Grabbing the root filesystem image from the Cab.Link CLS-D4E2WX1 / 2023-01-29

I wanted to grab the root filesystem image from the flash memory of the Cab.Link CLS-D4E2WX1 cable modem/router. The way to do this was the same as with Grabbing the firmware from the Corinex CXWC-HD200-WNeH and extracting the root filesystem although I decided to just dump the root filesystem image and not the entire flash memory.

So the box was opened again, the usb serial interface connected to the uart pins on Cab.Link CLS-D4E2WX1 I found earlier and the boot stopped in the U-Boot process.

First step was to determine where in the memory map the root filesystem image would be. This took a bit of calculation. From the bootup messages there are two important hints:

7 cmdlinepart partitions found on MTD device ar7240-nor0
Creating 7 MTD partitions on "ar7240-nor0":
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000050000 : "u-boot-env"
0x000000050000-0x000000670000 : "rootfs"
0x000000670000-0x0000007d0000 : "uImage"
0x0000007d0000-0x0000007e0000 : "SYSLOG"
0x0000007e0000-0x0000007f0000 : "NVRAM"
0x0000007f0000-0x000000800000 : "ART"

## Booting image at 9f670000 ...

So the kernel image is booted from address 0x9f670000 and it's in the MTD partition at 0x000000670000. This makes the guess that the rootfs image from 0x000000050000 will live at memory location 0x9f050000 and has a size of 0x620000 so the approach is to dump 0x620000 bytes starting at that memory location. The command to do that in U-Boot:

ar7240> md.b 0x9f050000 0x620000
9f050000: 68 73 71 73 04 03 00 00 07 25 98 52 00 00 02 00    hsqs.....%.R....
9f050010: 27 00 00 00 02 00 11 00 c0 00 01 00 04 00 00 00    '...............

This capture of data at 115200 bps took more than 20 minutes. But I have patience enough.... Ok, I went to do something else.

Converting the ascii dump to a binary file was done with gmbnomis/uboot-mdb-dump on GitHub. Commands:

$ uboot-mdb-dump/uboot_mdb_to_image.py < rootfs.cap > rootfs.bin

And this is indeed a squashfs image:

$ file rootfs.bin
rootfs.bin: Squashfs filesystem, little endian, version 1024.0, compressed, 2265649262148714496 bytes, 67305472 inodes, blocksize: 512 bytes, created: Fri Oct 19 18:45:38 1973
$ unsquashfs rootfs.bin
Parallel unsquashfs: Using 4 processors
715 inodes (764 blocks) to write

[===============================================================|] 764/764 100%

created 518 files
created 57 directories
created 197 symlinks
created 0 devices
created 0 fifos

And now I have 518 files to look deeper into.