OpenWrt Forum Archive

Topic: New Official Linksys 4.00.7(G) 4.50.6(GS) Firmware GPL

The content of this topic has been archived on 13 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

For those who find these things interesting...

The firmware looks like it's compressed. Using some other details I found on the web, I uncompressed part of the bin using instructions from http://www.faqs.org/docs/Linux-HOWTO/Li … HOWTO.html. (see step 6)

dd if=firmware.bin bs=60 skip=1 | zcat > comp.img

Unfortunately, I hit a wall from there.. The kernel on my debian box doesn't have cramfs installed. Using strings, however, I saw many references to squashfs - perhaps Linksys has switched?

If anyone makes further progress mounting this, please let me know. I'm interested to see what's hidden that wasn't included in the source.

The following command will give you the embedded squashfs:

dd if=WRT54GV3.1_4.00.7_US_code.bin of=squash skip=1 bs=686068

I was able to mount it with

mount -t squashfs -o loop squash ost/

OK, I extracted the firmware using those commands.  Now tell me, how the heck did you find the beginning marker for the squashfs partition?  Please, tell me everything, because I can only assume you're looking for a particular hex string.  Using hexdump is no good, because it wraps the lines and you can never guarantee you'll get the string of hex characters you're looking for in one chunk.

Thanks,

Kaldek

Ah right.  So if I had half a brain and realised that these markers are referred to as "magic" markers I would have gone to google and found it hours ago.   Sheesh, 11 years in the biz (not development) and entire areas of fact slip you by...

Anyway, does anyoneknow of a hex searching tool like hexdump, that can search an entire file for a particular series of characters, and *then* format the output (as opposed to dumping the file, formatting it, then using grep to find te magic marker - which causes the problem I mentioned in my previous post).  I actually managed to find "hsqs" in this particular firmware image using hexdump, because it was thankfully in the middle of a line when dumped to ascii format.

Kaldek

(Last edited by kaldek on 5 Jul 2005, 05:02)

The discussion might have continued from here.