I was able to download Linksys E1200 router firmware, which I would like to reverse engineer. I believe it is running some sort of Linux/Unix based firmware and may be running on an ARM CPU. I have run binwalk against it but I'm not sure what to do next.This is the output I get:32            0x20            TRX firmware header, little endian, image size: 7684096 bytes, CRC32: 0xB533F216, flags: 0x0, version: 1, header size: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x14FF20, rootfs offset: 0x060            0x3C            gzip compressed data, maximum compression, has original file name: piggy, from Unix, last modified: 2016-07-13 03:17:531376064       0x14FF40        Squashfs filesystem, little endian, non-standard signature, version 3.0, size: 6307458 bytes, 1721 inodes, blocksize: 65536 bytes, created: 2016-07-13 03:23:19
Help reverse engineering Linksys E1200 router firmware
firmware
The next step is extraction of the kernel and squashfs filesystem using the -e option when using binwalk. These extracted files can then be further analyzed. Running binwalk with the -A option on the bootloader and kernel files will provide clues about the instruction set architecture of the firmware. Performing an entropy scan with -E can be done to gain insight into the structure of the extracted files and is useful for identifying compressed or encrypted regions. A variety of tools exist for the purpose of squashfs filesystem extraction, such as squashfs-tools and sasquatch. A good example of the methodology employed in firmware analysis can be found here: Reverse Engineering Firmware: Linksys WAG120NUpdate after firmware download link was made available:To ensure that binwalk can properly extract SquashFS filesystem images, follow these steps:Install squashfs-tools:sudo apt-get install squashfs-toolsIn ~, clone sasquatch from github:git clone https://github.com/devttys0/sasquatch.gitIn ~/sasquatch, execute build.sh (check README.md to make sure all the dependencies are installed)Also check the version of binwalk installed locally:$ binwalkBinwalk v2.1.2bCraig Heffner, http://www.binwalk.orgExtractionCompute md5sum of firmware binary:$ md5sum FW_E1200v2.0.7.005_US_20160713_code.bin eb3752a5b72ccb0c9a92079fab88663e  FW_E1200v2.0.7.005_US_20160713_code.binRun binwalk signature scan to confirm output:$ binwalk FW_E1200v2.0.7.005_US_20160713_code.bin DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------32            0x20            TRX firmware header, little endian, image size: 7684096 bytes, CRC32: 0xB533F216, flags: 0x0, version: 1, header size: 28 bytes, loader offset: 0x1C, linux kernel offset: 0x14FF20, rootfs offset: 0x060            0x3C            gzip compressed data, maximum compression, has original file name: piggy, from Unix, last modified: 2016-07-13 03:17:531376064       0x14FF40        Squashfs filesystem, little endian, non-standard signature, version 3.0, size: 6307458 bytes, 1721 inodes, blocksize: 65536 bytes, created: 2016-07-13 03:23:19Output appears to match output in the original post.Extraction:$ binwalk -e FW_E1200v2.0.7.005_US_20160713_code.bin Files are extracted to directory _FW_E1200v2.0.7.005_US_20160713_code.bin.extracted/:$ file *14FF40.squashfs: datapiggy:           FoxPro FPT, blocks size 0, next free block index 15993608squashfs-root:   directory Inside squashfs-root is the extracted filesystem:$ ll squashfs-root/total 88drwxrwxrwx 13 user01 user01  4096 Jul 12  2016 ./drwxr-xr-x  3 user01 user01  4096 Jun 26 15:16 ../drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 bin/drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 dev/drwxrwxrwx  4 user01 user01  4096 Jul 12  2016 etc/drwxr-xr-x  3 user01 user01  4096 Jul 12  2016 lib/drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 mnt/drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 proc/drwxr-xr-x  2 user01 user01 12288 Jul 12  2016 sbin/drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 sys/drwxr-xr-x  2 user01 user01  4096 Jul 12  2016 tmp/drwxrwxrwx  6 user01 user01  4096 Jul 12  2016 usr/lrwxrwxrwx  1 user01 user01     7 Jun 26 15:16 var -> tmp/vardrwxr-xr-x 32 user01 user01 28672 Jul 12  2016 www/piggyRunning file against piggy produces a false positive:piggy:           FoxPro FPT, blocks size 0, next free block index 15993608Running binwalk against piggy suggests that it contains Linux kernel code:$ binwalk piggy DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------2617344       0x27F000        Linux kernel version 2.6.22 (zhang@sw3) (gcc version 4.2.3) #5 Tue Jun 7 18:33:13 HKT 20162641040       0x284C90        CRC32 polynomial table, little endian2656556       0x28892C        CRC32 polynomial table, little endian2852300       0x2B85CC        Unix path: /usr/gnemul/riscos/2854956       0x2B902C        Unix path: /usr/lib/libc.so.12927975       0x2CAD67        Neighborly text, NeighborSolicitsts2927999       0x2CAD7F        Neighborly text, NeighborAdvertisementsmp6OutDestUnreachs2928200       0x2CAE48        Neighborly text, NeighborSolicitsirects2928228       0x2CAE64        Neighborly text, NeighborAdvertisementssponses2930275       0x2CB663        Neighborly text, neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)An entropy plot produced by binwalk -EJ piggy reveals a large contiguous area with an entropy of roughly .68: This level of entropy is consistent with what is expected of regions containing object code.We can make an educated guess about what the instruction set architecture of the binary is by running binwalk with the -A argument:DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------1788          0x6FC           MIPSEL instructions, function epilogue2636          0xA4C           MIPSEL instructions, function epilogue4540          0x11BC          MIPSEL instructions, function epilogue4932          0x1344          MIPSEL instructions, function epilogue6092          0x17CC          MIPSEL instructions, function epilogue6476          0x194C          MIPSEL instructions, function epilogue6952          0x1B28          MIPSEL instructions, function epilogue7040          0x1B80          MIPSEL instructions, function epilogue8024          0x1F58          MIPSEL instructions, function epilogue8392          0x20C8          MIPSEL instructions, function epilogue9532          0x253C          MIPSEL instructions, function epilogue9840          0x2670          MIPSEL instructions, function epilogue12552         0x3108          MIPSEL instructions, function epilogue12682         0x318A          MIPS instructions, function epilogue12836         0x3224          MIPSEL instructions, function epilogue13364         0x3434          MIPSEL instructions, function epilogueThe ISA is likely MIPS little-endian.