wcampbell0x2a / backhand

Library and binaries for the reading, creating, and modification of SquashFS file systems
Apache License 2.0
115 stars 10 forks source link

Found an unsupported image type, plus a panic. #243

Open fullspectrumdev opened 1 year ago

fullspectrumdev commented 1 year ago

So I have this squashfs file I'm working with, and the geezless thing... Well, it has stupid headers (thanks Cisco) which cause a panic or an error, depending on what flags I use.

So with -a -i it fails to find the magic.

$ ./target/debug/unsquashfs --list ../fs.sqfs -a -i
[!] magic not found

Full backtrace.

 RUST_BACKTRACE=full ./target/debug/unsquashfs --list ../fs.sqfs
thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Deku(Assertion("SuperBlock.magic field failed assertion: magic == ctx_magic"))', src/bin/unsquashfs.rs:168:88
stack backtrace:
   0:     0x55b9649248ea - std::backtrace_rs::backtrace::libunwind::trace::ha9053a9a07ca49cb
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
   1:     0x55b9649248ea - std::backtrace_rs::backtrace::trace_unsynchronized::h9c2852a457ad564e
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
   2:     0x55b9649248ea - std::sys_common::backtrace::_print_fmt::h457936fbfaa0070f
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/sys_common/backtrace.rs:65:5
   3:     0x55b9649248ea - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h5779d7bf7f70cb0c
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/sys_common/backtrace.rs:44:22
   4:     0x55b96494538e - core::fmt::write::h5a4baaff1bcd3eb5
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/core/src/fmt/mod.rs:1232:17
   5:     0x55b964921bc5 - std::io::Write::write_fmt::h4bc1f301cb9e9cce
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/io/mod.rs:1684:15
   6:     0x55b9649246b5 - std::sys_common::backtrace::_print::h5fcdc36060f177e8
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/sys_common/backtrace.rs:47:5
   7:     0x55b9649246b5 - std::sys_common::backtrace::print::h54ca9458b876c8bf
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/sys_common/backtrace.rs:34:9
   8:     0x55b964925d0f - std::panicking::default_hook::{{closure}}::hbe471161c7664ed6
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panicking.rs:271:22
   9:     0x55b964925a4b - std::panicking::default_hook::ha3500da57aa4ac4f
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panicking.rs:290:9
  10:     0x55b9649262b8 - std::panicking::rust_panic_with_hook::h50c09d000dc561d2
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panicking.rs:692:13
  11:     0x55b9649261b9 - std::panicking::begin_panic_handler::{{closure}}::h9e2b2176e00e0d9c
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panicking.rs:583:13
  12:     0x55b964924d56 - std::sys_common::backtrace::__rust_end_short_backtrace::h5739b8e512c09d02
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/sys_common/backtrace.rs:150:18
  13:     0x55b964925ec2 - rust_begin_unwind
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panicking.rs:579:5
  14:     0x55b964307a93 - core::panicking::panic_fmt::hf33a1475b4dc5c3e
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/core/src/panicking.rs:64:14
  15:     0x55b964307f43 - core::result::unwrap_failed::hdff5465d74574b44
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/core/src/result.rs:1750:5
  16:     0x55b96430d409 - core::result::Result<T,E>::unwrap::h773dfdea8f2028e0
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/core/src/result.rs:1090:23
  17:     0x55b96431bb3b - unsquashfs::main::h3cd08d313dc20385
                               at /home/sky/payback/backhand/src/bin/unsquashfs.rs:168:20
  18:     0x55b96431354b - core::ops::function::FnOnce::call_once::hb05683f4b3700c80
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/core/src/ops/function.rs:250:5
  19:     0x55b9643289ae - std::sys_common::backtrace::__rust_begin_short_backtrace::h2213305af2ad5ea5
