Hacking TL-MR3020 – Part 3 – Firmware analysis
Extracting and Analysis Firmware of the TL-MR3020
This tutorial shows how the firmware of the TP-Link TL-MR3020 could be analysed.
DRAFT!
$ binwalk -e rootfs.img DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2594041 bytes, 624 inodes, blocksize: 131072 bytes, created: Tue Jun 10 12:04:31 2014
$ ../../Downloads/fmk/unsquashfs_all.sh working.squashfs Attempting to extract SquashFS .X file system... Trying ./src/squashfs-2.1-r2/unsquashfs-lzma... Trying ./src/squashfs-2.1-r2/unsquashfs... Trying ./src/squashfs-3.0/unsquashfs-lzma... Trying ./src/squashfs-3.0/unsquashfs... Trying ./src/squashfs-3.0-lzma-damn-small-variant/unsquashfs-lzma... Trying ./src/others/squashfs-2.0-nb4/unsquashfs... Trying ./src/others/squashfs-3.0-e2100/unsquashfs-lzma... Trying ./src/others/squashfs-3.0-e2100/unsquashfs... Trying ./src/others/squashfs-3.2-r2/unsquashfs... Trying ./src/others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools/unsquashfs... Trying ./src/others/squashfs-3.2-r2-hg612-lzma/unsquashfs... Trying ./src/others/squashfs-3.2-r2-wnr1000/unsquashfs... Trying ./src/others/squashfs-3.2-r2-rtn12/unsquashfs... Trying ./src/others/squashfs-3.3/unsquashfs... Trying ./src/others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools/unsquashfs... Trying ./src/others/squashfs-3.3-grml-lzma/squashfs3.3/squashfs-tools/unsquashfs... Trying ./src/others/squashfs-3.4-cisco/unsquashfs... Trying ./src/others/squashfs-3.4-nb4/unsquashfs-lzma... Trying ./src/others/squashfs-3.4-nb4/unsquashfs... Trying ./src/others/squashfs-4.2-official/unsquashfs... Parallel unsquashfs: Using 4 processors Trying ./src/others/squashfs-4.2/unsquashfs... Parallel unsquashfs: Using 4 processors Trying ./src/others/squashfs-4.0-lzma/unsquashfs-lzma... Parallel unsquashfs: Using 4 processors 584 inodes (619 blocks) to write [===================================================================| ] 551/619 89% created 444 files created 40 directories created 72 symlinks created 0 devices created 0 fifos File system sucessfully extracted! MKFS="./src/others/squashfs-4.0-lzma/mksquashfs-lzma"
$ ls -lah total 56K drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 4 matt matt 4.0K Jan 16 00:06 .. drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 bin drwxr-xr-x 3 matt matt 4.0K Jan 15 23:51 dev drwxr-xr-x 7 matt matt 4.0K Jan 15 23:51 etc drwxr-xr-x 5 matt matt 4.0K Jan 15 23:51 lib drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 mnt drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 proc drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 root drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 sbin drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 tmp drwxr-xr-x 4 matt matt 4.0K Jan 15 23:51 usr drwxr-xr-x 3 matt matt 4.0K Jan 15 23:51 var drwxr-xr-x 10 matt matt 4.0K Jan 15 23:51 web matt@kali:~/Scripts/squashfs_working/squashfs-root$ ls -lah * bin: total 272K drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. -rw-r--r-- 1 matt matt 262K Jan 15 23:51 busybox dev: total 12K drwxr-xr-x 3 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 pts etc: total 200K drwxr-xr-x 7 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 3gISP drwxr-xr-x 3 matt matt 4.0K Jan 15 23:51 ath -rw-r--r-- 1 matt matt 67 Jan 15 23:51 fstab -rw-r--r-- 1 matt matt 243 Jan 15 23:51 group -rw-r--r-- 1 matt matt 26 Jan 15 23:51 host.conf -rw-r--r-- 1 matt matt 85 Jan 15 23:51 inittab -rw-r--r-- 1 matt matt 13 Jan 15 23:51 issue -rw-r--r-- 1 matt matt 54 Jan 15 23:51 lld2d.conf -rw-r--r-- 1 matt matt 109K Jan 15 23:51 mode_switch.conf.bin -rw-r--r-- 1 matt matt 215 Jan 15 23:51 nsswitch.conf -rw-r--r-- 1 matt matt 462 Jan 15 23:51 passwd drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 ppp drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 rc.d -rw-r--r-- 1 matt matt 124 Jan 15 23:51 securetty -rw-r--r-- 1 matt matt 5.8K Jan 15 23:51 services -rw-r--r-- 1 matt matt 392 Jan 15 23:51 shadow drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 wpa2 -rw-r--r-- 1 matt matt 9.5K Jan 15 23:51 wr941n.ico lib: total 1.3M drwxr-xr-x 5 