diff --git a/src/binwalk/magic/filesystems b/src/binwalk/magic/filesystems index a9cd7dadc..6f36b84b6 100644 --- a/src/binwalk/magic/filesystems +++ b/src/binwalk/magic/filesystems @@ -570,14 +570,17 @@ # Not to be confused with an actual romfs image! # ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/DIR-600_fw_revC1_3-05B15__all_en_20120216.zip +# based on eCos romfs, but with lzma files compression 0x10 string ROMFS\x20v D-Link ROMFS filesystem, >0x17 string x version %s, >0 string !\x2EmoR >>0 string !Rom\x2E {invalid} unknown endianness >0 string \x2EmoR little endian, +>>4 lelong x %d entries, >>8 lelong x size: <= %d #>>8 lelong-0x20 x {jump:%d} >0 string Rom\x2E big endian, +>>4 belong x %d entries, >>8 belong x size: <= %d #>>8 belong-0x20 x {jump:%d} diff --git a/src/binwalk/magic/misc b/src/binwalk/magic/misc index f7cb9c606..dadb28b74 100644 --- a/src/binwalk/magic/misc +++ b/src/binwalk/magic/misc @@ -83,3 +83,10 @@ # Xilinx FPGA Bitstream # Ref: http://www.xilinx.com/support/answers/7891.html 0 ubequad 0xffffffffaa995566 Xilinx Virtex/Spartan FPGA bitstream dummy + sync word + +# D-Link MD5 hash based langpack (sealpac.slp used in embedded PHP i18n function) +0 belong 0x05ea19ac D-Link MD5 based langpack (sealpac), +>4 belong x %d translations, +>8 bequad !0 {invalid} non-zero header padding +>0x1f byte 0 +>>0x10 string x langcode: %s diff --git a/src/binwalk/plugins/dlromfsextract.py b/src/binwalk/plugins/dlromfsextract.py index 64ce9cc36..e65b6755c 100644 --- a/src/binwalk/plugins/dlromfsextract.py +++ b/src/binwalk/plugins/dlromfsextract.py @@ -11,6 +11,11 @@ class RomFSCommon(object): + def _read_next_halfword(self): + value = struct.unpack("%sH" % self.endianness, self.data[self.index:self.index + 2])[0] + self.index += 2 + return value + def _read_next_word(self): value = struct.unpack("%sL" % self.endianness, self.data[self.index:self.index + 4])[0] self.index += 4 @@ -48,7 +53,7 @@ class RomFSEntry(RomFSCommon): DIR_STRUCT_MASK = 0x00000001 DATA_MASK = 0x00000008 - COMPRESSED_MASK = 0x005B0000 + COMPRESSED_MASK = 0x005B0000 # wrong - probably some permissions def __init__(self, data, endianness="<"): self.data = data @@ -56,12 +61,13 @@ def __init__(self, data, endianness="<"): self.index = 0 self.type = self._read_next_word() - self.unknown2 = self._read_next_word() - self.unknown3 = self._read_next_word() + self.nlink = self._read_next_word() + self.user_id = self._read_next_halfword() + self.group_id = self._read_next_halfword() self.size = self._read_next_word() - self.unknown4 = self._read_next_word() + self.ctime = self._read_next_word() self.offset = self._read_next_word() - self.unknown5 = self._read_next_word() + self.size_decompressed = self._read_next_word() # 0 means no compression self.uid = self._read_next_uid() @@ -167,6 +173,9 @@ def _process_all_entries(self): entries[entry.uid].offset = entry.offset entries[entry.uid].size = entry.size entries[entry.uid].type = entry.type + entries[entry.uid].size_decompressed = entry.size_decompressed + entries[entry.uid].ctime = entry.ctime + entries[entry.uid].nlink = entry.nlink if entry.uid == 0: entries[entry.uid].name = os.path.sep @@ -200,7 +209,7 @@ def _process_all_entries(self): class DlinkROMFSExtractPlugin(binwalk.core.plugin.Plugin): ''' - Gzip extractor plugin. + D-link ROMFS extractor plugin. ''' MODULES = ['Signature'] BLOCK_SIZE = 10 * 1024