{"action":"created","issue":{"url":"https://api.github.com/repos/devttys0/binwalk/issues/178","labels_url":"https://api.github.com/repos/devttys0/binwalk/issues/178/labels{/name}","comments_url":"https://api.github.com/repos/devttys0/binwalk/issues/178/comments","events_url":"https://api.github.com/repos/devttys0/binwalk/issues/178/events","html_url":"https://github.com/devttys0/binwalk/issues/178","id":124947353,"number":178,"title":"support extracting filesystem from kyocera printer firmware","user":{"login":"Yannik","id":801996,"avatar_url":"https://avatars.githubusercontent.com/u/801996?v=3","gravatar_id":"","url":"https://api.github.com/users/Yannik","html_url":"https://github.com/Yannik","followers_url":"https://api.github.com/users/Yannik/followers","following_url":"https://api.github.com/users/Yannik/following{/other_user}","gists_url":"https://api.github.com/users/Yannik/gists{/gist_id}","starred_url":"https://api.github.com/users/Yannik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Yannik/subscriptions","organizations_url":"https://api.github.com/users/Yannik/orgs","repos_url":"https://api.github.com/users/Yannik/repos","events_url":"https://api.github.com/users/Yannik/events{/privacy}","received_events_url":"https://api.github.com/users/Yannik/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-01-05T11:34:59Z","updated_at":"2016-01-05T18:39:48Z","closed_at":null,"body":"Hi,\r\n\r\nI am trying to extract a kyocera printer firmware. \r\n\r\nRunning `binwalk -e` on the firmware file returns the following results:\r\n```\r\nDECIMAL       HEXADECIMAL     DESCRIPTION\r\n--------------------------------------------------------------------------------\r\n15917         0x3E2D          Zlib compressed data, default compression\r\n13812163      0xD2C1C3        mcrypt 2.5 encrypted data, algorithm: \"\", keysize: 27369 bytes, mode: \"M\",\r\n26231768      0x19043D8       LZMA compressed data, properties: 0x63, dictionary size: 16777216 bytes, uncompressed size: 2883884 bytes\r\n26632662      0x19661D6       MySQL ISAM compressed data file Version 1\r\n28384990      0x1B11EDE       YAFFS file system, big endian\r\n```\r\n\r\nbinwalk extracts the a file `3E2D.zlib` from 0x3E2D to the end of the file and uncompresses it to a file `3E2D`. `strings 3E2D` shows many familiar strings belonging to ELFs and other files (static assets for the webinterface).\r\n\r\n`binwalk -e 3E2D` results in > 10GB of .7z files\r\noutput:\r\n```\r\n30629505      0x1D35E81       LZMA compressed data, properties: 0x76, dictionary size: 16777216 bytes, uncompressed size: 803209216 bytes\r\n30629825      0x1D35FC1       LZMA compressed data, properties: 0xB6, dictionary size: 16777216 bytes, uncompressed size: 266403840 bytes\r\n30631305      0x1D36589       LZMA compressed data, properties: 0x7E, dictionary size: 16777216 bytes, uncompressed size: 467992576 bytes\r\n....\r\n```\r\nthe uncompressed size is unrealistic so these must be false positives.\r\n\r\nTo exclude these I run `binwalk -e -x 'lzma compressed data' 3E2D`.\r\nThis shows a `VxWorks WIND kernel version \"2.9\"`, various ELFs, Unix Paths and other files, including a \r\n```\r\n31559244      0x1E18E4C       Linux EXT filesystem, rev 0.0, ext2 filesystem data (mounted or unclean), UUID=00000000-0000-0003-cce2-000234bb34bb\r\n```\r\nentry quite in the beginning. The extracted file `1E18E4C.ext` contains many interesting strings belonging to cgi ELFs and static web assets.\r\n\r\nAny ideas on how to properly extract this filesystem / what kind of filesystem this is?\r\n\r\nThe firmware zip can be downloaded here: \r\nhttps://mega.nz/#!bxg1QLrC!SnEZm4xUHeGmpRVP9CuzYWtXYVHS3PH7FPFv4K7A9d0\r\n\r\nEdit: This probably isn't an ext2fs but something in the direction of Fat16. \r\n\r\nMaybe this helps:\r\n```\r\n^@^@^@^A`Aÿ^@^@<94>\\¾wÀF¼wÿÿÿÿ^@^@^@^@^@^@^@^@^@^@^@^V^@^@^A`^@ÐîÄ^A^A.^@^@ÐÇø^A^B..