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. -rw-r--r-- 1 matt matt 23K Jan 15 23:51 ld-uClibc-0.9.30.so -rw-r--r-- 1 matt matt 12K Jan 15 23:51 libcrypt-0.9.30.so -rw-r--r-- 1 matt matt 9.3K Jan 15 23:51 libdl-0.9.30.so drwxr-xr-x 3 matt matt 4.0K Jan 15 23:51 libexec -rw-r--r-- 1 matt matt 241K Jan 15 23:51 libgcc_s.so.1 -rw-r--r-- 1 matt matt 993 Jan 15 23:51 libip4tc.la -rw-r--r-- 1 matt matt 27K Jan 15 23:51 libip4tc.so.0.0.0 -rw-r--r-- 1 matt matt 993 Jan 15 23:51 libip6tc.la -rw-r--r-- 1 matt matt 28K Jan 15 23:51 libip6tc.so.0.0.0 -rw-r--r-- 1 matt matt 1.2K Jan 15 23:51 libiptc.la -rw-r--r-- 1 matt matt 4.9K Jan 15 23:51 libiptc.so.0.0.0 -rw-r--r-- 1 matt matt 33K Jan 15 23:51 libiw.so.29 -rw-r--r-- 1 matt matt 105K Jan 15 23:51 libm-0.9.30.so -rw-r--r-- 1 matt matt 4.4K Jan 15 23:51 libmsglog.so -rw-r--r-- 1 matt matt 1.7K Jan 15 23:51 libnsl-0.9.30.so -rw-r--r-- 1 matt matt 78K Jan 15 23:51 libpthread-0.9.30.so -rw-r--r-- 1 matt matt 1.7K Jan 15 23:51 libresolv-0.9.30.so -rw-r--r-- 1 matt matt 4.6K Jan 15 23:51 librt-0.9.30.so -rw-r--r-- 1 matt matt 394K Jan 15 23:51 libuClibc-0.9.30.so -rw-r--r-- 1 matt matt 33K Jan 15 23:51 libusb-0.1.so.4.4.4 -rw-r--r-- 1 matt matt 4.8K Jan 15 23:51 libutil-0.9.30.so -rw-r--r-- 1 matt matt 134K Jan 15 23:51 libwpa_common.so -rw-r--r-- 1 matt matt 13K Jan 15 23:51 libwpa_ctrl.so -rw-r--r-- 1 matt matt 1010 Jan 15 23:51 libxtables.la -rw-r--r-- 1 matt matt 28K Jan 15 23:51 libxtables.so.2.1.0 drwxr-xr-x 3 matt matt 4.0K Jan 15 23:51 modules drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 pkgconfig mnt: total 8.0K drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. proc: total 8.0K drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. root: total 8.0K drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. sbin: total 1.3M drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. -rw-r--r-- 1 matt matt 18K Jan 15 23:51 80211stats -rw-r--r-- 1 matt matt 11K Jan 15 23:51 apstart -rw-r--r-- 1 matt matt 22K Jan 15 23:51 athstats -rw-r--r-- 1 matt matt 6.1K Jan 15 23:51 athstatsclr -rw-r--r-- 1 matt matt 24K Jan 15 23:51 dumpregs -rw-r--r-- 1 matt matt 349K Jan 15 23:51 hostapd -rw-r--r-- 1 matt matt 235 Jan 15 23:51 hotplug -rw-r--r-- 1 matt matt 35K Jan 15 23:51 ifrename -rw-r--r-- 1 matt matt 67K Jan 15 23:51 iptables-multi -rw-r--r-- 1 matt matt 31K Jan 15 23:51 iwconfig -rw-r--r-- 1 matt matt 21K Jan 15 23:51 iwevent -rw-r--r-- 1 matt matt 18K Jan 15 23:51 iwgetid -rw-r--r-- 1 matt matt 33K Jan 15 23:51 iwlist -rw-r--r-- 1 matt matt 18K Jan 15 23:51 iwpriv -rw-r--r-- 1 matt matt 19K Jan 15 23:51 iwspy -rw-r--r-- 1 matt matt 12K Jan 15 23:51 pktlogconf -rw-r--r-- 1 matt matt 60K Jan 15 23:51 pktlogdump -rw-r--r-- 1 matt matt 8.2K Jan 15 23:51 reg -rw-r--r-- 1 matt matt 175K Jan 15 23:51 tc -rw-r--r-- 1 matt matt 21K Jan 15 23:51 wlanconfig -rw-r--r-- 1 matt matt 213K Jan 15 23:51 wpa_supplicant -rw-r--r-- 1 matt matt 28K Jan 15 23:51 wpatalk tmp: total 8.0K drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. usr: total 56K drwxr-xr-x 4 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. -rw-r--r-- 1 matt matt 30K Jan 15 23:51 arp drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 bin -rw-r--r-- 1 matt matt 7.6K Jan 15 23:51 net_ioctl drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 sbin var: total 12K drwxr-xr-x 3 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 run web: total 40K drwxr-xr-x 10 matt matt 4.0K Jan 15 23:51 . drwxr-xr-x 14 matt matt 4.0K Jan 15 23:51 .. drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 dynaform drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 frames drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 help drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 images drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 localiztion drwxr-xr-x 4 matt matt 4.0K Jan 15 23:51 login drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 oem drwxr-xr-x 2 matt matt 4.0K Jan 15 23:51 userRpm
$ file bin/busybox bin/busybox: ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, interpreter /lib/ld-uClibc.so.0, stripped
Leave a Reply