D-Link TLV file carver

src/extractors.rs

@@ -148,6 +148,7 @@ pub mod cab;
 pub mod common;
 pub mod csman;
 pub mod dahua_zip;
+pub mod dlink_tlv;
 pub mod dmg;
 pub mod dtb;
 pub mod dumpifs;

src/extractors/dlink_tlv.rs

@@ -0,0 +1,66 @@
+use crate::extractors::common::{Chroot, ExtractionResult, Extractor, ExtractorType};
+use crate::structures::dlink_tlv::parse_dlink_tlv_header;
+
+/// Defines the internal extractor function for carving out D-Link TLV firmware images
+///
+/// ```
+/// use std::io::ErrorKind;
+/// use std::process::Command;
+/// use binwalk::extractors::common::ExtractorType;
+/// use binwalk::extractors::dlink_tlv::dlink_tlv_extractor;
+///
+/// match dlink_tlv_extractor().utility {
+///     ExtractorType::None => panic!("Invalid extractor type of None"),
+///     ExtractorType::Internal(func) => println!("Internal extractor OK: {:?}", func),
+///     ExtractorType::External(cmd) => {
+///         if let Err(e) = Command::new(&cmd).output() {
+///             if e.kind() == ErrorKind::NotFound {
+///                 panic!("External extractor '{}' not found", cmd);
+///             } else {
+///                 panic!("Failed to execute external extractor '{}': {}", cmd, e);
+///             }
+///         }
+///     }
+/// }
+/// ```
+pub fn dlink_tlv_extractor() -> Extractor {
+    Extractor {
+        utility: ExtractorType::Internal(extract_dlink_tlv_image),
+        ..Default::default()
+    }
+}
+
+/// Internal extractor for carve pieces of D-Link TLV images to disk
+pub fn extract_dlink_tlv_image(
+    file_data: &[u8],
+    offset: usize,
+    output_directory: Option<&String>,
+) -> ExtractionResult {
+    const OUTPUT_FILE_NAME: &str = "image.bin";
+
+    let mut result = ExtractionResult {
+        ..Default::default()
+    };
+
+    // Get the D-Link TLV image data
+    if let Some(tlv_data) = file_data.get(offset..) {
+        // Parse the TLV header
+        if let Ok(tlv_header) = parse_dlink_tlv_header(tlv_data) {
+            result.success = true;
+            result.size = Some(tlv_header.header_size + tlv_header.data_size);
+
+            // If extraction was requested, do it
+            if output_directory.is_some() {
+                let chroot = Chroot::new(output_directory);
+                result.success = chroot.carve_file(
+                    OUTPUT_FILE_NAME,
+                    tlv_data,
+                    tlv_header.header_size,
+                    tlv_header.data_size,
+                );
+            }
+        }
+    }
+
+    result
+}

src/magic.rs

@@ -996,7 +996,7 @@ pub fn patterns() -> Vec<signatures::common::Signature> {
             magic: signatures::dlink_tlv::dlink_tlv_magic(),
             parser: signatures::dlink_tlv::dlink_tlv_parser,
             description: signatures::dlink_tlv::DESCRIPTION.to_string(),
-            extractor: None,
+            extractor: Some(extractors::dlink_tlv::dlink_tlv_extractor()),
         },
     ];
 

src/signatures/dlink_tlv.rs

@@ -1,4 +1,5 @@
 use crate::signatures::common::{SignatureError, SignatureResult, CONFIDENCE_HIGH};
+use crate::signatures::openssl::openssl_crypt_parser;
 use crate::structures::dlink_tlv::parse_dlink_tlv_header;
 
 /// Human readable description
@@ -37,7 +38,7 @@ pub fn dlink_tlv_parser(
 
             // Make sure the MD5 hashes match
             if payload_md5 == tlv_header.data_checksum {
-                result.size = tlv_header.header_size;
+                result.size = tlv_header.header_size + tlv_header.data_size;
                 result.description = format!(
                     "{}, model name: {}, board ID: {}, header size: {} bytes, data size: {} bytes",
                     result.description,
@@ -46,6 +47,15 @@ pub fn dlink_tlv_parser(
                     tlv_header.header_size,
                     tlv_header.data_size,
                 );
+
+                // Check if the firmware data is OpenSSL encrypted
+                if let Some(crypt_data) = file_data.get(offset + tlv_header.header_size..) {
+                    if let Ok(openssl_signature) = openssl_crypt_parser(crypt_data, 0) {
+                        result.description =
+                            format!("{}, {}", result.description, openssl_signature.description);
+                    }
+                }
+
                 return Ok(result);
             }
         }