2023-01-29
Grabbing the root filesystem image from the Cab.Link CLS-D4E2WX1
I wanted to grab the root filesystem image from the flash memory of the Cab.Link CLS-D4E2WX1 cable modem/router. The way to do this was the same as with Grabbing the firmware from the Corinex CXWC-HD200-WNeH and extracting the root filesystem although I decided to just dump the root filesystem image and not the entire flash memory. So the box was opened again, the usb serial interface connected to the uart pins on Cab.Link CLS-D4E2WX1 I found earlier and the boot stopped in the U-Boot process. First step was to determine where in the memory map the root filesystem image would be. This took a bit of calculation. From the bootup messages there are two important hints:7 cmdlinepart partitions found on MTD device ar7240-nor0 Creating 7 MTD partitions on "ar7240-nor0": 0x000000000000-0x000000040000 : "u-boot" 0x000000040000-0x000000050000 : "u-boot-env" 0x000000050000-0x000000670000 : "rootfs" 0x000000670000-0x0000007d0000 : "uImage" 0x0000007d0000-0x0000007e0000 : "SYSLOG" 0x0000007e0000-0x0000007f0000 : "NVRAM" 0x0000007f0000-0x000000800000 : "ART" ## Booting image at 9f670000 ...So the kernel image is booted from address 0x9f670000 and it's in the MTD partition at 0x000000670000. This makes the guess that the rootfs image from 0x000000050000 will live at memory location 0x9f050000 and has a size of 0x620000 so the approach is to dump 0x620000 bytes starting at that memory location. The command to do that in U-Boot:ar7240> md.b 0x9f050000 0x620000 9f050000: 68 73 71 73 04 03 00 00 07 25 98 52 00 00 02 00 hsqs.....%.R.... 9f050010: 27 00 00 00 02 00 11 00 c0 00 01 00 04 00 00 00 '...............This capture of data at 115200 bps took more than 20 minutes. But I have patience enough.... Ok, I went to do something else. Converting the ascii dump to a binary file was done with gmbnomis/uboot-mdb-dump on GitHub. Commands:$ uboot-mdb-dump/uboot_mdb_to_image.py < rootfs.cap > rootfs.binAnd this is indeed a squashfs image:$ file rootfs.bin rootfs.bin: Squashfs filesystem, little endian, version 1024.0, compressed, 2265649262148714496 bytes, 67305472 inodes, blocksize: 512 bytes, created: Fri Oct 19 18:45:38 1973 $ unsquashfs rootfs.bin Parallel unsquashfs: Using 4 processors 715 inodes (764 blocks) to write [===============================================================|] 764/764 100% created 518 files created 57 directories created 197 symlinks created 0 devices created 0 fifosAnd now I have 518 files to look deeper into.