Here's a direct link to the firmware referenced:


I'm having trouble extracting the file system from this particular router more specifically by using the dd command to extract the kernel within the firmware binary.

My steps:

I used binwalk dir601_revB_FW_201.bin to find that the lzma in question is located at byte #148 (so fairly early on). I tried to extract this lzma archive by using the following command:

dd if=dir601_revB_FW_201.bin skip=148 bs=1 count=8388608 of=kernel.lzma

Where count is the dictionary size of the archive but to no avail because when I try to unlzma my extracted archive it keeps giving me compressed data is corrupt error.

How to extract and uncompress this archive?

New contributor
Sparval is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 1
    Doesn't binwalk itself have an option to extract? – grawity Jun 12 at 21:12

In my Debian

binwalk -e dir601_revB_FW_201.bin

generates (among others) a file ./_dir601_revB_FW_201.bin.extracted/94. Below is my procedure to get the same file with dd and unlzma, like you tried.

I run your original command and the one from the other answer. In both cases I could do the extraction with 7za (with an error though) but not with sole unlzma. I was able to improve the approach so unlzma works.

First of all your count=8388608 is obviously wrong because dir601_revB_FW_201.bin is smaller. The right number is in the header:

uImage header, header size: 64 bytes, […] image size: 819799 bytes, […]

Your command should have been

dd if=dir601_revB_FW_201.bin skip=148 bs=1 count=819799 of=x.lzma

If I extract 1 byte less, unlzma x.lzma in my Debian will complain with unexpected end of input. If I extract 1 byte more, it will complain with compressed data is corrupt.

The exact number 819799 triggers no complains from the tool, everything works. After this I can binwalk x (as the other answer already noted).

The x file is identical to 94 obtained with binwalk -e (confirmed with cmp).

  • Thank you for your help! – Sparval Jun 12 at 20:32

I suggest you change a bit your dd options. Try it like this:

dd if=dir601_revB_FW_201.bin ibs=1 skip=148 of=x.lzma

Then you can uncompress it with lzma -d x.lzma and if you binwalk x you'll see something like this:

77724         0x12F9C         Certificate in DER format (x509 v3), header length: 4, sequence length: 30
1769504       0x1B0020        Linux kernel version 2.6.31
1832080       0x1BF490        CRC32 polynomial table, little endian
2081839       0x1FC42F        Neighborly text, "neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)"
  • Thank you for your help! – Sparval Jun 12 at 20:33
  • Did you use unlzma or another tool? Your command produces exactly the same *.lzma file as the OP's command. If they couldn't proceed in the first place, your answer changes nothing. – Kamil Maciorowski Jun 12 at 20:35
  • I used lzma -d. It's basically the standard tool for .lzma files. – gmelis 2 days ago
  • Apparently your lzma -d (and probably unlzma) does accept archives with trailing garbage. The OP's unlzma doesn't and I guess their lzma -d won't. – Kamil Maciorowski 2 days ago
  • Well, I use the Debian repository's LZMA command line tool 9.22, if it's of any help. But still, once you have x.lzma you may dd if=x.lzma count=1791 bs=512 of=y.lzma and single out only the lzma archive in file y.lzma. – gmelis yesterday

Your Answer

Sparval is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.