5

I have 2 files but I have no idea, how to unpack them.

239113254011.ldr

239113254012.krn

Inside is a Firmware for ADB(iCan)3800TW used in Italy. We need to unpack it and delete the root password.

Can somebody help please?

joseff
  • 51
  • 1
  • Yes, I know about Binwalk, just tried, but have found nothing. That is the reason, why I ask here. :-) – joseff Dec 20 '13 at 10:37
  • Try a newer version of binwalk perhaps? Binwalk shows me a valid Zlib compressed block of data at offset 0x230 in the ldr file. After decompression it contains readable strings and what appears to be executable code. No dice on the krn file, but analysis of the decompressed Zlib data may help with understanding the krn file. – devttys0 Dec 25 '13 at 04:37
  • Wow. How did you opened the ldr file? It show me, that there is something, but it say that the zlib archive is defect and not possible to open. Can you write some manual, with what and how you have extracted this from the file? – joseff Dec 26 '13 at 16:16
  • What are you using to decompress it? I used Python's zlib module. – devttys0 Dec 26 '13 at 19:13
  • Yes, it is working. Thank you very much. This is a small step forward after a very long time. Well, now to the second file (.krn). There is a sequence of 14 bytes in the file, which is repeated every 64 KB, it looks like something to mark blocks... On the other hand, binwalk calculated entropy close to 1 in the entire file. So there will be some compression. That does not go together. The sequence must go away... ??? After those 14 bytes is always increasing number. Always the same structure up to 32. byte. It is possible, that somewhere on the beginning is one or more "small" pictures. – joseff Dec 27 '13 at 17:03
  • Actually, looking at binwalk's entropy plot shows large variations in entropy, especially in the first part of the krn file. My guess is the krn file is broken up into blocks, each of which are encrypted/compressed. Some interesting strings from the decompressed ldr zlib data might be pertinent: "SRH ENCRYPTED CRC ERROR", "SECTOR DECRYPTION ERROR", "SRH UNKNOWN COMPRESSION METHOD", "SGRM DECOMPRESSION ERROR". – devttys0 Dec 28 '13 at 00:00

1 Answers1

7

You can try to use binwalk. It can be used in various ways:

  • Embedded file identification and extraction
  • Executable code identification
  • Entropy analysis and graphing (useful for compression and encryption identification)
  • "Smart" strings analysis

You could try to open your file with 7zip, since it supports a shitload of compression formats.

And also worth looking at the firmware mod kit.

jvoisin
  • 2,516
  • 16
  • 23