
4185947 0x3FDF5B LZMA compressed data, properties: 0xA8, dictionary size:
46137344 bytes, uncompressed size: 68168064 bytes
4185979 0x3FDF7B LZMA compressed data, properties: 0xA8, dictionary size:
348127232 bytes, uncompressed size: 336603520 bytes
4186011 0x3FDF9B LZMA compressed data, properties: 0xA8, dictionary size:
364904448 bytes, uncompressed size: 873474432 bytes
4186203 0x3FE05B LZMA compressed data, properties: 0xA8, dictionary size:
281018368 bytes, uncompressed size: 672213376 bytes
4186395 0x3FE11B LZMA compressed data, properties: 0xA8, dictionary size:
213909504 bytes, uncompressed size: 68299136 bytes
4187163 0x3FE41B LZMA compressed data, properties: 0xA8, dictionary size:
77135872 bytes, uncompressed size: 68430208 bytes
4187195 0x3FE43B LZMA compressed data, properties: 0xA8, dictionary size:
93913088 bytes, uncompressed size: 269756800 bytes
4187227 0x3FE45B LZMA compressed data, properties: 0xA8, dictionary size:
110690304 bytes, uncompressed size: 538192256 bytes
4187259 0x3FE47B LZMA compressed data, properties: 0xA8, dictionary size:
127467520 bytes, uncompressed size: 1007954304 bytes
4187643 0x3FE5FB LZMA compressed data, properties: 0xA8, dictionary size:
328794112 bytes, uncompressed size: 269822336 bytes
4187675 0x3FE61B LZMA compressed data, properties: 0xA8, dictionary size:
345571328 bytes, uncompressed size: 739584384 bytes
4188027 0x3FE77B LZMA compressed data, properties: 0xA8, dictionary size:
546897920 bytes, uncompressed size: 1452416 bytes
4188059 0x3FE79B LZMA compressed data, properties: 0xA8, dictionary size:
563675136 bytes, uncompressed size: 404105600 bytes
4188091 0x3FE7BB LZMA compressed data, properties: 0xA8, dictionary size:
580452352 bytes, uncompressed size: 739649920 bytes
4188123 0x3FE7DB LZMA compressed data, properties: 0xA8, dictionary size:
597229568 bytes, uncompressed size: 1008085376 bytes
4188443 0x3FE91B LZMA compressed data, properties: 0xA8, dictionary size:
765001728 bytes, uncompressed size: 1517952 bytes
4188475 0x3FE93B LZMA compressed data, properties: 0xA8, dictionary size:
781778944 bytes, uncompressed size: 269953408 bytes
4188507 0x3FE95B LZMA compressed data, properties: 0xA8, dictionary size:
798556160 bytes, uncompressed size: 605497728 bytes
4188539 0x3FE97B LZMA compressed data, properties: 0xA8, dictionary size:
815333376 bytes, uncompressed size: 1008150912 bytes
4188795 0x3FEA7B LZMA compressed data, properties: 0xA8, dictionary size:
949551104 bytes, uncompressed size: 270018944 bytes
4188827 0x3FEA9B LZMA compressed data, properties: 0xA8, dictionary size:
966328320 bytes, uncompressed size: 739780992 bytes
4188859 0x3FEABB LZMA compressed data, properties: 0xA8, dictionary size:
999882752 bytes, uncompressed size: 1008216448 bytes
4189211 0x3FEC1B LZMA compressed data, properties: 0xA8, dictionary size:
1184432128 bytes, uncompressed size: 135866752 bytes
4189243 0x3FEC3B LZMA compressed data, properties: 0xA8, dictionary size:
463011840 bytes, uncompressed size: 471411072 bytes
4189275 0x3FEC5B LZMA compressed data, properties: 0xA8, dictionary size:
1217986560 bytes, uncompressed size: 739846528 bytes
4189627 0x3FEDBB LZMA compressed data, properties: 0xA8, dictionary size:
1402535936 bytes, uncompressed size: 1714560 bytes
4189659 0x3FEDDB LZMA compressed data, properties: 0xA8, dictionary size:
1419313152 bytes, uncompressed size: 404367744 bytes
4189691 0x3FEDFB LZMA compressed data, properties: 0xA8, dictionary size:
1436090368 bytes, uncompressed size: 605694336 bytes
4189723 0x3FEE1B LZMA compressed data, properties: 0xA8, dictionary size:
1452867584 bytes, uncompressed size: 807020928 bytes
4189755 0x3FEE3B LZMA compressed data, properties: 0xA8, dictionary size:
