Update

- Korea: N151RT-V2.1.3_20150911.zip, F1-V2.2.0-20161029.zip
- VNPT vẫn còn cung cấp cho khách hàng router Totolink nhưng chưa có cập nhật gì mới.

Riêng Viettel đã bỏ Totolink nên An Phát cũng không còn hỗ trợ!

Code:

% binwalk TOTOLINK-F1-V2.0.0-B20150721.1711.web

DECIMAL       HEXADECIMAL     DESCRIPTION  
--------------------------------------------------------------------------------
16            0x10            bzip2 compressed data, block size = 900k  
268279        0x417F7         LZMA compressed data, properties: 0x88, dictionary size: 1048576 bytes, uncompressed size: 65535 bytes  
278058        0x43E2A         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3409580 bytes  
1264180       0x134A34        Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2079485 bytes, 570 inodes, blocksize: 131072 bytes, created: 1902-05-06 07:36:32  


• Từ 268279 (0x417F7) tới 278058 (0x43E2A) được nén lại bằng lzma
  
• Từ 278058 (0x43E2A) tới 1264180 (0x134A34) được nén lại bằng lzma
  
• Từ 1264180 (0x134A34) tới hết là file system định dạng Squashfs quá quen thuộc với các nền tảng nhúng.
  

Code:

$ dd if=TOTOLINK-F1-V2.0.0-B20150721.1711.web bs=1 of=fs1.lzma skip=268279 count=`python -c 'print 0x43E2A-0x417F7'`

$ dd if=TOTOLINK-F1-V2.0.0-B20150721.1711.web bs=1 of=fs2.lzma skip=278058 count=`python -c 'print 0x134A34-0x43E2A'`

$ dd if=TOTOLINK-F1-V2.0.0-B20150721.1711.web of=fs3.squashfs bs=1 skip=1264180


Code:

fs1.lzma:     data  
fs2.lzma:     LZMA compressed data, non-streamed, size 3409580  
fs3.squashfs: Squashfs filesystem, little endian, version 4.0, 2079485 bytes, 570 inodes, blocksize: 131072 bytes, created: Fri Jun 11 14:04:48 2038

$ ls -lh fs*
-rw-r--r-- 1 harry harry 9.6K Jun  9 10:38 fs1.lzma
-rw-r--r-- 1 harry harry 964K Jun  9 10:38 fs2.lzma
-rw-r--r-- 1 harry harry 2.0M Jun  9 10:35 fs3.squashfs


Code:

% tree -d _fs*
_fs1.lzma.extracted  
_fs2.lzma.extracted  
_fs3.squashfs.extracted  
└── squashfs-root
    ├── bin
    ├── dev
    │   ├── misc
    │   ├── pts
    │   └── voip
    ├── etc
    │   ├── boa
    │   ├── init.d
    │   ├── samba
    │   └── tmp
    ├── home
    ├── lib
    ├── mnt
    ├── proc
    ├── sys
    ├── tmp -> /var/tmp
    ├── usr
    │   └── share
    │       └── udhcpc
    └── var

21 directories

Code:

% binwalk  _fs2.lzma.extracted/0

DECIMAL       HEXADECIMAL     DESCRIPTION  
--------------------------------------------------------------------------------
3002400       0x2DD020        Linux kernel version "2.6.30.9 (acer1@localhost.localdomain) (gcc version 4.4.5-1.5.5p2 (GCC) ) #1073 Tue Jul 21 17:18:43 CST 2015"  
3134292       0x2FD354        Neighborly text, "NeighborSolicits0"  
3134312       0x2FD368        Neighborly text, "NeighborAdvertisements"  
3137399       0x2FDF77        HTML document header  
3137562       0x2FE01A        HTML document footer  
3179017       0x308209        Certificate in DER format (x509 v3), header length: 4, sequence length: 2176  
3179053       0x30822D        Certificate in DER format (x509 v3), header length: 4, sequence length: 11392  
3179065       0x308239        Certificate in DER format (x509 v3), header length: 4, sequence length: 14464  
3179069       0x30823D        Certificate in DER format (x509 v3), header length: 4, sequence length: 14464  
3179073       0x308241        Certificate in DER format (x509 v3), header length: 4, sequence length: 16512  


Code:

$ cd _fs3.squashfs.extracted/squashfs-root

$ tree -f .|egrep "flash|samba|host|start|app|pass|admin"
│   ├── ./bin/chpasswd -> busybox
│   ├── ./bin/flash
│   ├── ./bin/hostname -> busybox
│   ├── ./bin/iapp
│   ├── ./bin/startup.sh
│   ├── ./bin/wlanapp.sh
│   ├── ./etc/dropbear_rsa_host_key
│   ├── ./etc/host.conf
│   ├── ./etc/hosts -> /var/hosts
│   ├── ./etc/hosts.org
│   ├── ./etc/passwd -> /var/passwd
│   ├── ./etc/passwd.org
│   ├── ./etc/samba
│   │   ├── ./etc/samba/smb.conf
│   │   └── ./etc/samba/smbpasswd


Code:

% cat ./etc/passwd.org
root:zhxPr1e7Npazg:0:0:root:/:/bin/sh  
onlime_r:$1$01OyWDBw$Hrxb2t.LtmiiJD49OBsCU/:0:0:root:/:/bin/sh  
nobody:x:0:0:nobody:/:/dev/null  


Code:

$1$01OyWDBw$Hrxb2t.LtmiiJD49OBsCU/12345

Code:

% cat ./etc/samba/smbpasswd
samba:500:E37D9D1B60CE6031F4EE5CAB3C10B45B:246D949F60611CFA928A476B3FF28B25:[U          ]:LCT-43D6003C:  

% cat ./bin/startup.sh

Code:

% file bin/busybox
bin/busybox: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), dynamically linked (uses shared libs), with unknown capability 0x41000000 = 0xf676e75, with unknown capability 0x10000 = 0x70403, stripped  


Code:

$ sudo apt-get install binutils-mips-linux-gnu binutils-mipsel-linux-gnu  binutils-arm-linux-gnueabi


Code:

$ cd _fs3.squashfs.extracted/squashfs-root

$ mips-linux-gnu-readelf -h bin/busybox
ELF Header:  
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           MIPS R3000
  Version:                           0x1
  Entry point address:               0x4026f0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          261196 (bytes into file)
  Flags:                             0x1007, noreorder, pic, cpic, o32, mips1
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         7
  Size of section headers:           40 (bytes)
  Number of section headers:         27
  Section header string table index: 26


Code:

$ cp `which qemu-mips-static` .
$ sudo chroot . ./qemu-mips-static bin/busybox

BusyBox v1.13.4 (2015-07-21 17:06:46 CST) multi-call binary  
Copyright (C) 1998-2008 Erik Andersen, Rob Landley, Denys Vlasenko  
and others. Licensed under GPLv2.  
See source distribution for full notice.

Usage: busybox [function] [arguments]...  
   or: function [arguments]...

    BusyBox is a multi-call binary that combines many common Unix
    utilities into a single executable.  Most people will create a
    link to busybox for each function they wish to use and BusyBox
    will act like whatever it was invoked as!

Currently defined functions:  
    ash, bunzip2, bzcat, cat, chpasswd, cp, cut, date, echo, expr, false,
    free, getty, grep, halt, head, hostname, ifconfig, init, ip, kill,
    killall, klogd, ln, login, ls, mkdir, mount, ping, ping6, poweroff,
    ps, reboot, renice, rm, route, sed, sh, sleep, syslogd, tail, telnetd,
    true, umount, uptime, wc