Motorola vt2x42 firmware extraction

[peeps]

I have a few vt2442's laying around that my old job was getting rid of.  I would like to modify the firmware that is on it.  I have not been able to extract the firmware as of yet, and this kit seems to come the closest to getting the job done.  Can anyone assist?  Thanks in advance.

Code Select Expand

./src/binwalk -v -m src/binwalk-0.4.1/src/magic.binwalk vt2442-11.4.1-r070201-1.3.2-r1-xp1.img

Scan Time:    Jan 06, 2012 @ 14:47:56
Magic File:   src/binwalk-0.4.1/src/magic.binwalk
Signatures:   75
Target File:  vt2442-11.4.1-r070201-1.3.2-r1-xp1.img
MD5 Checksum: c5200d4205f7b4c1eee8e7ce9b8d95c4

DECIMAL         HEX             DESCRIPTION
-------------------------------------------------------------------------------------------------------
35408           0x8A50          7-zip archive data, version 48.50
524288          0x80000         Squashfs filesystem, little endian, version 1.0, size: 3294864 bytes, 687 inodes, blocksize: 32768 bytes, created: Sat May 28 20:54:20 2011


[Jeremy Collake]

Please try posting such things on the Google Code project for Firmware Modification Kit (Firmware Mod Kit)

[peeps]

I have posted it in the issues (number 50).  I will keep trying to work on patching squashfs 4.2 with LZMA support, and let you you know if i make any progress.

[peeps]

I have made a little progress.   After using the old script (from the kit) to split apart the vmlinux image and the squashfs image. I was able to get squash-tools 4.2 to read the superblock.

Code Select Expand

./unsquashfs -s squashfs-lzma-image-x_x
Found a valid little endian SQUASHFS 1:0 superblock on squashfs-lzma-image-x_x.
Creation or last append time Sat May 28 20:54:20 2011
Filesystem size 3217.64 Kbytes (3.14 Mbytes)
Block size 32768
Filesystem is not exportable via NFS
Inodes are compressed
Data is compressed
Check data is not present in the filesystem
Duplicates are removed
Number of inodes 687
Number of uids 1
Number of gids 0


In looking though the though the source code for unsquashfs, with the little bit of C that I know, I found that the decompresser for for superblock versions 1-3 is hard-coded to "gzip".  So i changed it to "lzma" (line 1573 in unsquashfs.c).  Unfortunately, this did not work, but I did see an change in the error code I was getting. 

When unsquashfs was using gzip to decompress the image, I was getting error -3 (defined as Z_DATA_ERROR in zlib.h, line 178)

Code Select Expand


./unsquashfs squashfs-lzma-image-x_x
Parallel unsquashfs: Using 8 processors
gzip uncompress failed with error code -3
read_block: failed to read block @0x3219a1
FATAL ERROR aborting: uncompress_inode_table: failed to read block


With lzma I get error 1 (defined as SZ_ERROR_DATA in the LZMA SDK Types.h file, line 15)

Code Select Expand


./unsquashfs squashfs-lzma-image-x_x
Parallel unsquashfs: Using 8 processors
lzma uncompress failed with error code 1
read_block: failed to read block @0x3219a1
FATAL ERROR aborting: uncompress_inode_table: failed to read block


I hope this helps. 

[Jeremy Collake]

Responded on issue 50 at Google Code's FMK repo ... as we must keep the discussion in one place. I could speculate as to the cause, but I will refrain at this time.