For the past 8 months or so, I’ve been heading a project on reverse engineering router firmware with the end goal of developing a generalized, repeatable, effective technique to backdoor router firmwares images (and ultimately the devices they are flashed upon). While I have much to share about my research and progress so far, it is unfortunately not the topic of this post, but will instead have to wait until a future one.
Instead, this post will be used to publish the beginning of an interesting conversation I started with NETGEAR. The latest target of my project is the NETGEAR WNR1000v3 router, specifically the V1.0.2.26 North America (NA) firmware image. After analyzing the image, I discovered an LZMA-compressed SquashFS filesystem but was unable to extract it using any public means available. For more information, I posted a detailed case regarding the issue on the OpenWRT forum: https://forum.openwrt.org/viewtopic.php?id=35157
The WNR1000v3 firmware is in fact open source (available here), but it does not contain the necessary unsquashfs utility to unpackage the filesystem, only the mksquashfs utility used to create it:
$ find . -name *squashfs* ./src/router/mipsel-uclibc/target.squashfs ./src/router/squashfs ./src/router/squashfs/mksquashfs.c ./src/router/squashfs/mksquashfs.h ./src/linux/linux/scripts/squashfs ./src/linux/linux/scripts/squashfs/mksquashfs ./src/linux/linux/scripts/squashfs/mksquashfs.c ./src/linux/linux/scripts/squashfs/mksquashfs.h ./src/linux/linux/scripts/squashfs/squashfs_fs.h ./src/linux/linux/fs/squashfs ./src/linux/linux/fs/squashfs/.squashfs2_0.o.flags ./src/linux/linux/fs/squashfs/squashfs2_0.o ./src/linux/linux/fs/squashfs/squashfs.o ./src/linux/linux/fs/squashfs/squashfs.h ./src/linux/linux/fs/squashfs/squashfs2_0.c ./src/linux/linux/fs/squashfs/.squashfs.o.flags ./src/linux/linux/include/linux/squashfs_fs_i.h ./src/linux/linux/include/linux/squashfs_fs.h ./src/linux/linux/include/linux/squashfs_fs_sb.h ./src/linux/linux/include/config/squashfs.h ./src/linux/linux/include/config/squashfs
While waiting for potential replies on the reverse engineering route, I additionally reached out to NETGEAR itself to see if it would be possible for them to simply provide their version of the unsquashfs code. As this utility is not necessary for the actual firmware build process, I was wholly expecting an answer of either “I’m sorry, we have no such tool” or “We simply are unable to send it to you,” but figured it was worth a try anyways. However, I was a bit surprised to instead receive the answer that apparently the WNR1000v3 is actually not open source.
…What?
3/2/2012 3:06:00 PM REFURB 2012-02-28 Other Hi Netgear, I'm reviewing the source code for your WNR1000v3 router (specifically, the WNR1000v3-V1.0.2.26_51.0.59NA image), and I see under bcm5356/src/router/squashfs that you only provide mksquashfs, and not unsquashfs. Since it seems that your squashfs utilities have special patches to perform LZMA compression, stock unsquashfs utilities don't work (nor do any other variants I can find publicly). Would it be possible to receive unsquashfs.c, and any other relevant files to unpackage the filesystem on this router? Thank you!
3/4/2012 2:02:00 AM From Agent ID: 1410 Case ID: 18044702 Dear Michael, Thank you for choosing NETGEAR. My name is Naveen, and I am your support engineer today. I understand that you want to modify the source code of the router. We apologize for this inconvenience. Because we are doing this online, it might require a few email exchanges to resolve the issue. Rest assured that we will do our best to resolve your case quickly. Regarding your concern I am sorry to inform you that we cannot modify the source code of this router because its not an open source. Please contact us again if you require further assistance. Please do visit http://support.netgear.com for any technical queries regarding NETGEAR products. A notice will automatically be sent to your email address when we have responded to your inquiry. Please DO NOT REPLY to that email. Instead, to add additional information to your case, click No to the question "Was your problem resolved with the information provided by the NETGEAR representative above?" If you click YES, your case will be closed and a separate email containing a survey link will be sent so you can share with us your customer support experience. Thanks again for choosing NETGEAR. Have a great day! Sincerely, Naveen Technical Support NETGEAR, Inc. http://my.netgear.com ***NOTE: Your case will autoclose after 7 days of inactivity.*** Did you know that NETGEAR provides support for all your home networking devices and PCs? We can provide a one-stop solution - no need to call multiple vendors* for support. If you would like to learn more about the NETGEAR GearHead services, go to http://kbserver.netgear.com/kb_web_files/gearhead/home.html.
I have replied to the ticket and will provide updates as the conversation progresses.
UPDATE: NETGEAR has replied:
3/4/2012 2:27:00 AM Hi Naveen, Thank you for your reply, I greatly appreciate it. However I am very confused. That model router is in fact open source, contrary to what you mentioned. It is listed on http://support.netgear.com/app/answers/detail/a_id/2649 and specifically may be downloaded from http://www.downloads.netgear.com/files/GPL/WNR1000v3-V1.0.2.26_51.0.59NAWW_src.tar.zip According to the GPL license, all derivative work must also be GPL licensed, and therefore open source. NETGEAR''s WNR1000v3 product is based upon the GPL-licensed Linux kernel, as well as the GPL-licensed SquashFS filesystem, and therefore directly falls under this category of derivative work. NETGEAR has published all versions of the WNR1000v3 firmware free and open source, however, they lack the unsquashfs utility that is part of the SquashFS project. May NETGEAR please release the source code to the unsquashfs utility for the WNR1000v3 V1.0.2.26 firmware, which is part of the SquashFS software project used to build this router''s filesystem? Thank you.
3/4/2012 3:44:00 AM From Agent ID: 1410 Case ID: 18044702 Dear Michael, My name is Naveen, and I am following up on your Support case. After reviewing the information you provided, I have a better understanding of your issue Please do click on the link below to know more about the router: http://support.netgear.com/app/answers/detail/a_id/19969 Please do visit http://support.netgear.com for any technical queries regarding NETGEAR products. A notice will automatically be sent to your email address when we have responded to your inquiry. Please DO NOT REPLY to that email. Instead, to add additional information to your case, click No to the question "Was your problem resolved with the information provided by the NETGEAR representative above?" If you click YES, your case will be closed and a separate email containing a survey link will be sent so you can share with us your customer support experience. Thanks again for choosing NETGEAR. Have a great day! Sincerely, Naveen Technical Support NETGEAR, Inc. http://my.netgear.com ***Please be aware that your case will autoclose after 7 days of inactivity.*** Did you know that NETGEAR provides support for all your home networking devices and PCs? We can provide a one-stop solution - no need to call multiple vendors* for support. If you would like to learn more about the NETGEAR GearHead services, go to http://kbserver.netgear.com/kb_web_files/gearhead/home.html.
Michael Coppola's Blog 