I'm trying to use Binwalk to extract an IpCam bin firmware. I did it successfully for the WebUI, but I can't on the firmware itself.Hardware : Vstarcam C7824WIPFirmware : CH-sys-48.53.64.67.zipWebUI : CH-app-EN53.8.1.13_VSTARCAM.zipProblem : It's only extracting sysversion.txt, a bit light :).Files :ron@vpsXXXXXX:~/firmware$ lsCH-sys-48.53.64.67.zipVerification and extraction :ron@vpsXXXXXX:~/firmware$ binwalk CH-sys-48.53.64.67.zipDECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------0             0x0             Zip archive data, at least v2.0 to extract, compressed size: 605571, uncompressed size: 612699, name: CH-sys-48.53.64.67.bin605717        0x93E15         End of Zip archiveron@vpsXXXXXX:~/firmware$ file CH-sys-48.53.64.67.zipCH-sys-48.53.64.67.zip: Zip archive data, at least v2.0 to extractron@vpsXXXXXX:~/firmware$ unzip CH-sys-48.53.64.67.zipArchive:  CH-sys-48.53.64.67.zip  inflating: CH-sys-48.53.64.67.binBinwalk without extracting :ron@vpsXXXXXX:~/firmware$ binwalk CH-sys-48.53.64.67.binDECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------172           0xAC            Zip archive data, at least v2.0 to extract, compressed size: 8969, uncompressed size: 19091, name: system/system/lib/libsns_gc1004.so9337          0x2479          End of Zip archive9499          0x251B          Zip archive data, at least v2.0 to extract, compressed size: 7813, uncompressed size: 16341, name: system/system/lib/libsns_ov9712_plus.so17518         0x446E          End of Zip archive17680         0x4510          Zip archive data, at least v2.0 to extract, compressed size: 90121, uncompressed size: 353248, name: system/system/lib/libOnvif.so107987        0x1A5D3         End of Zip archive108149        0x1A675         Zip archive data, at least v2.0 to extract, compressed size: 43603, uncompressed size: 84480, name: system/system/lib/libvoice_arm.so151946        0x2518A         End of Zip archive152108        0x2522C         Zip archive data, at least v2.0 to extract, compressed size: 130, uncompressed size: 227, name: system/init/ipcam.sh152406        0x25356         End of Zip archive152568        0x253F8         Zip archive data, at least v2.0 to extract, compressed size: 402383, uncompressed size: 886168, name: system/system/bin/encoder555129        0x87879         End of Zip archive555291        0x8791B         Zip archive data, at least v2.0 to extract, compressed size: 35394, uncompressed size: 74200, name: system/system/bin/wifidaemon590869        0x90415         End of Zip archive591031        0x904B7         Zip archive data, at least v2.0 to extract, compressed size: 1852, uncompressed size: 9692, name: system/system/bin/grade.sh593063        0x90CA7         End of Zip archive593225        0x90D49         Zip archive data, at least v2.0 to extract, compressed size: 8704, uncompressed size: 20212, name: system/system/bin/updata602105        0x92FF9         End of Zip archive602267        0x9309B         Zip archive data, at least v2.0 to extract, compressed size: 1874, uncompressed size: 4522, name: system/system/bin/gpio_aplink.ko604333        0x938AD         End of Zip archive604495        0x9394F         Zip archive data, at least v2.0 to extract, compressed size: 7241, uncompressed size: 16802, name: system/system/bin/motogpio.ko611922        0x95652         End of Zip archive612084        0x956F4         Zip archive data, at least v1.0 to extract, compressed size: 8, uncompressed size: 8, name: system/system/bin/fwversion.bin612282        0x957BA         End of Zip archive612444        0x9585C         Zip archive data, at least v1.0 to extract, compressed size: 9, uncompressed size: 9, name: system/system/bin/sysversion.txt612645        0x95925         End of Zip archiveBinwalk extraction : ron@vpsXXXXXX:~/firmware$ binwalk -Mer CH-sys-48.53.64.67.binScan Time:     2016-01-19 00:36:12Target File:   /home/ron/firmware/CH-sys-48.53.64.67.binMD5 Checksum:  58df9214226cfe46760215bfca0c496cSignatures:    344DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------172           0xAC            Zip archive data, at least v2.0 to extract, compressed size: 8969, uncompressed size: 19091, name: system/system/lib/libsns_gc1004.so9337          0x2479          End of Zip archive9499          0x251B          Zip archive data, at least v2.0 to extract, compressed size: 7813, uncompressed size: 16341, name: system/system/lib/libsns_ov9712_plus.so17518         0x446E          End of Zip archive17680         0x4510          Zip archive data, at least v2.0 to extract, compressed size: 90121, uncompressed size: 353248, name: system/system/lib/libOnvif.so107987        0x1A5D3         End of Zip archive108149        0x1A675         Zip archive data, at least v2.0 to extract, compressed size: 43603, uncompressed size: 84480, name: system/system/lib/libvoice_arm.so151946        0x2518A         End of Zip archive152108        0x2522C         Zip archive data, at least v2.0 to extract, compressed size: 130, uncompressed size: 227, name: system/init/ipcam.sh152406        0x25356         End of Zip archive152568        0x253F8         Zip archive data, at least v2.0 to extract, compressed size: 402383, uncompressed size: 886168, name: system/system/bin/encoder555129        