-2

Does anyone know what filetype or filesystem a router Rom file (downloaded from the router interface ) is usually saved in? Is there a tool (we're not talking about archive tool like zip/7z/rar here) that I could use to unpack/properly repack the firmware file? Reason I'm asking is because I want to fiddle around, probably add some changes to them and have my router flushed with the modified firmware. The router doesn't support custom and fancy 3rd party firmwares, hence the reason I need to mod the manufacturer's stock firmware.

Improve this question
6
  • 2
    It heavily depends on the OS the router is running and its bootloader. There is no standard format among all routers.
    – LawrenceC
    Jan 31, 2014 at 15:08
  • Yeah, it would depend entirely upon the make/model and version of the router, and even if you were to specify that information to us, chances are slim that anyone has ever tried this before on that specific router -- especially if it's not one that can traditionally be reflashed with e.g. OpenWRT.
    – allquixotic
    Jan 31, 2014 at 15:09
  • here is the specification of the router I was talking about : TP-LINK TD-W8951ND with firmware ZynOS
    – user1863359
    Jan 31, 2014 at 15:22
  • You do understand even if you unpack the file its going to be the compiled version of the firmware right?
    – Ramhound
    Jan 31, 2014 at 16:19
  • I Have no Idea , but there is a service (website) allowing you to upload you Rom file and extract Informations , this what I need , but I need something on local
    – user1863359
    Jan 31, 2014 at 16:45

1 Answer 1

Reset to default
2

A tool named binwalk might be a good start point where it comes to analyzing a firmware. It will produce a listing what exactly contains the firmware file. It is also capable of extracting an identified blocks, but I'm using dd instead.

Though very useful, binwalk is not fully accurate. I am actually struggling with ZynOS firmware and binwalk says that is LZMA compressed archive, but none of the LZMA tools is able to unpack it. It looks like a big pack of data without any known file structure.

It might be a bad information for you, but sometimes it would not be possible to simply unpack it, change something and pack it back again (like my Linksys where the firmware is just a SquashFS partition with a typical Linux file system). I will be doing further researches, and if I happen to find something interesting, I will update my post.

You should get a similar output from binwalk.

    DECIMAL         HEX             DESCRIPTION
-------------------------------------------------------------------------------------------------------------------
65790           0x100FE         LZMA compressed data, properties: 0x7E, dictionary size: 4194304 bytes, uncompressed size: 65536 bytes
84992           0x14C00         ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 66696, compressed size: 16847, uncompressed checksum: 0xCB32, compressed checksum: 0xD5A5, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0
85043           0x14C33         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 66696 bytes
128002          0x1F402         GIF image data, version "89a", 200 x 50
136194          0x21402         GIF image data, version "89a", 560 x 50
328486          0x50326         Copyright string: " (c) 2001 - 2012 TP-LINK TECHNOLOGIES CO., LTD.LOGIES CO., LTD."
350208          0x55800         ZynOS header, header size: 48 bytes, rom image type: ROMBIN, uncompressed size: 5077932, compressed size: 1121804, uncompressed checksum: 0xB4F9, compressed checksum: 0x84CA, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0
350259          0x55833         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 5077932 bytes

Columns:

  1. Position in the target file (decimal)
  2. Position in the target file (hexadecimal)
  3. Short description of a block
Improve this answer
3
  • what you means by "I'm using dd" ?
    – user1863359
    Feb 12, 2014 at 15:40
  • thanks for the response , I already try the binwalk tool and I faced the same problems .... actually I'm not very familiarized with Linux Os and I'm searching for a win tool .... I was using an online service [50.57.229.26/zynos.php] but it's out of service now !!... last thing can you plse explain to me what you means by "I'm using dd" ?
    – user1863359
    Feb 12, 2014 at 15:46
  • "dd" is a general purpose, binary copy tool. Suppose you want to extract the GIF located at offset 128002, then you simply type in a console: dd if=firmware.bin of=image1.gif bs=1 skip=128002 count=8132. "count" value is a difference of destination segment offset and following segment offset, in this case: 136194-128002. In some cases, binwalk's extract option might be a better choice, though. Try, try and... Try.
    – itachi
    Feb 18, 2014 at 14:05

Not the answer you're looking for? Browse other questions tagged .