I'm trying to analysis router firmware.
I desoldering chip from router. chip name is F59L1g81la
And i erase ecc data from the extracted firmware and using binwalk to extract filesystem. It worked but can't extract file system. output is just empty folder.
So trying to extract squashfs file system using dd command and after that using unsquashfs tools. -> squashfs-tools/unsquashfs(https://github.com/plougher/squashfs-tools) but Can't extract squashfs file system.
The error address is in directory_table. using unsquashfs can't extract data file. e.g. binary file, etc, ...
but if i extract zlib data in directory_table, i can uncompress zlib compressed data.
i don't know why.
So, first i tried to get squashfs file system using unsquashfs tools. version 4.6.1
└─[0] <> unsquashfs -v
unsquashfs version 4.6.1 (2023/03/25)
copyright (C) 2023 Phillip Lougher <[email protected]>
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License
as published by the Free Software Foundation; either version 2,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
File name is 4300000.squashfs and attached more information.
└─[0] <> ls
1000000.squashfs 2990 4300000.squashfs
└─[0] <> unsquashfs 4300000.squashfs
gzip uncompress failed with error code -3
read_block: failed to read block @0x4745e8
get_metadata: failed to read block
Parallel unsquashfs: Using 8 processors
0 inodes (0 blocks) to write
gzip uncompress failed with error code -3
read_block: failed to read block @0x4745e8
get_metadata: failed to read block
FATAL ERROR: dir_scan: failed to read directory squashfs-root
└─[1] <> unsquashfs -s 4300000.squashfs
Found a valid SQUASHFS 4:0 superblock on 4300000.squashfs.
Creation or last append time Sat Apr 23 14:58:24 2039
Filesystem size 4676747 bytes (4567.14 Kbytes / 4.46 Mbytes)
Compression gzip
Block size 131072
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Uids/Gids (Id table) are compressed
Fragments are compressed
Always-use-fragments option is specified
Xattrs are compressed
Duplicates are removed
Number of fragments 54
Number of inodes 880
Number of ids 3
Number of xattr ids 0
and i extract zlib data.
└─[0] <> ls
1000000.squashfs 2990 4300000.squashfs extract_error_data.zlib
└─[0] <> file extract_error_data.zlib
extract_error_data.zlib: zlib compressed data
└─[0] <> zlib-flate -uncompress < extract_error_data.zlib > extract_error_data.zlib.output
└─[0] <> ls -l extract_error_data.zlib.output
-rw-r--r-- 1 rasser staff 4806 Feb 13 17:50 extract_error_data.zlib.output
And this is uncompressed data
So, i don't know why... using unsquashfs tool -> can't extract data. but extract just zlib compressed data = can extract data and uncompress. any solutions?