Unpacking a ZTE ZXV10 H108L router firmware

Posted by v3ng3ful on Super User See other posts from Super User or by v3ng3ful
Published on 2012-09-03T08:52:49Z Indexed on 2012/09/03 9:40 UTC
Read the original article Hit count: 2234

I binwalked a firmware of a ZTE ZXV10 H108L, and got some encouraging results of uImage uboot, and LZMA compression, as well as a Squashfs 3.0 LZMA compressed filesystem.

 256        0x100       uImage header, header size: 64 bytes, header CRC: 0xE70BCBB9, created: Thu Nov 10 04:54:54 2011, image size: 804172 bytes, Data Address: 0x80002000, Entry Point: 0x80266000, data CRC: 0x6EFE90F1, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: MIPS Linux-2.6.20
320         0x140       LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2637958 bytes
851968      0xD0000     Squashfs filesystem, big endian, lzma signature, version 3.0, size: 2543403 bytes, 632 inodes, blocksize: 65536 bytes, created: Thu Nov 10 04:56:12 2011

Now what I did is, to test several portions of the file (320byte-end, 851968byte-end, and many more) using dd, and trying with certain tools to uncompress/unpack the filesystem of the firmware. After some digging I found out the best tool to do this is the firmware_mod_kit, that understands a squashfs-lzma v3 filesystem. Although I ended up really frustrated as unsquashfs-lzma v3 reported a cold "zlib::uncompress failed, unknown error -3". Do you have any ideas? Could it be that, the firmware is corrupted on purpose to discourage attempts like this? Router file

Thanks

© Super User or respective owner

Related posts about linux

Related posts about router