Filesystem compression

[yarghpirates]

I've been trying to mount (and binwalk extract) the JFFS2 filesystems from the flash dumps in this repo. It appears that the filesystems are compressed, mostly with ZLIB compression.

While they all mount, the files in some of them are inaccessible and dmsg log shows the follow errors when you try to read the contents:
jffs2: compression type 0x16 not available
jffs2: Error: jffs2_decompress returned -5

Binwalking will successfully extract the inodes of the filesystem, but doesn't decompress them, again due to the unsupported compression type (0x16).

Has anyone figured out what is going on here? These issues have happened for the following flash dumps:
MX25L12835F_CFW_20210830.BIN
MX25L12835F_FW_20200804.bin
MX25L12835F_FW_20210306.bin
MX25L12835F_FW_20210306_2.bin

[jsm174]

A while ago I played with this and I had some luck with jefferson.

I just tried to install jefferson again and am having some issues with lzo on an m1 mac. Going to try to find my notes..

[yarghpirates]

I've also tried to directly use jefferson, and have debugged it down to unpack(), where it checks the compression type, and then fails because 0x16 isn't supported. I tried adding 0x16 to force it to use ZLIB decompression, but it fails with various errors (e.g. invalid distance too far back).

I've also tried to manually decompress the binwalk extracted files, using "pigz -d < input_file > output_file". This fails in many cases, but some of the files under /scripts do partially decompress.

I wondered if the vendor is using a proprietary version of JFFS2 kernel modules, with a custom ZLIB compression algorithm, but there seems to be no consistent usage of it among firmware versions. There isn't some specific point in time that they began compressing it this way.

[jsm174]

So the last time I used jefferson with this project was back in November of 2020.

After setting it up, it started to come back to me.

git clone https://github.com/sviehb/jefferson
cd jefferson
git checkout e06a6178b6ad4abc3e6caf32a7df4709625773cd
sudo pip3 install cstruct==1.8
sudo python3 setup.py install
jefferson ~/Downloads/MX25L12835F_FW_20210306.bin -d MX25L12835F_FW_20210306

As you said, jefferson reported errors:

compression not implemented Jffs2_raw_inode(magic=6533, nodetype=57346, totlen=2571, hdr_crc=1444361888, ino=19, version=1, mode=33261, uid=1000, gid=0, isize=1918732, atime=1480478172, mtime=1480478172, ctime=1480478172, offset=0, csize=2503, dsize=4096, compr=22, usercompr=0, flags=0, data_crc=1057549853, node_crc=2190948154)

I didn't really see any examples of different compression options added to JFFS2 kernel modules, although I guess anything is possible.

[ludwig-v]

After working on it for hours, enjoy : https://github.com/ludwig-v/wireless-carplay-dongle-reverse-engineering/tree/master/Flash_Dump/Tools

@jsm174 @yarghpirates, never too late ahah

[jsm174]

awesome! I definitely have to revisit this project again.

[Zubastic]

@ludwig-v I forked repo with fix:
https://github.com/Zubastic/jefferson

So just clone and launch poetry.

How to use with binwalk

1. Uninstall original jefferson via pip pip3 uninstall jefferson
2. Cd to repo dir (git clone u do already) cd jefferson
3. Build package poetry build
4. Install package pip3 install jefferson/dist/jefferson-0.4.5-py3-none-any.whl change path to ur whl

After that just launch binwalk (I use binwalk-ui from scripts folder):
./binwalk-ui -e 1.bin

PS List of box versions from boxImgTools:

Auto_Box
A15HW
A15W
U2WR
U2W
U2HW
U2HC
U2AW
U2F
U2AC
U2IW
UC2HCD
UC2WD
UC2HWD
UC2D
UC2W
UC2HW
UC2HC
UC2F
UC2AW
O2W