1469644800 bytes, uncompressed size: 1008347520 bytes
4191643 0x3FF59B LZMA compressed data, properties: 0xA8, dictionary size:
160104448 bytes, uncompressed size: 270477696 bytes
4191675 0x3FF5BB LZMA compressed data, properties: 0xA8, dictionary size:
176881664 bytes, uncompressed size: 606022016 bytes
4191707 0x3FF5DB LZMA compressed data, properties: 0xA8, dictionary size:
160038912 bytes, uncompressed size: 1008675200 bytes
4192507 0x3FF8FB LZMA compressed data, properties: 0xA8, dictionary size:
830930944 bytes, uncompressed size: 136391040 bytes
4192539 0x3FF91B LZMA compressed data, properties: 0xA8, dictionary size:
847708160 bytes, uncompressed size: 740370816 bytes
4192923 0x3FFA9B LZMA compressed data, properties: 0xA8, dictionary size:
25886720 bytes, uncompressed size: 539109760 bytes
4192955 0x3FFABB LZMA compressed data, properties: 0xA8, dictionary size:
42663936 bytes, uncompressed size: 874654080 bytes
4193339 0x3FFC3B LZMA compressed data, properties: 0xA8, dictionary size:
1820590080 bytes, uncompressed size: 2304384 bytes
4193371 0x3FFC5B LZMA compressed data, properties: 0xA8, dictionary size:
1837367296 bytes, uncompressed size: 270739840 bytes
4193403 0x3FFC7B LZMA compressed data, properties: 0xA8, dictionary size:
1854144512 bytes, uncompressed size: 472066432 bytes
4193435 0x3FFC9B LZMA compressed data, properties: 0xA8, dictionary size:
1870921728 bytes, uncompressed size: 673393024 bytes
4193467 0x3FFCBB LZMA compressed data, properties: 0xA8, dictionary size:
1887698944 bytes, uncompressed size: 874719616 bytes
4195675 0x40055B LZMA compressed data, properties: 0xA8, dictionary size:
59441152 bytes, uncompressed size: 673720704 bytes
4196019 0x4006B3 LZMA compressed data, properties: 0xA8, dictionary size:
1150877696 bytes, uncompressed size: 539830656 bytes
4196059 0x4006DB LZMA compressed data, properties: 0xA8, dictionary size:
193265664 bytes, uncompressed size: 808266112 bytes
4196619 0x40090B LZMA compressed data, properties: 0xA8, dictionary size:
1954742272 bytes, uncompressed size: 539896192 bytes
4196659 0x400933 LZMA compressed data, properties: 0xA8, dictionary size:
1971519488 bytes, uncompressed size: 674113920 bytes
4196699 0x40095B LZMA compressed data, properties: 0xA8, dictionary size:
1988296704 bytes, uncompressed size: 875440512 bytes
4198619 0x4010DB LZMA compressed data, properties: 0xA8, dictionary size:
662896640 bytes, uncompressed size: 137439616 bytes
4198659 0x401103 LZMA compressed data, properties: 0xA8, dictionary size:
679673856 bytes, uncompressed size: 338766208 bytes
4198699 0x40112B LZMA compressed data, properties: 0xA8, dictionary size:
696451072 bytes, uncompressed size: 607201664 bytes
4198739 0x401153 LZMA compressed data, properties: 0xA8, dictionary size:
713228288 bytes, uncompressed size: 808528256 bytes
4198779 0x40117B LZMA compressed data, properties: 0xA8, dictionary size:
730005504 bytes, uncompressed size: 1009854848 bytes
4229826 0x408AC2 LZMA compressed data, properties: 0xA0, dictionary size:
80150528 bytes, uncompressed size: 1064960 bytes
4235390 0x40A07E LZMA compressed data, properties: 0xA5, dictionary size:
34996224 bytes, uncompressed size: 270340 bytes
4236110 0x40A34E LZMA compressed data, properties: 0xA5, dictionary size:
68550656 bytes, uncompressed size: 270342 bytes
4274554 0x41397A LZMA compressed data, properties: 0xAC, dictionary size:
53084160 bytes, uncompressed size: 4194304 bytes
4275794 0x413E52 LZMA compressed data, properties: 0xAF, dictionary size:
163643392 bytes, uncompressed size: 1048586 bytes
4275994 0x413F1A LZMA compressed data, properties: 0xD7, dictionary size:
34537472 bytes, uncompressed size: 4456448 bytes
