用binwalk2第一次分析,然后解压出来得到文件名为8C的文件。
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
76 0x4C uImage header, header size: 64 bytes, header CRC: 0x31E3AA7C, created: 2015-05-28 15:24:02, image size: 6920927 bytes, Data Address: 0x80000000, Entry Point: 0x8000C2F0, data CRC: 0xE6A4E643, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
140 0x8C LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 10035720 bytes
第二步:查看得到8C文件类型。
file 8C
8C: data
用binwalk分析并解压,得到好多文件。3EFFA8.xz ,403A58。。。到404850.
我用ghex看了下应该是把8C 从0x3EFFA8至文件尾分离得到3EFFA8.xz 。从0x403A58到文件尾得到403A58。
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
3608648 0x371048 Linux kernel version "2.6.36+ (root@jhl-ubuntu) (gcc version 3.4.2) #3687 Thu May 28 11:23:48 EDT 2015"
3796896 0x39EFA0 CRC32 polynomial table, little endian
3820048 0x3A4A10 Base64 standard index table
4128680 0x3EFFA8 xz compressed data
4186199 0x3FE057 Unix path: /S70/S75/505V/F505/F707/F717/P8
4209240 0x403A58 HTML document header
4209483 0x403B4B HTML document footer
4209592 0x403BB8 HTML document header
4209922 0x403D02 HTML document footer
4210040 0x403D78 HTML document header
4210101 0x403DB5 HTML document footer
4212460 0x4046EC HTML document header
4212652 0x4047AC HTML document footer
4212816 0x404850 HTML document header
4213185 0x4049C1 HTML document footer
4214788 0x405004 HTML document footer
4237871 0x40AA2F Neighborly text, "neighbor %.2x%.2x.%pM lostde"
第三步:然后又分析了3EFFA8.xz 。
file 3EFFA8.xz
3EFFA8.xz: XZ compressed data
尝试解压失败
xz -dc 3EFFA8.xz
xz: 3EFFA8.xz: Compressed data is corrupt
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 xz compressed data
57519 0xE0AF Unix path: /S70/S75/505V/F505/F707/F717/P8
80560 0x13AB0 HTML document header
80803 0x13BA3 HTML document footer
80912 0x13C10 HTML document header
81242 0x13D5A HTML document footer
81360 0x13DD0 HTML document header
81421 0x13E0D HTML document footer
83780 0x14744 HTML document header
83972 0x14804 HTML document footer
84136 0x148A8 HTML document header
84505 0x14A19 HTML document footer
86108 0x1505C HTML document footer
109191 0x1AA87 Neighborly text, "neighbor %.2x%.2x.%pM lostde"
GOOGLE了好久了,求懂文件结构的帮忙分析下。怎么解压。
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课