Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add modified CramFS to filesystem magic #363

Open
E3V3A opened this issue Oct 16, 2018 · 3 comments
Open

Add modified CramFS to filesystem magic #363

E3V3A opened this issue Oct 16, 2018 · 3 comments

Comments

@E3V3A
Copy link
Contributor

E3V3A commented Oct 16, 2018

Some time ago, there were a bunch of Pirelli routers whose firmware was using a modified CramFS.
(also containing LZMA structures).

The file magic for these were: 45 3D CD 28.
With LZMA:

  • major blocks using: 5D 00 00 40 and
  • minor ones using 5D 00 00 80

I suggest to call this after the modifers:
Jungo's OpenRG version of CramFS or alternatively
Jungo modified CramFS

How can I add this to the magic file?


PS. The original:

http://va.ler.io/dl/lzma-uncramfs.tar.gz
lzma-uncramfs v0.7rg by Andrew Stitcher, lzma for openrg  by V. Di Giampietro ([email protected])
45 3D CD 28, and is preceding (by 12 bytes) the string "Compressed ROMFS"
@E3V3A
Copy link
Contributor Author

E3V3A commented Nov 26, 2018

uuhm, this is not a support ticket, it's an enhancement.

@devttys0
Copy link
Collaborator

Since the LZMA version of CramFS has the same signature, I think there are two approaches to this.

First, the easy way: just add the lzma-uncramfs utility as a cramfs extractor. If it fails, binwalk will move on to the next cramfs extractor. This requires minimal effort, and the files will be extracted correctly, but there won't be anything in binwalk's output to indicate that the CramFS image has Jungo's LZMA modifications.

Second, the "correct" way: write a plugin. I don't think this can be done with a simple signature as the location of the compressed blocks is not necessarily predictable (at least AFAIK). A plugin that does some basic parsing of the CramFS image and looks at a compressed block and sees that it starts with 0x5D could then modify the displayed description string to indicate that it's a Jungo LZMA CramFS image.

@Engineer-26
Copy link

Engineer-26 commented Jun 18, 2024

it seems the issue is that after Ubuntu 18.04 cramfs was depricated for squashfs. To manually install cramfs extractor support:

  • git clone https://github.com/davidribyrne/cramfs
    • add #include <sys/sysmacros.h> to cramfsswap.c
    • make && sudo make install
  • git clone https://github.com/julijane/cramfsswap
    • edit Makefile and change gcc -Wall -g -O -o cramfsswap -lz cramfsswap.c togcc -Wall -g -O -o cramfsswap cramfsswap.c -lz
    • make && sudo make install
      binwalk -e now supports extracting cramfs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants