迅捷PoE*AC路由一体机FR100P-AC固件提取研究

获取固件

从官网上下载固件升级包。

升级软件包：

https://service.fastcom.com.cn/d3/201712/FR100P-AC V1.0升级软件20171124.zip

解压出来fr100pacv1.bin

固件提取

binwalk分析一下固件。

(p27) ➜  binwalk fr100pacv1.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
20            0x14            IMG0 (VxWorks) header, size: 909568
43956         0xABB4          U-Boot version string, "U-Boot 1.1.3 (Jun  2 2017 - 18:37:14)"
57492         0xE094          IMG0 (VxWorks) header, size: 852096
57620         0xE114          LZMA compressed data, properties: 0x6E, dictionary size: 8388608 bytes, uncompressed size: 1267504 bytes
675920        0xA5050         Unix path: /web/language/cn/error.js
677152        0xA5520         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 1758 bytes
678325        0xA59B5         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 3237 bytes
678785        0xA5B81         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 200 bytes
678981        0xA5C45         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 80 bytes
679039        0xA5C7F         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 21984 bytes
682408        0xA69A8         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 147 bytes
682529        0xA6A21         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 493 bytes
682948        0xA6BC4         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 2826 bytes
684431        0xA718F         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 32861 bytes
691537        0xA8D51         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 4383 bytes
693333        0xA9455         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 2747 bytes
694524        0xA98FC         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 7316 bytes
696832        0xAA200         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 1981 bytes
697735        0xAA587         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 15912 bytes
701953        0xAB601         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 2955 bytes
702968        0xAB9F8         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 6623 bytes
704981        0xAC1D5         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 3565 bytes
706289        0xAC6F1         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 2831 bytes
707554        0xACBE2         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 4280 bytes
708886        0xAD116         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 10925 bytes
711326        0xADA9E         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 286 bytes
711548        0xADB7C         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 3912 bytes
712971        0xAE10B         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 5943 bytes
714894        0xAE88E         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 5955 bytes
716799        0xAEFFF         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 6416 bytes
718873        0xAF819         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 1638 bytes
719622        0xAFB06         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 7549 bytes
721691        0xB031B         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 857 bytes
722183        0xB0507         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 22381 bytes

尝试binwalk -Me提取，提出了一堆无用文件。

通过binwalk解压分析后并不能得到和其他大部分路由器一样类似的完整的文件系统。从binwalk的分析结果来看：

(p27) ➜  binwalk  fr100pacv1.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
20            0x14            IMG0 (VxWorks) header, size: 909568
43956         0xABB4          U-Boot version string, "U-Boot 1.1.3 (Jun  2 2017 - 18:37:14)"
57492         0xE094          IMG0 (VxWorks) header, size: 852096
57620         0xE114          LZMA compressed data, properties: 0x6E, dictionary size: 8388608 bytes, uncompressed size: 1267504 bytes
675920        0xA5050         Unix path: /web/language/cn/error.js
677152        0xA5520         LZMA compressed data, properties: 0x5A, dictionary size: 8388608 bytes, uncompressed size: 1758 bytes

该固件主要由一个固件头部（IMG0 header）、引导加载程序（uBoot）、和其他LZMA格式的文件数据组成（LZMA是一种压缩算法）。但uBoot解析并没有获取到入口地址Entry Point，只能尝试手动提取分析。

拉个图表，分析每个段的长度，可以很明显看出来57620开始位置的lzma压缩文件占用空间最大，占用了68%，极大概率是主程序。

用dd来提取dd if=fr100pacv1.bin of=57620.lzma bs=1 skip=57620 count=619532

(p27) ➜  ls -l 57620.lzma
-rw-r--r-- 1 root root 619532 3月  28 05:30 57620.lzma
(p27) ➜  lzma -d 57620.lzma
lzma: 57620.lzma: Compressed data is corrupt

lzma解压报错，用010editor打开57620.lzma，拉到底，看右侧灰度布局。

灰度有问题，往上拉，找到断层位置。

将下面的数据删除，重新lzma解压：

(p27) ➜  lzma -d 57620.lzma
(p27) ➜  ls -l 57620
-rw-r--r-- 1 root root 1267504 3月  28 05:36 57620

没有回显，已经成功解压。丢进ida，无法分析，先分析程序是x86还是arm。

binwalk 分析：

(p27) ➜  FR100P-AC V1.0 binwalk 57620

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
176636        0x2B1FC         Copyright string: "Copyright(C) 2001-2011 by TP-LINK TECHNOLOGIES CO., LTD."
522740        0x7F9F4         PEM certificate
523412        0x7FC94         PEM RSA private key
559336        0x888E8         Copyright string: "Copyright FAST_TECHNOLOGIES"
790532        0xC1004         HTML document header
790597        0xC1045         HTML document footer
947428        0xE74E4         PEM certificate
947484        0xE751C         PEM certificate request
947668        0xE75D4         PEM RSA private key
947864        0xE7698         PEM EC private key
947928        0xE76D8         PEM DSA private key
1049388       0x10032C        XML document, version: "1.0"
1049576       0x1003E8        Base64 standard index table
1183672       0x120FB8        SHA256 hash constants, little endian
1242908       0x12F71C        XML document, version: "1.0"

没能找到大致的系统，但至少确定了是little endian小端，挨个试吧，先试一下arm：

ida里c一下，发现还是不对：

x86架构也不对：

再试试mips：

mips的架构估计是对的，那么换ghidra来分析，选择mips 32位小端：

先看文件最开始的汇编：

将基地址改为0xb0000000，再进行分析：

可以看到，反编译窗口也正常了：

但是发现部分函数的偏移是0x80开头：

重新尝试改基地址为0x80000000：

反编译正常运行：

字符串的数据引用也正常了，到这里固件的提取就完成了。