tenda w311r firmware parsing problem about binwalk HOT 11 CLOSED

What tool are you using to decompress the LZMA file? Binwalk's auto-extraction (-e) decompresses it fine, and manual extraction using p7zip produces no warnings or errors:

 7-Zip (A) 9.04 beta  Copyright (c) 1999-2009 Igor Pavlov  2009-05-30
 p7zip Version 9.04 (locale=en_US.utf8,Utf16=on,HugeFiles=on,2 CPUs)

 Processing archive: 1C.7z

 Extracting  1C

 Everything is Ok

 Size:       2442476
 Compressed: 888804

Based on the strings in the decompressed file, this appears to be running the eCos real-time operating system (http://ecos.sourceware.org/):

 $ strings 1C | grep -i ecos
 ecos_name
 ecos
 eCos Router/AP %s 
 /projects/hnd_swbuild_ext17/build_linux_ext17/AKASHI_REL_5_110_27_7/ecos-external-router-5357-partial-src/2011.5.15.0/src/bcmcrypto/bn.c
 /projects/hnd_swbuild_ext17/build_linux_ext17/AKASHI_REL_5_110_27_7/ecos-external-router-5357-partial-src/2011.5.15.0/src/router/nas/nas_wksp.c
 /projects/hnd_swbuild_ext17/build_linux_ext17/AKASHI_REL_5_110_27_7/ecos-external-router-5357-partial-src/2011.5.15.0/src/router/nas/nas_wksp_radius.c
 /projects/hnd_swbuild_ext17/build_linux_ext17/AKASHI_REL_5_110_27_7/ecos-external-router-5357-partial-src/2011.5.15.0/src/router/libbcm/bcmgpio.c
 /projects/hnd_swbuild_ext17/build_linux_ext17/AKASHI_REL_5_110_27_7/ecos-external-router-5357-partial-src/2011.5.15.0/src/wps/common/shared/slist.c
 ECOS
 eCos_node

from binwalk.

using LZMA in console will get a warning,and 7-zip not.
Hum,I didn't noticed this at all,I simply thought it must be linux for the firmware has a trx header. I've never seen any document mentioned the eCos . therefore , it isn't a bad idea to add more info in output. : )
and now,in this situation,it's difficult to modify the firmware for me.

BTW,I found the string 'Tenda_mfg' in Chinese ver.(http://www.tenda.com.cn/uploadfile/downloads/uploadfile/201211/W311R/W311R_V5.07.44_cn.rar),and the product using GoAhead as web interface as well. I nmaped , udp port closed,only opening the port for QoS,Upnp,ntp and dhcp. I believe there is a way.

from binwalk.

Yes, I noticed that in the Russian firmware also, though it uses a slightly different name. The Russian one at least appears to be disabled by default and can be activated through the web interface. I suspect at this point that you need to be logged in to start it via the web interface, but I'm not positive. Something to look into for sure. :)

from binwalk.

You're right.The web service not listen on udp ,so the expliot is invalid.Logging into web interface is not a problem , thanks tenda left an fantastic auth method--Enter correct password and it set a cookie proves you‘ve logged.Just a cookie,no any session validation.W311R CHN ver,Hardware ver 5.0. I made a feedback to tenda some months ago,but no response.This made me thought there must be another way.I‘ll make futher research about this after I finished my end year exam.Anyhow,thanks for your developing binwalk.

from binwalk.

hey guys is it possible to unpack tenda's firmware and edit some points inside ? and if is possible then how can pack again to trx/bin file ?

from binwalk.

If it uses TRX for it's firmware update format, the firmware-mod-kit should allow you to unpack/edit/repack it: https://code.google.com/p/firmware-mod-kit/

from binwalk.

yeah its trx.. this is worst brand that ever was used by me..
i can unfilter ports but they still closed so my inet is unusable. So i can try to make some changes on it firmware if is possible..

from binwalk.

Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake

Firmware Mod Kit (extract) 0.99, (c)2011-2013 Craig Heffner, Jeremy Collake

Preparing tools ...
uncramfs.c: In function 'usage':
uncramfs.c:72:4: warning: incompatible implicit declaration of built-in function 'exit' [enabled by default]
uncramfs.c: In function 'do_file':
uncramfs.c:231:28: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
uncramfs.c:231:15: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
uncramfs.c: In function 'do_symlink':
uncramfs.c:315:7: warning: incompatible implicit declaration of built-in function 'exit' [enabled by default]
uncramfs.c: In function 'main':
uncramfs.c:696:3: warning: incompatible implicit declaration of built-in function 'exit' [enabled by default]
uncramfs.c:703:7: warning: incompatible implicit declaration of built-in function 'exit' [enabled by default]
uncramfs.c:712:7: warning: incompatible implicit declaration of built-in function 'exit' [enabled by default]
uncramfs.c:720:7: warning: incompatible implicit declaration of built-in function 'exit' [enabled by default]
uncramfs.c:727:4: warning: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'size_t' [-Wformat]
LzmaTest.c: In function 'main':
LzmaTest.c:238:3: warning: format not a string literal and no format arguments [-Wformat-security]
decode.c: In function 'lzma_decode':
decode.c:127:2: warning: pointer targets in passing argument 10 of 'LzmaDecode' differ in signedness [-Wpointer-sign]
In file included from decode.c:51:0:
LzmaDecode.h:86:5: note: expected 'unsigned int ' but argument is of type 'int *'
mkcramfs.c: In function 'parse_directory':
mkcramfs.c:245:2: warning: passing argument 4 of 'scandir' from incompatible pointer type [enabled by default]
In file included from mkcramfs.c:31:0:
/usr/include/dirent.h:254:12: note: expected 'int ()(const struct dirent *, const struct dirent *)' but argument is of type 'int ()(const void *, const void *)'
mkcramfs.c:287:15: warning: pointer targets in assignment differ in signedness [-Wpointer-sign]
mkcramfs.c: In function 'write_superblock':
mkcramfs.c:399:3: warning: pointer targets in passing argument 1 of 'strncpy' differ in signedness [-Wpointer-sign]
In file included from /usr/include/string.h:640:0,
from mkcramfs.c:34:
/usr/include/bits/string3.h:117:1: note: expected 'char * restrict' but argument is of type 'u8 *'
mkcramfs.c:401:3: warning: pointer targets in passing argument 1 of 'strncpy' differ in signedness [-Wpointer-sign]
In file included from /usr/include/string.h:640:0,
from mkcramfs.c:34:
/usr/include/bits/string3.h:117:1: note: expected 'char * restrict' but argument is of type 'u8 *'
mkcramfs.c: In function 'write_directory_structure':
mkcramfs.c:480:4: warning: pointer targets in passing argument 1 of 'strlen' differ in signedness [-Wpointer-sign]
In file included from mkcramfs.c:34:0:
/usr/include/string.h:399:15: note: expected 'const char *' but argument is of type 'unsigned char *'
mkcramfs.c: In function 'do_compress':
mkcramfs.c:598:4: warning: pointer targets in passing argument 1 of 'compress2' differ in signedness [-Wpointer-sign]
In file included from mkcramfs.c:37:0:
/usr/include/zlib.h:1174:21: note: expected 'Bytef *' but argument is of type 'char *'
mkcramfs.c:598:4: warning: pointer targets in passing argument 3 of 'compress2' differ in signedness [-Wpointer-sign]
In file included from mkcramfs.c:37:0:
/usr/include/zlib.h:1174:21: note: expected 'const Bytef *' but argument is of type 'char *'
mkcramfs.c: In function 'write_data':
mkcramfs.c:647:5: warning: pointer targets in passing argument 3 of 'do_compress' differ in signedness [-Wpointer-sign]
mkcramfs.c:578:21: note: expected 'const char *' but argument is of type 'unsigned char *'
mkcramfs.c: In function 'main':
mkcramfs.c:773:4: warning: format '%Ld' expects argument of type 'long long int', but argument 3 has type 'loff_t' [-Wformat]
mkcramfs.c:810:2: warning: format '%d' expects argument of type 'int', but argument 2 has type 'ssize_t' [-Wformat]
mkcramfs.c:817:2: warning: format '%d' expects argument of type 'int', but argument 2 has type 'ssize_t' [-Wformat]
mkcramfs.c:821:50: warning: format '%d' expects argument of type 'int', but argument 2 has type 'long unsigned int' [-Wformat]
mkcramfs.c:825:2: warning: pointer targets in passing argument 2 of 'crc32' differ in signedness [-Wpointer-sign]
In file included from mkcramfs.c:37:0:
/usr/include/zlib.h:1600:23: note: expected 'const Bytef *' but argument is of type 'char *'
cramfsck.c: In function 'test_crc':
cramfsck.c:224:8: warning: ignoring return value of 'read', declared with attribute warn_unused_result [-Wunused-result]
cramfsck.c: In function 'romfs_read':
cramfsck.c:294:7: warning: ignoring return value of 'read', declared with attribute warn_unused_result [-Wunused-result]
cramfsck.c: In function 'do_symlink':
cramfsck.c:553:11: warning: ignoring return value of 'asprintf', declared with attribute warn_unused_result [-Wunused-result]
cramfsswap.c: In function 'main':
cramfsswap.c:112:8: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result]
cramfsswap.c:242:10: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result]
cramfsswap.c:250:10: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result]
cramfsswap.c:302:12: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result]
cramfsswap.c:328:12: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result]
cramfsswap.c:341:10: warning: ignoring return value of 'write', declared with attribute warn_unused_result [-Wunused-result]
mksquashfs.c: In function 'dir_scan':
mksquashfs.c:1444:6: warning: format '%Ld' expects argument of type 'long long int', but argument 3 has type '__off_t' [-Wformat]
mksquashfs.c: In function 'write_file':
mksquashfs.c:1170:14: warning: ignoring return value of 'ftruncate', declared with attribute warn_unused_result [-Wunused-result]
ZLib.cpp:183:31: error: expected initializer before 'OF'
makefile:34: recipe for target 'ZLib.o' failed
make[2]: ** [ZLib.o] Error 1
Makefile:13: recipe for target 'mksquashfs-lzma' failed
make[1]: *** [mksquashfs-lzma] Error 2
Makefile:7: recipe for target 'all' failed
make: *** [all] Error 2
Tools build failed! Check pre-requisites. Quitting...

