Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

for a few days I was trying to extract the filesystem of a router firmware. Checking the image that the vendor provides I can see a SquashFS flag on it:

DECIMAL     HEX         DESCRIPTION
-------------------------------------------------------------------------------------------------------
52          0x34        uImage header, header size: 64 bytes, header CRC: 0x1A27096C, created: Tue Nov 27 06:52:32 2012, image size: 3448768 bytes, Data Address: 0x80000000, Entry Point: 0x8023A000, data CRC: 0x584BBD98, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
116         0x74        LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2445108 bytes
983092      0xF0034     Squashfs filesystem, little endian, non-standard signature,  version 3.0, size: 2463170 bytes,  637 inodes, blocksize: 65536 bytes, created: Tue Nov 27 06:51:11 2012 

Once extracted the file and checking it with hexdump I found the folowing magic number shsq:

00000000  73 68 73 71 7d 02 00 00  00 00 00 54 03 00 00 08  |shsq}......T....|
00000010  1c 71 b7 a0 12 71 b7 19  1f 73 00 18 03 00 00 00  |.q...q...s......|
00000020  38 72 10 00 c0 02 01 cf  54 b4 50 d4 0c 1f 10 00  |8r......T.P.....|
00000030  00 00 00 00 00 01 00 2c  00 00 00 02 00 a2 bf c2  |.......,........|
00000040  95 25 00 00 00 00 00 b6  95 25 00 00 00 00 00 be  |.%.......%......|

This is not the first time I found this header, but I couldn't find a solution for extract it.

Things I tried so far:

You can find further information of this issue in this link but without solution:

http://forums.modem-help.co.uk/viewtopic.php?t=9668

How to achieve this?

share|improve this question
    
Maybe try 7-zip (latest alpha). –  Igor Skochinsky Jun 5 '13 at 11:30
    
@IgorSkochinsky It doesnt work, I guess 7zip support for this kind of files only works with standard compression (Header sqsh) and not with this one. –  Nucklear Jun 5 '13 at 12:12
add comment

closed as off-topic by Rory Alsop Feb 28 at 9:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

It would really help if you could provide the model of the Router and the firmware versions, you're looking at. I know some router manufactures like to to make slight modifications to their FS tools (read SquashFS). It's also possible that the extracted image is encrypted or compressed again in a different format. Did you look at OpenWRT site?

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.