Coder Social home page Coder Social logo

ubidump's Introduction

UBIFS Dumper

This tool can be used to view or extract the contents of UBIFS images.

About UBIFS

UBIFS is a filesystem specifically designed for used on NAND flash chips. NAND flash is organized in eraseblocks. Eraseblocks can be erased, appended to, and read. Erasing is a relatively expensive operation, and can be done only a limited number of times.

An UBIFS image contains four abstraction layers:

  • eraseblocks
  • volumes
  • b-tree nodes
  • inodes

Each eraseblock contains info on how often it has been erased, and which volume it belongs to. A volume contains a b-tree database with keys for:

  • inodes, indexed by inode number
  • direntries, indexed by inode number + name hash
  • datablocks, indexed by inode number + block number

The inodes are basically a standard unix filesystem, with direntries, regular files, symlinks, devices, etc.

mounting images on linux

modprobe nandsim first_id_byte=0x2c second_id_byte=0xac third_id_byte=0x90 fourth_id_byte=0x26
nandwrite /dev/mtd0   firmware-image.ubi 
modprobe ubi mtd=/dev/mtd0,4096
mount -t ubifs  -o ro /dev/ubi0_0 mnt

This will mount a ubi image for a device with eraseblock size 0x40000. If your image has a blocksize of 0x20000, use fourth_id_byte=0x15, and specify a pagesize of 2048 with the second modprobe line.

Usage

View the contents of the /etc/passwd file in the filesystem image image.ubi:

python ubidump.py  -c /etc/passwd  image.ubi

List the files in all the volumes in image.ubi:

python ubidump.py  -l  image.ubi

View the contents of b-tree database from the volumes in image.ubi:

python ubidump.py  -d  image.ubi

Install

Install the required python modules using:

pip install -r requirements.txt

or as a pip package:

pip install ubidump

You may need to manually install your operarating system libraries for lzo first:

on linux:

apt install liblzo2-dev

on MacOS:

brew install lzo

maybe you need to build the python library like this:

LDFLAGS=-L/usr/local/lib CFLAGS=-I/usr/local/include/lzo pip3 install python-lzo

When you need zstd compression, you will need to install the zstandard module.

Dependencies

  • python2 or python3
  • python-lzo ( >= 1.09, which introduces the 'header=False' argument )
  • crcmod
  • optional: zstandard

TODO

  • add option to select a volume
  • add option to select a older master node
  • parse the journal
  • analyze b-tree structure for unused nodes
  • analyze fs structure for unused inodes, dirents
  • verify that data block size equals the size mentioned in the inode.
  • add support for ubifs ( without the ubi layer )
  • add option to extract a raw volume.

References

Similar tools

Author

Willem Hengeveld [email protected]

ubidump's People

Contributors

nlitsme avatar geekman avatar jremmet avatar xixitalk avatar

Watchers

James Cloos avatar  avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.