WG2600HPx ファーム展開メモ (2)

続き的なもの。

前回OpenSSLによりdecryptしたファイルを用い、KernelとRootfsの取り出し。
ブートローダ用スクリプト, TP (TestProgram), Kernel (HLOS), RootFSの4つのイメージがFIT形式で格納されている。
余談: 以下は全てWindows 10環境(WSL含む)での作業。

バイナリエディタ等でdecryptしたファーム内のhexデータ d00dfeed (D00DFEED) を探し、

tofu@Tofu-H170W10 MINGW64 ~/router/nec/wg2600hp2/wg2600hp2_1_0_5
$ busybox hexdump -n 256 -C wg2600hp2_1_0_5.bin.pad.dec
00000000  55 53 42 20 41 54 45 52  4d 57 4c 33 30 35 30 00  |USB ATERMWL3050.|
00000010  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000020  00 00 ff ff 00 00 00 68  00 00 00 18 6a af 00 00  |.......h....j...|
00000030  00 00 00 00 00 00 00 00  56 45 52 53 49 4f 4e 3a  |........VERSION:|
00000040  20 33 2e 33 39 2e 32 30  0a 4f 45 4d 31 20 56 45  | 3.39.20.OEM1 VE|
00000050  52 53 49 4f 4e 3a 20 31  2e 30 2e 35 0a 43 6f 70  |RSION: 1.0.5.Cop|
00000060  79 72 69 67 68 74 28 63  29 20 4e 45 43 20 50 6c  |yright(c) NEC Pl|
00000070  61 74 66 6f 72 6d 73 2c  20 4c 74 64 2e 20 32 30  |atforms, Ltd. 20|
00000080  30 31 2d 32 30 31 35 0a  00 02 ff fd 00 f9 66 50  |01-2015.......fP|
00000090  00 00 00 18 ce 19 00 00  00 00 00 00 00 00 00 00  |................|
000000a0  d0 0d fe ed 00 f9 66 34  00 00 00 38 00 f9 64 64  |......f4...8..dd|
000000b0  00 00 00 28 00 00 00 11  00 00 00 10 00 00 00 00  |...(............|
000000c0  00 00 00 3c 00 f9 64 2c  00 00 00 00 00 00 00 00  |...<..d,........|
000000d0  00 00 00 00 00 00 00 00  00 00 00 01 00 00 00 00  |................|
000000e0  00 00 00 03 00 00 00 04  00 00 00 32 5c 41 a9 4f  |...........2\A.O|
000000f0  00 00 00 03 00 00 00 17  00 00 00 00 46 6c 61 73  |............Flas|
00000100

それが先頭に来るよう切り詰め。

tofu@Tofu-H170W10 MINGW64 ~/router/nec/wg2600hp2/wg2600hp2_1_0_5
$ busybox hexdump -n 256 -C wg2600hp2_1_0_5.bin.pad.dec.itb
00000000  d0 0d fe ed 00 f9 66 34  00 00 00 38 00 f9 64 64  |......f4...8..dd|
00000010  00 00 00 28 00 00 00 11  00 00 00 10 00 00 00 00  |...(............|
00000020  00 00 00 3c 00 f9 64 2c  00 00 00 00 00 00 00 00  |...<..d,........|
00000030  00 00 00 00 00 00 00 00  00 00 00 01 00 00 00 00  |................|
00000040  00 00 00 03 00 00 00 04  00 00 00 32 5c 41 a9 4f  |...........2\A.O|
00000050  00 00 00 03 00 00 00 17  00 00 00 00 46 6c 61 73  |............Flas|
00000060  68 69 6e 67 20 6e 6f 72  20 31 30 30 20 31 30 30  |hing nor 100 100|
00000070  30 30 00 00 00 00 00 01  69 6d 61 67 65 73 00 00  |00......images..|
00000080  00 00 00 01 73 63 72 69  70 74 00 00 00 00 00 03  |....script......|
00000090  00 00 00 0a 00 00 00 00  66 6c 61 73 68 2e 73 63  |........flash.sc|
000000a0  72 00 00 00 00 00 00 03  00 00 63 c7 00 00 00 0c  |r.........c.....|
000000b0  69 66 20 74 65 73 74 20  22 78 24 76 65 72 62 6f  |if test "x$verbo|
000000c0  73 65 22 20 3d 20 22 78  22 3b 20 74 68 65 6e 0a  |se" = "x"; then.|
000000d0  66 61 69 6c 65 64 6d 73  67 3d 27 5b 66 61 69 6c  |failedmsg='[fail|
000000e0  65 64 5d 27 0a 65 6c 73  65 0a 66 61 69 6c 65 64  |ed]'.else.failed|
000000f0  6d 73 67 3d 27 23 23 23  23 23 23 23 23 23 23 23  |msg='###########|
00000100

切り詰めたファイルを dumpimage コマンドでリスト表示。

tofu@Tofu-H170W10:/mnt/d/router/NEC/WG2600HP2/wg2600hp2_1_0_5$ dumpimage -l wg2600hp2_1_0_5.bin.pad.dec.itb
FIT description: Flashing nor 100 10000
Created:         Fri Jan 18 19:24:15 2019
 Image 0 (script)
  Description:  flash.scr
  Created:      Fri Jan 18 19:24:15 2019
  Type:         Script
  Compression:  uncompressed
  Data Size:    25543 Bytes = 24.94 KiB = 0.02 MiB
  Hash algo:    crc32
  Hash value:   fad97085
 Image 1 (tp-147c46b934f3a70b73abf2c62847c7685388b4b8)
  Description:  rotary-tp.bin
  Created:      Fri Jan 18 19:24:15 2019
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    66736 Bytes = 65.17 KiB = 0.06 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
  Hash algo:    crc32
  Hash value:   22f74fee
 Image 2 (hlos-894c257106b4e407230bdc07bedb9c44ce088f40)
  Description:  openwrt-ipq806x-3.4-uImage
  Created:      Fri Jan 18 19:24:15 2019
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    1925174 Bytes = 1880.05 KiB = 1.84 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
  Hash algo:    crc32
  Hash value:   7d55fcec
 Image 3 (fs-73be11f50c9325ae68c43b1ae01663c947d14314)
  Description:  openwrt-ipq806x-squashfs-root.img
  Created:      Fri Jan 18 19:24:15 2019
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    14325760 Bytes = 13990.00 KiB = 13.66 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
  Hash algo:    crc32
  Hash value:   bb43bd4c

再び dumpimage コマンドを用い、KernelとRootFSを取り出し。

-i: 入力ファイル
-p: FIT内の位置指定、上記リストの Image n
最後: 出力先ファイル名
tofu@Tofu-H170W10:/mnt/d/router/NEC/WG2600HP2/wg2600hp2_1_0_5$ dumpimage -T flat_dt -i wg2600hp2_1_0_5.bin.pad.dec.itb -p 2 wg2600hp2_1_0_5_kernel.bin
Extracted:
 Image 2 (hlos-894c257106b4e407230bdc07bedb9c44ce088f40)
  Description:  openwrt-ipq806x-3.4-uImage
  Created:      Fri Jan 18 19:24:15 2019
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    1925174 Bytes = 1880.05 KiB = 1.84 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
  Hash algo:    crc32
  Hash value:   7d55fcec
tofu@Tofu-H170W10:/mnt/d/router/NEC/WG2600HP2/wg2600hp2_1_0_5$ dumpimage -T flat_dt -i wg2600hp2_1_0_5.bin.pad.dec.itb -p 3 wg2600hp2_1_0_5_rootfs.bin
Extracted:
 Image 3 (fs-73be11f50c9325ae68c43b1ae01663c947d14314)
  Description:  openwrt-ipq806x-squashfs-root.img
  Created:      Fri Jan 18 19:24:15 2019
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    14325760 Bytes = 13990.00 KiB = 13.66 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
  Hash algo:    crc32
  Hash value:   bb43bd4c
広告

コメントを残す

以下に詳細を記入するか、アイコンをクリックしてログインしてください。

WordPress.com ロゴ

WordPress.com アカウントを使ってコメントしています。 ログアウト /  変更 )

Google フォト

Google アカウントを使ってコメントしています。 ログアウト /  変更 )

Twitter 画像

Twitter アカウントを使ってコメントしています。 ログアウト /  変更 )

Facebook の写真

Facebook アカウントを使ってコメントしています。 ログアウト /  変更 )

%s と連携中