
cbus Documentation, Release 0.1-dev
– cftp_daemon will not be able to copy a new project file into RAM temporarily for flashing, and may be perma-
nently stuck in this state. This partial brick state could probably gotten around by writing NULL over the contents of
/dev/mtdblock/6, then transferring a new project file.
4.5 Firmware image
Firmware image for the device is bundled with the PICED software as Firmware/firmware_1_24_0.img. The
tool binwalk shows the layout of the firmware image:
0x13 uImage header, header size: 64 bytes, header CRC: 0x2781C02C,
created: Mon Oct 3 11:26:33 2011, image size: 722439 bytes,
Data Address: 0x40008000, Entry Point: 0x40008000,
data CRC: 0xF7547123, OS: Linux, CPU: ARM,
image type: OS Kernel Image, compression type: lzma,
image name: Linux-2.6.17
0x53 LZMA compressed data, properties: 0x5D,
dictionary size: 8388608 bytes, uncompressed size: 2015280 bytes
0xC0013 Squashfs filesystem, little endian, version 2.1,
size: 1736392 bytes, 435 inodes, blocksize: 65536 bytes,
created: Mon Oct 3 11:27:23 2011
Appears to be a uBoot image with some extra headers on the image.
4.5.1 Extracting root filesystem
The version of squashfs used by the root filesystem is very old, and current Linux kernels are incapable of mounting
it. It requires an LZMA version of squashfs-2.1 in order to extract it, available from firmware-mod-kit. Their SVN
repository contains all the components needed:
$ svn co https://firmware-mod-kit.googlecode.com/svn/trunk/src/lzma/
$ svn co https://firmware-mod-kit.googlecode.com/svn/trunk/src/squashfs-2.1-r2/
$ cd squashfs-2.1-r2
$ make
Once built, extract the root filesystem with:
$ binwalk -D squashfs:squashfs firmware_1_24_0.img
$ ./squashfs-2.1-r2/unsquashfs-lzma C0013.squashfs
This will then give an extracted copy of the root filesystem in the directory squashfs-root.
4.5.2 Filesystem observations
These are things that need some more investigation:
• NTP client which has 32 hard-coded NTP server IP addresses.
4.5. Firmware image 19
Comentários a estes Manuais