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/sys_common/backtrace.rs:134:18
  20:     0x55b964318751 - std::rt::lang_start::{{closure}}::ha22a9c28de1e74d0
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/rt.rs:166:18
  21:     0x55b96491c5ec - core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once::hd6efcd3bec896f2c
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/core/src/ops/function.rs:287:13
  22:     0x55b96491c5ec - std::panicking::try::do_call::hce04e543bb1f4cbb
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panicking.rs:487:40
  23:     0x55b96491c5ec - std::panicking::try::h3342dd4e1f680968
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panicking.rs:451:19
  24:     0x55b96491c5ec - std::panic::catch_unwind::h148ce1e59ac0cee7
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panic.rs:140:14
  25:     0x55b96491c5ec - std::rt::lang_start_internal::{{closure}}::h25f9dda2057a67fe
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/rt.rs:148:48
  26:     0x55b96491c5ec - std::panicking::try::do_call::h7caaaeaf9401650b
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panicking.rs:487:40
  27:     0x55b96491c5ec - std::panicking::try::he7d15285746cbbc2
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panicking.rs:451:19
  28:     0x55b96491c5ec - std::panic::catch_unwind::h89fb4f50c0301fe0
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/panic.rs:140:14
  29:     0x55b96491c5ec - std::rt::lang_start_internal::h078acd489417d3c1
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/rt.rs:148:20
  30:     0x55b96431872a - std::rt::lang_start::h7ba2c4bcf8fab38f
                               at /rustc/84c898d65adf2f39a5a98507f1fe0ce10a2b8dbc/library/std/src/rt.rs:165:17
  31:     0x55b964320a5e - main
  32:     0x7f5e35c5fd0a - __libc_start_main
                               at ./csu/../csu/libc-start.c:308:16
  33:     0x55b96430812a - _start
  34:                0x0 - <unknown>
$ 
$ binwalk ../fs.sqfs 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Squashfs filesystem, little endian, non-standard signature, version 3.1, size: 8476193 bytes, 1028 inodes, blocksize: 131072 bytes, created: 2019-10-14 04:51:02
$ sasquatch -trace fs.sqfs 
squashfs: read_bytes: reading from position 0x0, bytes 32
SquashFS version [3.1] / inode count [1028] suggests a SquashFS image of the same endianess
Non-standard SquashFS Magic: shsq
squashfs: read_bytes: reading from position 0x0, bytes 96
squashfs: read_bytes: reading from position 0x0, bytes 119
Parallel unsquashfs: Using 1 processor
squashfs: read_uids_guids: no_uids 2, no_guids 0
squashfs: read_bytes: reading from position 0x815619, bytes 8
squashfs: read_fragment_table: 51 fragments, reading 1 fragment indexes from 0x814e3c
squashfs: read_bytes: reading from position 0x814e3c, bytes 8
squashfs: read_bytes: reading from position 0x814cf6, bytes 2
squashfs: read_block: block @0x814cf6, 323 compressed bytes
squashfs: read_bytes: reading from position 0x814cf9, bytes 323
Trying to decompress using default gzip decompressor...
squashfs: Default gzip decompressor failed! [-1 -3]
Trying to decompress with lzma...
Detected lzma compression
squashfs: Read fragment table block 0, from 0x814cf6, length 816
squashfs: read_inode_table: start 8421718, end 8454352
squashfs: read_bytes: reading from position 0x808156, bytes 2
squashfs: read_block: block @0x808156, 8192 uncompressed bytes

I'll upload the file to this issue, in a .tgz, to help debug. fs.sqfs.tgz

wcampbell0x2a commented 1 year ago

Thanks for trying!

Couple of things:

fullspectrumdev commented 1 year ago

Ah, that makes sense - I'll try find the GPL released source for the modified squashfs/etc and share them on this issue, might be helpful for adding support.

If its helpful, should I make an issues in future with sample filesystems whenever I come across something that doesn't unpack or triggers a panic?

wcampbell0x2a commented 1 year ago

Sure, always helpful