Binwalk - 压缩数据已损坏

时间:2016-04-21 19:07:41

标签: reverse-engineering

root@kali:~/ROUTER# binwalk new-firmware.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
84            0x54            uImage header, header size: 64 bytes, header CRC: 0xE52A7F50, created: 2012-02-10 07:27:12, image size: 819799 bytes, Data Address: 0x80002000, Entry Point: 0x801AC9F0, data CRC: 0x6A10D412, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
148           0x94            LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2386252 bytes
917588        0xE0054         Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2588426 bytes, 375 inodes, blocksize: 16384 bytes, created: 2016-02-05 02:05:56

root@kali:~/ROUTER# dd if=new-firmware.bin of=uboot.lzma skip=148 bs=1
3735488+0 records in
3735488+0 records out
3735488 bytes (3.7 MB, 3.6 MiB) copied, 4.16712 s, 896 kB/s

root@kali:~/ROUTER# dd if=new-firmware.bin of=kernel.squash skip=917588 bs=1
2818048+0 records in
2818048+0 records out
2818048 bytes (2.8 MB, 2.7 MiB) copied, 3.46517 s, 813 kB/s

到目前为止,所有看起来都有效,但我尝试了以下内容:

root@kali:~/ROUTER# lzma -d uboot.lzma 
lzma: uboot.lzma: Compressed data is corrupt

root@kali:~/ROUTER# unsquashfs kernel.squash 
Parallel unsquashfs: Using 4 processors
lzma uncompress failed with error code 0
read_block: failed to read block @0x277af0
read_fragment_table: failed to read fragment table index
FATAL ERROR:failed to read fragment table

知道为什么会这样吗?如提示所示,我在Kali Linux上。也可以这个

jj@ubuntu:~/Firmware$ binwalk -e new-firmware.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
84            0x54            uImage header, header size: 64 bytes, header CRC: 0xE52A7F50, created: 2012-02-10 07:27:12, image size: 819799 bytes, Data Address: 0x80002000, Entry Point: 0x801AC9F0, data CRC: 0x6A10D412, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
148           0x94            LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2386252 bytes

WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -le -d '%%squashfs-root%%' '%e'': [Errno 2] No such file or directory

WARNING: Extractor.execute failed to run external extractor 'sasquatch -p 1 -be -d '%%squashfs-root%%' '%e'': [Errno 2] No such file or directory
917588        0xE0054         Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2588426 bytes, 375 inodes, blocksize: 16384 bytes, created: 2016-02-05 02:05:56

2 个答案:

答案 0 :(得分:1)

尝试

lzma -d < uboot.lzma > uboot

您发现的错误是由于LZMA Utils已被XV Utils取代,后者不会忽略尾随垃圾。如果你将它用作流(就像我给你的那样),你最后仍然会收到损坏错误信息,但你会得到你的文件。

Source(搜索“腐败”并找到其他相关评论)

答案 1 :(得分:-1)

试试

binwalk -e new-firmware.bin

你最终会解压出 2 个文件

在提取的一个中,你会得到 2 个解压缩的和一个压缩的 此时你可以使用 dd 并且 unlzma 应该可以工作,至少它对我有用

这就是我的意思

root@ROOT20:~/Desktop/project/dlink/dlink2#binwalk dcs932l_v1.14.04.bin

十进制十六进制描述

106352 0x19F70 U-Boot 版本字符串,“U-Boot 1.1.3” 106816 0x1A140 CRC32 多项式表,小端 124544 0x1E680 HTML 文件头 124890 0x1E7DA HTML 文档页脚 124900 0x1E7E4 HTML 文件头 125092 0x1E8A4 HTML 文档页脚 125260 0x1E94C HTML 文件头 125953 0x1EC01 HTML 文档页脚 327680 0x50000 uImage header, header size: 64 bytes, header CRC: 0x88345E96, created: 2016-09-09 13:52:27, image size: 3804958 bytes, Data Address: 0x800000008,500800800800080008008000800080080000800080080008 OS:Linux,CPU:MIPS,镜像类型:OS Kernel Image,压缩类型:lzma,镜像名称:“Linux Kernel Image” 327744 0x50040 LZMA 压缩数据,属性:0x5D,字典大小:33554432 字节,未压缩大小:6558763 字节