will be not that easy to unpack...

from binwalk.

This is a known issue. Gentoo (which I assume you are running) changed the #defines in the zlib library so that tools linked against the standard zlib library fail with this error. You have to change the build command to contain this: "-DOF=_OF", IIRC. Or install the standard zlib library.

from binwalk.

hm i am on gentoo but where to put this command ?

from binwalk.

hmm on debian virtualbox guest have progress but what the hell ?

LZMADecoder.c:179:49: warning: cast from pointer to integer of different size [-Wpointer-to-int-cast]
pseudo.c:70:13: warning: ‘dump_pseudo’ defined but not used [-Wunused-function]
pseudo.c:69:13: warning: ‘dump_pseudo’ defined but not used [-Wunused-function]
webdecomp.c: In function ‘detect_key’:
webdecomp.c:201:3: warning: format ‘%d’ expects argument of type ‘int’, but argument 5 has type ‘size_t’ [-Wformat]
Scanning firmware...

Scan Time: 2014-07-13 20:45:30
Signatures: 193
Target File: /root/router-firmware-kit/fmk/W316R_ecos_lzma_2.trx
MD5 Checksum: e1279154107fee1a2bd871d6c9ff2886

DECIMAL HEX DESCRIPTION

0 0x0 TRX firmware header, little endian, header size: 28 bytes, image size: 929792 bytes, CRC32: 0xBFE80B6E flags/version: 0x10000
11 0xB LZMA compressed data, properties: 0xBF, dictionary size: 65536 bytes, uncompressed size: 28 bytes
28 0x1C LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 2636884 bytes

Extracting 0 bytes of trx header image at offset 0
ERROR: No supported file system found! Aborting...

what not supported file system ?

from binwalk.