4297174 0x4191D6 LZMA compressed data, properties: 0x9D, dictionary size:
734134272 bytes, uncompressed size: 1064960 bytes
4351749 0x426705 LZMA compressed data, properties: 0xC0, dictionary size:
536870912 bytes, uncompressed size: 65536 bytes
4351785 0x426729 LZMA compressed data, properties: 0xC0, dictionary size:
536870912 bytes, uncompressed size: 65536 bytes
4351857 0x426771 LZMA compressed data, properties: 0xC0, dictionary size:
536870912 bytes, uncompressed size: 65536 bytes
4351893 0x426795 LZMA compressed data, properties: 0xC0, dictionary size:
536870912 bytes, uncompressed size: 65536 bytes
4351929 0x4267B9 LZMA compressed data, properties: 0xC0, dictionary size:
536870912 bytes, uncompressed size: 65536 bytes
4351965 0x4267DD LZMA compressed data, properties: 0xC0, dictionary size:
536870912 bytes, uncompressed size: 65536 bytes
4352001 0x426801 LZMA compressed data, properties: 0xC0, dictionary size:
536870912 bytes, uncompressed size: 65536 bytes
4352037 0x426825 LZMA compressed data, properties: 0xC0, dictionary size:
536870912 bytes, uncompressed size: 65536 bytes
4410219 0x434B6B LZMA compressed data, properties: 0xD7, dictionary size:
251789312 bytes, uncompressed size: 235015170 bytes
4448347 0x43E05B LZMA compressed data, properties: 0xD0, dictionary size:
251658240 bytes, uncompressed size: 69085568 bytes
4457967 0x4405EF LZMA compressed data, properties: 0x8D, dictionary size:
814415872 bytes, uncompressed size: 806094336 bytes
4457983 0x4405FF LZMA compressed data, properties: 0x8E, dictionary size:
831193088 bytes, uncompressed size: 33555968 bytes
4457999 0x44060F LZMA compressed data, properties: 0x8F, dictionary size:
847970304 bytes, uncompressed size: 33555968 bytes
4458015 0x44061F LZMA compressed data, properties: 0x90, dictionary size:
864747520 bytes, uncompressed size: 16778752 bytes
4458031 0x44062F LZMA compressed data, properties: 0x91, dictionary size:
881524736 bytes, uncompressed size: 2164224 bytes
4458303 0x44073F LZMA compressed data, properties: 0xDA, dictionary size:
1217069056 bytes, uncompressed size: 536872448 bytes
4470592 0x443740 LZMA compressed data, properties: 0x80, dictionary size:
452984832 bytes, uncompressed size: 905969664 bytes
4509636 0x44CFC4 GIF image data, version 87a, 180 x 60
4512576 0x44DB40 GIF image data, version 89a, 18 x 18
4512792 0x44DC18 GIF image data, version 89a, 18 x 18
4512864 0x44DC60 GIF image data, version 89a, 18 x 18
4512964 0x44DCC4 GIF image data, version 89a, 18 x 18
4513060 0x44DD24 GIF image data, version 89a, 18 x 18
4513156 0x44DD84 GIF image data, version 89a, 18 x 18
4513248 0x44DDE0 GIF image data, version 89a, 18 x 18
4513384 0x44DE68 GIF image data, version 89a, 18 x 18
4513528 0x44DEF8 GIF image data, version 89a, 18 x 18
4513596 0x44DF3C GIF image data, version 89a, 18 x 18
4513728 0x44DFC0 GIF image data, version 89a, 18 x 18
4513796 0x44E004 GIF image data, version 89a, 1 x 1
4513840 0x44E030 GIF image data, version 89a, 12 x 12
4513936 0x44E090 GIF image data, version 89a, 12 x 12
4514016 0x44E0E0 GIF image data, version 89a, 20 x 487
4516784 0x44EBB0 GIF image data, version 89a, 560 x 50
4518428 0x44F21C GIF image data, version 89a, 560 x 50
4520144 0x44F8D0 GIF image data, version 89a, 200 x 50
4521080 0x44FC78 GIF image data, version 89a, 19 x 22
4522092 0x45006C GIF image data, version 89a, 314 x 51
4524416 0x450980 GIF image data, version 89a, 314 x 51
4526812 0x4512DC GIF image data, version 87a, 180 x 60
4529752 0x451E58 GIF image data, version 89a, 18 x 18
4529968 0x451F30 GIF image data, version 89a, 18 x 18
4530040 0x451F78 GIF image data, version 89a, 18 x 18
4530140 0x451FDC GIF image data, version 89a, 18 x 18
4530236 0x45203C GIF image data, version 89a, 18 x 18
