X-POST FROM unix.stackexchange.comI'm currently trying to make modifications to a router firmware: Swisscom Centro Grande - aka Pirelli Vx226N1, firmware version: 60200.I've decompiled it successfully with FMK v0.99 and got the header.img, the rootfs.img and the footer.img image parts.This is the binwalk of rootfs.img:Squashfs filesystem, little endian, non-standard signature,  version 4.0, compression:gzip, size: 2764423 bytes,  1145 inodes, blocksize: 65536 bytes, created: Fri Mar 15 00:33:08 2013I decompiled the rootfs.img with unsquashfs succesfully and got the system folders. I made some changes (enabled a shell on telnet) and tried to repack everything with the tools provided (the ./build-firmware.sh command).The final firmware size was bigger than the original one.Tried to falsh, nothing happened.I analyzed the firmware and especially the upgrade method to learn how to properly build the firmware.I found the update.sh file which handles the upgrade process (analyzes the file provided by the user and flashes only if everything is correct, in order to prevent brick)Here is the link to the pastebin of that fileI'm pretty sure that the original firmware files are parsed through the parse_yaps_image() function, so I tried adapting on my own to check the files but I noticed that there was an external check with a binary file called sig_verifyIf the files doesn't exists another function is invoked, the problem is that the function provided isn't correct (it return a wrong validation token error even with original firmwares!)My goal is to analyze the sig_verify file and look for the algorithm, in order to understand the composition method and in order to flash my router in the proper way and finally get the root shell (and make modification on everything I want)I uploaded all files on a Mega folder so the interesed guys who wanna help me could access any file needed.I included in the folder 60208 the two scripts I used to check the files.The result of the script I wrote (it's just the adaptation of the script in the router) is this:denys@denys-pc:~/Documents/router/Vx226N1/images/modified/60208$ ./check_upgrade_yaps.sh Parsing YAPS format...16+0 records in16+0 records out16 bytes (16 B) copied, 0.000843843 s, 19.0 kB/sError: wrong validation token (5b445d3b251d59753031c9d7a94ba4ab, 7d98668859855f1b9459256257fc3262)And here is the binwalk of sig_verify file.denys@denys-pc:~/Documents/router/Vx226N1/images/modified/60208$ binwalk sig_verify DECIMAL     HEX         DESCRIPTION-------------------------------------------------------------------------------------------------------0           0x0         ELF 32-bit MSB executable, MIPS, version 11921        0x781       LZMA compressed data, properties: 0x01, dictionary size: 16777216 bytes, uncompressed size: 16777472 bytesAs you can notice it's a MIPS executable.I tried to run it under a MIPS envirronment (virtual machine, qemu-system-mips) without any success.qemu-system-mips -M mips -kernel ./vmlinux-2.6.18-6-qemu -initrd ./initrd.gz -hda hda.img -append root=/dev/ram console=ttyS0 -nographicThe kernel and the initrd were downloaded by http://archive.debian.org/debian/dists/etch/main/installer-mips/current/images/qemu/netboot/Any help would be appreciated. If someting isn't clear just let me know :)--- EDIT ---Decompiled...Anyone that could translate machine language into human-comprehensible code?
Router firmware modification and MIPS executable under x86_64 Ubuntu [X-POST from unix.stackexchange.com]
binary analysis;firmware;mips