小米路由固件解包打包
来自Jack's Lab
(版本间的差异)
(→解包) |
(→解包) |
||
第54行: | 第54行: | ||
33957053 0x20624BD TRX firmware header, little endian, header size: 28 bytes, image size: 7761920 bytes, CRC32: 0x2FC538ED flags: 0x0, version: 1 | 33957053 0x20624BD TRX firmware header, little endian, header size: 28 bytes, image size: 7761920 bytes, CRC32: 0x2FC538ED flags: 0x0, version: 1 | ||
33957081 0x20624D9 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 4456704 bytes | 33957081 0x20624D9 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 4456704 bytes | ||
− | 35814013 0x2227A7D Squashfs filesystem, little endian, version 4.0, compression:lzma (non-standard type definition), size: 5902826 bytes, | + | 35814013 0x2227A7D Squashfs filesystem, little endian, version 4.0, compression:lzma (non-standard type definition), size: 5902826 bytes, |
+ | 1332 inodes, blocksize: 262144 bytes, created: Sat May 31 15:55:18 2014 | ||
41718973 0x27C94BD TRX firmware header, little endian, header size: 28 bytes, image size: 2859008 bytes, CRC32: 0x7EF15BCF flags: 0x0, version: 1 | 41718973 0x27C94BD TRX firmware header, little endian, header size: 28 bytes, image size: 2859008 bytes, CRC32: 0x7EF15BCF flags: 0x0, version: 1 | ||
41719001 0x27C94D9 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 5439744 bytes | 41719001 0x27C94D9 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 5439744 bytes |
2014年6月4日 (三) 21:10的版本
1 工具
小米自己改了个打包解包固件的工具,基于 trx 改的,加了 RSA 验证和解包功能,路由系统里自带:
root@XiaoQiang:/userdisk/rom/0.2.62$ mkxqimage -h mkxqimage: invalid option -- h Usage: mkxqimg [-o outfile] [-p private_key] [-f file] [-f file [-f file [-f file ]]] -----> 打包 [-x file] -----> 解包
mkxqimage 解包打包时都会去读这个文件: /usr/share/xiaoqiang/public.pem ,是一个RSA公钥文件
没有会报:
root@XiaoQiang:/userdisk/rom/0.2.62$ mv /usr/share/xiaoqiang/public.pem / root@XiaoQiang:/userdisk/rom/0.2.62$ mkxqimage -x ../brcm4709_hdk_0.2.62.bin error fopen public key Image verify failed, not formal image
打包时会把校验后的码写在文件尾部,检验失败会报:
root@XiaoQiang:/userdisk/rom/0.2.62$ mkxqimage -x ../brcm4709_hdk_0.2.62.bin error PEM_read_RSAPublicKey Image verify failed, not formal image
2 解包
解包成功则:
root@XiaoQiang:/userdisk/rom/0.2.62$ mkxqimage -x ../brcm4709_hdk_0.2.62.bin -rw-r--r-- 1 root root 37199873 Nov 28 01:21 root.ext4.lzma -rw-r--r-- 1 root root 2813952 Nov 28 01:21 vmlinuz.trx
另外使用 binwalk 工具也可解开:
$ binwalk -e ../brcm4709_all_0de4_0.5.56.bin DECIMAL HEX DESCRIPTION ------------------------------------------------------------------------------------------------------------------- 0 0x0 TRX firmware header, little endian, header size: 28 bytes, image size: 44577981 bytes, CRC32: 0x563BB3C0 flags: 0x3, version: 2 32 0x20 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 134217728 bytes 33957053 0x20624BD TRX firmware header, little endian, header size: 28 bytes, image size: 7761920 bytes, CRC32: 0x2FC538ED flags: 0x0, version: 1 33957081 0x20624D9 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 4456704 bytes 35814013 0x2227A7D Squashfs filesystem, little endian, version 4.0, compression:lzma (non-standard type definition), size: 5902826 bytes, 1332 inodes, blocksize: 262144 bytes, created: Sat May 31 15:55:18 2014 41718973 0x27C94BD TRX firmware header, little endian, header size: 28 bytes, image size: 2859008 bytes, CRC32: 0x7EF15BCF flags: 0x0, version: 1 41719001 0x27C94D9 LZMA compressed data, properties: 0x5D, dictionary size: 65536 bytes, uncompressed size: 5439744 bytes $ ls _brcm4709_all_0de4_0.5.56.bin.extracted $ ls _brcm4709_all_0de4_0.5.56.bin.extracted/ 20 20624D9 20624D9.7z 20.7z 2227A7D.squashfs 27C94D9 27C94D9.7z squashfs-root comcat@Pek-JJJ-d1:/work/openwrt/xiaomi/rom/0.5.56$ ls _brcm4709_all_0de4_0.5.56.bin.extracted/squashfs-root/ bin data dev etc lib mnt opt overlay proc rom root sbin sys tmp usr var www