Binwalk 0.3.8 Release

Binwalk 0.3.8 has just been released. In addition to bug fixes, signature updates and speed improvements, binwalk can now also identify raw executable code for various different architectures using the -A option:

$ binwalk -A soho.bin

DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------
132       	0x84      	MIPSEL function epilogue
144       	0x90      	MIPSEL function epilogue
176       	0xB0      	MIPSEL function epilogue
224       	0xE0      	MIPSEL function epilogue
248       	0xF8      	MIPSEL function prologue
432       	0x1B0     	MIPSEL function epilogue
440       	0x1B8     	MIPSEL function prologue
896       	0x380     	MIPSEL function epilogue
904       	0x388     	MIPSEL function prologue
1548      	0x60C     	MIPSEL function epilogue
1556      	0x614     	MIPSEL function prologue
2128      	0x850     	MIPSEL function epilogue
2136      	0x858     	MIPSEL function prologue
2800      	0xAF0     	MIPSEL function epilogue
2808      	0xAF8     	MIPSEL function prologue
2880      	0xB40     	MIPSEL function epilogue
2888      	0xB48     	MIPSEL function prologue
3172      	0xC64     	MIPSEL function epilogue
...
1830540   	0x1BEE8C  	MIPSEL function epilogue
1830584   	0x1BEEB8  	MIPSEL function epilogue
1830616   	0x1BEED8  	MIPSEL function epilogue
1830748   	0x1BEF5C  	MIPSEL function epilogue
1830800   	0x1BEF90  	MIPSEL function epilogue
1830812   	0x1BEF9C  	MIPSEL function epilogue

Grab the latest release here!

Extracting Non-Standard SquashFS Images

SquashFS is a widely used file system in embedded Linux devices; in fact, it is probably one of the most commonly used file systems among Linux based consumer products.

While many devices use standard SquashFS file systems that can be extracted using the unsquashfs tools provided in the firmware mod kit, you will inevitably encounter some implementations that are…special.

Perhaps the vendor simply changed the SquashFS signature, or maybe they modified something in the de/compression code, but for one reason or another, none of the unsquashfs tools will work.

The D-Link DIR-320 is special.

Continue reading