Another approach with a different firmware this time, I choose netgear’s DG834PN wireless dsl routers’ firmware. The firmware, DG834PN_V1.03.39.img can be found at netgear’s website for download.
Starting as before, I used binwalk to identify the sections on the image.
Many lzma headers one squashfs and some bzip2 compressed data. The squashfs partition should be the filesystem located on the router, the lzma data should contain the loader, so how about the bzip2 compressed data…
Starting ( wrong as proven later ) from the bzip2 headers, I thought of extracting the last part to check on the data.
running “file” command on the extracted contents the command responds identifying the data as proper bzip2 compressed file.
but this is not correct,
“file” command will identify any file containing “BZh.” header in the start as bzip2 compressed document, an example below will demonstrate it. A text file with the name false_bz is created and the “file” command identifies it as bzip2 compressed data.
So this is definitely not the way to go. The sections are not properly identified.
Back to the start then, hexdump and strings commands will be proven again valuable and I believe that’s the proper way to start always.
From the hexdump we can see the loader that is used for the image,
string CFE1CFE1 is a clear mark of CFE loader ( http://melbourne.wireless.org.au/files/wrt54/cfe.pdf )
Going straight now for the filesystem I needed tools to work with squashfs, first choice was the firmware mod kit, ( http://www.bitsum.com/firmware_mod_kit.htm ) that contains many different filesystem decoders like cramfs, various versions of squashfs and others. Later through the tests I found more useful the unsquashfs provided by the squashfs-tools on debian/ubuntu systems.
Extracting the squashfs system and after identifying it properly with unsquashfs I was able to mount the extracted filesystem and browse the files.
and finally the extracted filesystem,