0x87879         End of Zip archive555291        0x8791B         Zip archive data, at least v2.0 to extract, compressed size: 35394, uncompressed size: 74200, name: system/system/bin/wifidaemon590869        0x90415         End of Zip archive591031        0x904B7         Zip archive data, at least v2.0 to extract, compressed size: 1852, uncompressed size: 9692, name: system/system/bin/grade.sh593063        0x90CA7         End of Zip archive593225        0x90D49         Zip archive data, at least v2.0 to extract, compressed size: 8704, uncompressed size: 20212, name: system/system/bin/updata602105        0x92FF9         End of Zip archive602267        0x9309B         Zip archive data, at least v2.0 to extract, compressed size: 1874, uncompressed size: 4522, name: system/system/bin/gpio_aplink.ko604333        0x938AD         End of Zip archive604495        0x9394F         Zip archive data, at least v2.0 to extract, compressed size: 7241, uncompressed size: 16802, name: system/system/bin/motogpio.ko611922        0x95652         End of Zip archive612084        0x956F4         Zip archive data, at least v1.0 to extract, compressed size: 8, uncompressed size: 8, name: system/system/bin/fwversion.bin612282        0x957BA         End of Zip archive612444        0x9585C         Zip archive data, at least v1.0 to extract, compressed size: 9, uncompressed size: 9, name: system/system/bin/sysversion.txt612645        0x95925         End of Zip archiveScan Time:     2016-01-19 00:36:12Target File:   /home/ron/firmware/_CH-sys-48.53.64.67.bin.extracted/system/system/bin/sysversion.txtMD5 Checksum:  3e98d83fbced8eb62c79542f5df5a14fSignatures:    344DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------Only one target file extracted...A quick look to headers :ron@vpsXXXXXX:~/firmware$ head -n1 CH-sys-48.53.64.67.bin | hexdump -C00000000  77 77 77 2e 6f 62 6a 65  63 74 2d 63 61 6d 65 72  |www.object-camer|00000010  61 2e 63 6f 6d 2e 62 79  2e 68 6f 6e 67 7a 78 2e  |a.com.by.hongzx.|00000020  73 79 73 74 65 6d 2f 73  79 73 74 65 6d 2f 6c 69  |system/system/li|00000030  62 2f 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |b/..............|00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|*00000060  6c 69 62 73 6e 73 5f 67  63 31 30 30 34 2e 73 6f  |libsns_gc1004.so|00000070  2e 7a 69 70 00 00 00 00  00 00 00 00 00 00 00 00  |.zip............|00000080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|*000000a0  e3 23 00 00 43 40 35 30  00 00 00 00 50 4b 03 04  |.#..C@50....PK..|000000b0  14 00 00 00 08 00 fa 8b  5d 47 89 42 30 43 09 23  |........]G.B0C.#|000000c0  00 00 93 4a 00 00 22 00  1c 00 73 79 73 74 65 6d  |...J.....system|000000d0  2f 73 79 73 74 65 6d 2f  6c 69 62 2f 6c 69 62 73  |/system/lib/libs|000000e0  6e 73 5f 67 63 31 30 30  34 2e 73 6f 55 54 09 00  |ns_gc1004.soUT..|000000f0  03 88 e7 31 56 88 e7 31  56 75 78 0b 00 01 04 ed  |...1V..1Vux.....|00000100  03 00 00 04 ed 03 00 00  e5 7c 0b 78 53 55 d6 f6  |.........|.xSU..|00000110  3e b9 b4 69 9a cb 69 cf  29 96 8b 92 0a           |>..i..i.)....|0000011dAny idea why I'm not able to extract everything ? Thank you !Ronan
Unpack IpCam firmware - Binwalk extraction issue
binary analysis;binary
Although my binwalk version extracted the files correctly to the system folder along with the zip files containing only the sysversion.txt, I shortly describe why you see only the sysversion.txt in the archive files.It is because the firmware file contain multiple PKZIP archives and the binwalk does not know the exact size of these files. So, it can identify the start of the PKZIP file correctly based on the PK magic, but without knowing the correct file size, it extracts the remaining bytes to the created ZIP file. Because the central directory structure in PKZIP format stored at the end of the ZIP file, after the compressed data and the extracted ZIP file ends with the sysversion.txt.zip, the file viewer or decompressor may found the central directory of the last ZIP file.To solve this problem, you may check the system folder in the same folder you found the ZIP files, or you can extract the files manually.If you take a look at the start of the CH-sys-48.53.64.67.bin file, you will find that it has a simple structure. It starts with a magic string (marked with blue in the picture). The next element is a 0x40 bytes long directory name (marked with yellow) followed by a 0x40 bytes long file name entry (marked with green). After the file name you will find the size of the file (marked with purple), some flags and the binary content (start of the binary file marked with grey).Based on these information you can write a simple script, which extracts the files correctly, for example:import sysimport structif (len(sys.argv) < 2):    print 'usage: parse binary'    sys.exit(1)b = open(sys.argv[1], 'rb').read()o = 0x20while(o < len(b)-0x20):    dir = b[o:o+0x40].strip('\x00')    fname = b[o+0x40:o+0x80].strip('\x00')    size = struct.unpack('L', b[o+0x80:o+0x84])[0]    unk1 = struct.unpack('L', b[o+0x84:o+0x88])[0]    unk2 = struct.unpack('L', b[o+0x88:o+0x8c])[0]    print '%x, %s, %s: %x, %x, %x'%(o, dir, fname, size, unk1, unk2)    open(fname, 'wb').write(b[o+0x8c:o+0x8c+size])    o += 0x8c+size