root@ROOT20:~/Desktop/project/dlink/dlink2#dd if=dcs932l_v1.14.04.bin skip=327744 bs=1 of=kernel.lzma 3866560+0 条记录 3866560+0 条记录 复制了 3866560 字节(3.9 MB,3.7 MiB),9.61104 秒,402 kB/秒

root@ROOT20:~/Desktop/project/dlink/dlink2# unlzma kernel.lzma unlzma:kernel.lzma:压缩数据已损坏

root@ROOT20:~/Desktop/project/dlink/dlink2# binwalk -e dcs932l_v1.14.04.bin

十进制十六进制描述

106352 0x19F70 U-Boot 版本字符串,“U-Boot 1.1.3” 106816 0x1A140 CRC32 多项式表,小端 124544 0x1E680 HTML 文件头 124890 0x1E7DA HTML 文档页脚 124900 0x1E7E4 HTML 文件头 125092 0x1E8A4 HTML 文档页脚 125260 0x1E94C HTML 文件头 125953 0x1EC01 HTML 文档页脚 327680 0x50000 uImage header, header size: 64 bytes, header CRC: 0x88345E96, created: 2016-09-09 13:52:27, image size: 3804958 bytes, Data Address: 0x800000008,500800800800080008008000800080080000800080080008 OS:Linux,CPU:MIPS,镜像类型:OS Kernel Image,压缩类型:lzma,镜像名称:“Linux Kernel Image” 327744 0x50040 LZMA 压缩数据,属性:0x5D,字典大小:33554432 字节,未压缩大小:6558763 字节

root@ROOT20:~/Desktop/project/dlink/dlink2#ls dcs932l_v1.14.04.bin _dcs932l_v1.14.04.bin.extracted kernel.lzma

root@ROOT20:~/Desktop/project/dlink/dlink2#cd _dcs932l_v1.14.04.bin.extracted/

root@ROOT20:~/Desktop/project/dlink/dlink2/_dcs932l_v1.14.04.bin.extracted#ls 50040 50040.7z

root@ROOT20:~/Desktop/project/dlink/dlink2/_dcs932l_v1.14.04.bin.extracted# binwalk 50040

十进制十六进制描述

3145804 0x30004C Linux 内核版本 2.6.21 3175792 0x307570 SHA256 散列常量,小端 3389960 0x33BA08 Unix 路径:/usr/gnemul/irix/ 3392244 0x33C2F4 Unix 路径:/usr/lib/libc.so.1 3393940 0x33C994 Unix 路径:/dev/vc/0 3408260 0x340184 版权所有字符串:“Copyright (c) 2010 Alpha Networks Inc.” 3491536 0x3546D0 Unix 路径:/etc/Wireless/RT2860STA/RT2860STA.dat 3573187 0x3685C3 邻居文本,“邻居 %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x 在端口 %d(%s)(%s) 上丢失” 3807776 0x3A1A20 CRC32 多项式表,小端 4038656 0x3DA000 LZMA 压缩数据,属性:0x5D,字典大小:1048576 字节,未压缩大小:8072704 字节

root@ROOT20:~/Desktop/project/dlink/dlink2/_dcs932l_v1.14.04.bin.extracted#dd if=50040 skip=4038656 bs=1 of=kernel2.lzma 2520107+0 条记录 2520107+0 条记录 已复制 2520107 字节(2.5 MB,2.4 MiB),8.23342 秒,306 kB/秒 root@ROOT20:~/Desktop/project/dlink/dlink2/_dcs932l_v1.14.04.bin.extracted# unlzma kernel2.lzma

root@ROOT20:~/Desktop/project/dlink/dlink2/_dcs932l_v1.14.04.bin.extracted#

root@ROOT20:~/Desktop/project/dlink/dlink2/_dcs932l_v1.14.04.bin.extracted# mkdir cpio; cd cpio

root@ROOT20:~/Desktop/project/dlink/dlink2/_dcs932l_v1.14.04.bin.extracted/cpio#cpio -idm --no-absolute-filenames < ../kernel2 cpio:从成员名称中删除前导“/” 15767块

root@ROOT20:~/Desktop/project/dlink/dlink2/_dcs932l_v1.14.04.bin.extracted/cpio#ls bin dev etc etc_ro home init lib media mnt mydlink proc sbin sys tmp usr var