^@ÐðH¶^Kversion.htm^@^@^@^@ÐóL¶^Gtop.htm^@^@^@^@ÐúÔ¶        index.htm^@^@Ñ^H<8c>¶^Kfavicon.ico^@^@^@^@Ñ^L0ÿ^Cadv^@^@^@^@ØØ¬ÿ^Ebasic^@^@Û|(ÿ^Ccss^@^@^@^@ÛÍ<9c>ÿ^Cdeu^@^@^@^@ÛÒ ÿ^Cdut^@^@^@^@Û×¤ÿ^Ceng^@^@^@^@ÛÜ¨ÿ^Eerror^@^@Ûátÿ^Cesp^@^@^@^@Ûæxÿ^Heventlog^@^@^@Ü^F<98>ÿ^Cfra^@^@^@^@Ü^K<9c>ÿ^Fimages^@Ü¤Äÿ^Cita^@^@^@^@Ü©Èÿ^Cjob^@^@^@^@ÝF8ÿ^Cjpn^@^@^@^@ÝK<ÿ^Bjs^@ßH¸ÿ^Dmail^@^@^@ßm´ÿ^Dopt1^@^@^@ßr¼ÿ^Gprinter^@^@^@^@à^G^\\ÿ^Crus^@^@^@^@à^L ÿ^Estart^@^@ã6 ÿ^Gstrings^@^@^@^@^@^@^@^@^@^BÞ<81>¶^@^@<94>\\¾wÀF¼wÿÿÿÿ^@^@^@^@^@^@^@^@^@^@^@^V^@^@^Bà<html dir=\"ltr\">^M\r\n<head>^M\r\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">^M\r\n<meta http-equiv=\"Content-Style-Type\" content=\"text/css\">^M\r\n<title></title>^M\r\n<link rel=\"stylesheet\" href=\"css/main.css\">^M\r\n</head>^M\r\n<body style=\"backGround:#fff\">^M\r\n<div id=\"title\"><h1>Kyocera Command Center</h1>^M\r\n<br>^M\r\n<br>^M\r\n<b>Target :</b> 2GR^M\r\n<br><br>^M\r\n<b>Template Version :</b> 006053001^M\r\n<br><br>^M\r\n<b>Specification Version :</b> Not Modified^M\r\n</div>^M\r\n<div id=\"content\">^M\r\n<B>ä¸»ã<81>ªæ<9b>´æ<96>°å<86><85>å®¹</B>^M\r\n<UL style=\"margin-top:3px;margin-bottom:5px\">^M\r\n<LI>Local Navigationã<81><8c>IE5.5ã<81>§æ­£å¸¸ã<81>«å<8b><95>ä½<9c>ã<81><97>ã<81>ªã<81><84>ã<81>®ã<82><92>ä¿®æ­£</LI>^M\r\n</UL>^M\r\n<B>å<88>¶é<99><90>äº<8b>é <85></B>^M\r\n<UL style=\"margin-top:3px;margin-bottom:5px\">^M\r\n<LI>ã<81>ªã<81><97></LI>^M\r\n</UL>^M\r\n</body>^M\r\n</html>^M\r\n^@^@^@^@^Gb<81>¶^@^@<94>\\¾wÀF¼wÿÿÿÿ^@^@^@^@^@^@^@^@^@^@^@^V^@^@^Gd<!------------------------------------------------------------------------->^M\r\n<!-- Kyocera Command Center                                              -->^M\r\n<!-- for Project code 2GR                                                -->^M\r\n<!--                                                                     -->^M\r\n<!-- Copyright (C) 2005 KYOCERA MITA Corporation                         -->^M\r\n<!------------------------------------------------------------------------->^M\r\n<!-- File Name : top.htm                                                 -->^M\r\n<!-- Category  : Topframe temporary file                                 -->^M\r\n<!-- Kind      : PageSource                                              -->^M\r\n<!------------------------------------------------------------------------->^M\r\n<!-- Original    :                                                       -->^M\r\n<!-- Modify      :                                                       -->^M\r\n<!-- Last Update : Masato Mine                            Date: 7.14.2005-->^M\r\n<!------------------------------------------------------------------------->^M\r\n<!-- Note:                                                               -->^M\r\n<!--   Please use the charactor-code \"UTF-8\" when you edit this source.  -->^M\r\n<!--   The greater part of comments are written in Japanese.             -->^M\r\n<!--                                                                     -->^M\r\n<!-- ã<82>³ã<83>¡ã<83>³ã<83><88>ã<81>¯è<8b>±èª<9e>ã<81><8c>æ¨<99>æº<96>ã<80><82>æ<97>¥æ<9c>¬èª<9e>ã<81>¯æ<89><80>ã<81>«ã<82><88>ã<82><8a>å<98><98>ã<81><8c>ã<81><82>ã<82><8b>ã<81><8b>ã<82><82>w -->^M\r\n<html dir=\"ltr\">^M\r\n<head>^M\r\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=UTF-8\">^M\r\n<meta http-equiv=\"Content-Style-Type\" content=\"text/css\">^M\r\n<meta http-equiv=\"Content-Script-Type\" content=\"text/javascript\">^M\r\n<title></title>^M\r\n</head>^M\r\n<body bgcolor=\"#000000\">^M\r\n<form>^M\r\n<script language=\"JavaScript\">^M\r\n</script>^M\r\n<input type=\"hidden\" name=\"FileName\" value=\"\">^M\r\n</form>^M\r\n</body>^M\r\n</html>^M\r\n^@^@^@^@^M<94><81>¶^@^@<94>\\¾wÀF¼wÿÿÿÿ^@^@^@^@^@^@^@^@^@^@^@^V^@^@^M<94><!------------------------------------------------------------------------->^M\r\n<!-- Kyocera Command Center                                              -->^M\r\n<!