4530332 0x45209C GIF image data, version 89a, 18 x 18
4530424 0x4520F8 GIF image data, version 89a, 18 x 18
4530560 0x452180 GIF image data, version 89a, 18 x 18
4530704 0x452210 GIF image data, version 89a, 18 x 18
4530772 0x452254 GIF image data, version 89a, 18 x 18
4530904 0x4522D8 GIF image data, version 89a, 18 x 18
4530972 0x45231C GIF image data, version 89a, 1 x 1
4531016 0x452348 GIF image data, version 89a, 12 x 12
4531112 0x4523A8 GIF image data, version 89a, 12 x 12
4531192 0x4523F8 GIF image data, version 89a, 20 x 487
4533960 0x452EC8 GIF image data, version 89a, 560 x 50
4535604 0x453534 GIF image data, version 89a, 560 x 50
4537320 0x453BE8 GIF image data, version 89a, 200 x 50
4538256 0x453F90 GIF image data, version 89a, 19 x 22
4539268 0x454384 GIF image data, version 89a, 314 x 51
4541592 0x454C98 GIF image data, version 89a, 314 x 51
5336289 0x516CE1 LZMA compressed data, properties: 0x82, dictionary size:
4325376 bytes, uncompressed size: 512 bytes
Original comment by timeisfl...@gmail.com
on 1 Aug 2012 at 1:02
No only have the firmware binary packet
Original comment by timeisfl...@gmail.com
on 1 Aug 2012 at 1:04
Please don't label images or directories 'cracked', that isn't the purpose of
this project, nor intent ;p. We'll see what we can do. It may be a while,
though if you or anyone else gets to this, patches are welcome. Right now Craig
is the active one on this project, so he may be able to provide more assistance
than I (who am distracted struggling to pay my rent, as always ;p).
Original comment by jeremy.collake@gmail.com
on 1 Aug 2012 at 1:09
I'm trying to trouble, just like you I am unemployed :( thanx anyway
Original comment by timeisfl...@gmail.com
on 1 Aug 2012 at 1:13
Not encrypted, just an RTOS. Big endian MIPS code and plenty of strings in the
uncompressed LZMA data:
$ binwalk -A data
DECIMAL HEX DESCRIPTION
--------------------------------------------------------------------------------
-----------------------
480 0x1E0 MIPS function epilogue
1664 0x680 MIPS function epilogue
2324 0x914 MIPS function epilogue
3868 0xF1C MIPS function epilogue
4184 0x1058 MIPS function epilogue
4368 0x1110 MIPS function epilogue
5072 0x13D0 MIPS function epilogue
5080 0x13D8 MIPS function epilogue
5088 0x13E0 MIPS function epilogue
5280 0x14A0 MIPS function epilogue
5412 0x1524 MIPS function epilogue
...
$ strings data
...ERROR: Cholesky decomposition failed: num = %d
ON .. flatness_delta = %d/1e5
dynamic allocation TEQ
LoopNr=%d, Ts=%d, Gb=%d, delta=%d, LoopOffset=%d ...
utc delay=%d iOpt=%d, mse=%d
delta=%d, delay_save=%d, mse_opt=%d
ADPLL_RX_TRIGG
ERROR: no such AFE chips: %d
RTL8271:: gain=%d/10, LNA_INIT =(%d %d %d %d) dB
### gRegistry_LNA_22nF=%d
ERROR::AGC_FINAL
ERROR!! unknown AGC phase %d in RTL8271
AGC_INIT:: rxGaindB = %d
TX_ID currentValue: 0x%x
currentValue warning: index = %d
nominalGi = %d, maxPower = %d
nominalGi(org) = %d, targetMargin = %d
nominalGi(0) = %d, targetMargin = %d
nominalGi(%d) = %d, targetMargin = %d
decrease FALSE! %d %d %d %d %d
increase FALSE! %d %d %d %d %d
increase FALSE 2! %d %d %d %d %d
increase FALSE 3! %d %d %d %d %d
...
Probably not a good candidate for FMK though, as we primarily (exclusively)
support Linux based firmware.
Original comment by heffne...@gmail.com
on 4 Aug 2012 at 12:45
need to re-edit and re-compile it?
Original comment by timeisfl...@gmail.com
on 4 Aug 2012 at 11:07
FMK doesn't support non-Linux firmware. If you want to edit and re-compile the
firmware, you'll need the RTOS compiler and source, which is most likely
proprietary.
Original comment by heffne...@gmail.com
on 4 Aug 2012 at 4:21
Original issue reported on code.google.com by
timeisfl...@gmail.com
on 1 Aug 2012 at 4:55Attachments: