16

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it:

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------
52          0x34        uImage header, header size: 64 bytes, header CRC: 0x1A27096C, created: Tue Nov 27 06:52:32 2012, image size: 3448768 bytes, Data Address: 0x80000000, Entry Point: 0x8023A000, data CRC: 0x584BBD98, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
116         0x74        LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2445108 bytes
983092      0xF0034     Squashfs filesystem, little endian, non-standard signature,  version 3.0, size: 2463170 bytes,  637 inodes, blocksize: 65536 bytes, created: Tue Nov 27 06:51:11 2012

Once extracted the file and checking it with hexdump I found the folowing magic number shsq:

00000000  73 68 73 71 7d 02 00 00  00 00 00 54 03 00 00 08  |shsq}......T....|
00000010  1c 71 b7 a0 12 71 b7 19  1f 73 00 18 03 00 00 00  |.q...q...s......|
00000020  38 72 10 00 c0 02 01 cf  54 b4 50 d4 0c 1f 10 00  |8r......T.P.....|
00000030  00 00 00 00 00 01 00 2c  00 00 00 02 00 a2 bf c2  |.......,........|
00000040  95 25 00 00 00 00 00 b6  95 25 00 00 00 00 00 be  |.%.......%......|

This is not the first time I found this header, but I couldn't find a solution for extract it.

Things I tried so far:

You can find further information of this issue in this link but without solution:

http://forums.modem-help.co.uk/viewtopic.php?t=9668

Anyone has idea about how to achieve this?

asheeshr
  • 2,465
  • 8
  • 28
  • 41
Nucklear
  • 725
  • 2
  • 8
  • 17
  • 1
    SquashFS has been hacked to support LZMA by many a vendor, so without more information on the vendor/model, it's hard to point to a definitive answer. Have you looked to see if the vendor has any GPL code released for this device (or others)? FWIW, the firmware-mod-kit was able to extract the squashfs image from the link in Igor Skochinsky's answer, which has the same magic bytes. – devttys0 Jun 08 '13 at 01:28
  • Actually firmware-mod-kit does support LZMA. I ran into a similar problem with a Zyxel router which also used a modified version of squashfs and managed to get around it, but the respective libs need to be available at compile time, IIRC. – 0xC0000022L Jun 08 '13 at 02:51
  • 1
    @Nucklear: are you trying to extract this on a 32 or 64 bit system? I've had issues with hacked up unsquashfs tools not working properly on 64 bit systems. – devttys0 Jun 08 '13 at 13:50
  • @devttys0 Hi, this is the vendor website for this model: http://www.buffalotech.com/products/wireless/single-band-routers/airstation-n150-wireless-router I don't see any GPL code there, and I'm using a 64bits kali distro. I'm going to test it on a 32bits system and post here the result. Regards – Nucklear Jun 08 '13 at 14:03
  • @devttys0 Yes, you were right the problem was doing it in a 64bits system, I prepared a 32bits VM and uncompresed it with squashfs-3.2-r2-lzma included on the last version of firmware-mod-kit – Nucklear Jun 08 '13 at 14:41
  • On linux: unsquashfs filename – uDude Sep 28 '19 at 07:14

2 Answers2

6

0x73687371 is apparently a magic value used to indicate LZMA compression by some vendors.

I can't test it since I don't have the image but here's a blog post with some description and source code links which is supposed to handle it:

http://www.poppopret.org/?p=204

EDIT: after some struggle with the download site I was able to get the decrypted shsq binary. I could open it easily with 7-Zip 9.21 beta:

enter image description here

Presumably any later versions will work too.

You can find the source code for handling SquashFS in 7z922.tar.bz2, file CPP/7zip/Archive/SquashfsHandler.cpp so you can try to figure out why it works and what's wrong with other approaches.

Igor Skochinsky
  • 36,553
  • 7
  • 65
  • 115
  • Hi Igor, thanks for your response but as you can see I posted a comment in that blog (Last comment) but that solution didn't work for me. – Nucklear Jun 08 '13 at 09:41
1

Try the patch from: http://sourceforge.net/p/squashfs/patches/20/

It seems to work ok on an X86_64 Debian installation.

user4744
  • 11
  • 1