-- for Project code 2GR                                                -->^M\r\n<!--                                                                     -->^M\r\n<!-- Copyright (C) 2005 KYOCERA MITA Corporation                         -->^M\r\n<!------------------------------------------------------------------------->^M\r\n<!-- File Name : index.htm                                               -->^M\r\n```\r\n\r\nFirst there is a listing of files and directories\r\n(I found this list of directories in the http server config file:\r\n```\r\n/start/\r\n/basic/\r\n/printer/\r\n/scanner/\r\n/job/\r\n/box/\r\n/adv/\r\n/deu/index.htm\r\n/dut/index.htm\r\n/eng/index.htm\r\n/esp/index.htm\r\n/fra/index.htm\r\n/ita/index.htm\r\n/jpn/index.htm\r\n/rus/index.htm\r\n/opt1/index.htm\r\n/fax/\r\n/mail/\r\n/top.htm\r\n/index.htm\r\n/eventlog\r\n```\r\n\r\nAfter that index table, the file data of the listed files (version.htm, top.htm, index.htm) seem to follow."},"comment":{"url":"https://api.github.com/repos/devttys0/binwalk/issues/comments/169092351","html_url":"https://github.com/devttys0/binwalk/issues/178#issuecomment-169092351","issue_url":"https://api.github.com/repos/devttys0/binwalk/issues/178","id":169092351,"user":{"login":"devttys0","id":5703146,"avatar_url":"https://avatars.githubusercontent.com/u/5703146?v=3","gravatar_id":"","url":"https://api.github.com/users/devttys0","html_url":"https://github.com/devttys0","followers_url":"https://api.github.com/users/devttys0/followers","following_url":"https://api.github.com/users/devttys0/following{/other_user}","gists_url":"https://api.github.com/users/devttys0/gists{/gist_id}","starred_url":"https://api.github.com/users/devttys0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devttys0/subscriptions","organizations_url":"https://api.github.com/users/devttys0/orgs","repos_url":"https://api.github.com/users/devttys0/repos","events_url":"https://api.github.com/users/devttys0/events{/privacy}","received_events_url":"https://api.github.com/users/devttys0/received_events","type":"User","site_admin":false},"created_at":"2016-01-05T18:39:48Z","updated_at":"2016-01-05T18:39:48Z","body":">I just installed python-backports-lzma...binwalk still shows the false positive lzma matches. Using python3 it doesn't. Maybe this is a bug that should be fixed.\r\n\r\nBinwalk expects the module to be named `lzma`, not `backports.lzma`. Most Linux distros have a `python-lzma` package for Python2; it is a standard module in Python3, which is why you don't get the LZMA false positives in Python3. I've updated the master branch to check for `backports.lzma`, so that should be fixed now.\r\n\r\n>a larger count of ELFs seems reasonable to me.\r\n\r\nWell, bear in mind when I say \"larger\" I mean there are 5 or 6 ELF files. Usually with VxWorks I've only seen one ELF file, which was for the decompression stub, so it was not part of the main VxWorks OS.\r\n\r\n> the symbol tables being intact is a positive find\r\n\r\nThe symbol tables for the ELF files are intact, but I didn't immediately see a symbol table for the main OS.\r\n\r\n>Regularly, there is no cli access to users.\r\n\r\nI did a very brief disassembly of some of the ELF files, and some have command line usage strings and `getopt` style strings in them, so they do take command line options. Could just be for developer debug access via a serial port or something though.\r\n\r\n>Is it quite certain that everything is baked into the kernel? It would be a bit easier to investigate separated files/modules if it was possible to extract a usable filesystem.\r\n\r\nIt would be a lot easier, but unfortunately that's usually how Real Time Operating Systems (like VxWorks) work: the OS is typically one big kernel running in a flat memory space (there is no user space or user applications). With that said, some RTOS's support user space protected code execution, but I'm not sure how that would work in VxWorks."}}