0

I used binwalk to scan firmware image, uncompressed & raw RAM dump. When scan for signatures with -I flag there is reference to Linux EXT filesystem:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
... ... 
2148245       0x20C795        Linux EXT filesystem, blocks count: 1048741, image size: 1073910784, invalid state invalid error behavior invalid major revision rev 611745794.9334, ext2 filesystem data (mounted or unclean), UUID=a200288c-6200-14af-a200-2c8c62006200, volume name "¢"

I want extract that filesystem use dd command:

dd if=image.out of=ext2-filesystem bs=1 skip=2148245 count=1048741

On output I got file 1,0 MiB (1 048 741 bytes). I'm not sure that this is correct result, the file is too small. What should be the correct command for this?

EDIT: GNU Coreutils,

$ dd --version
dd (coreutils) 8.32
Improve this question
5
  • (1) What is the question? (2) I did dd if=/dev/urandom count=2M of=random && binwalk -I random and also found EXT with "invalid state invalid error behavior invalid major revision". Meaningless. Your file is not random data by itself, but the alleged EXT may be a false positive. (3) "Blocks count" is not "bytes count". The block size seems to be 1024 bytes here. Commented Jul 4, 2024 at 5:19
  • 1
    You specified blocksize=1 (bs=1) and count=1048741, that gives a file size of 1MB. As Kamil stated, the blocksize is 1024 (1073910784 / 1024 = 1048731). So you may get the image you desire by simply specifying bs=1024. Also recalculate the skip= value to fit the beginning of the assumed image in the dump. Commented Jul 4, 2024 at 6:33
  • 2148245 is not divisible by 1024, so recalculating skip= while using bs=1024 is not really possible. In dd from GNU coreutils 9.0 or later skip=2148245B should work regardless of bs=, I think. Earlier versions could do this with skip=2148245 iflag=skip_bytes. Portably one needs to keep bs=1 and to recalculate count=. Commented Jul 4, 2024 at 6:54
  • dd if=image.out of=ext2-filesystem bs=1024 skip=2148245B count=1048741 dd: invalid number: ‘2148245B’ Commented Jul 4, 2024 at 11:26
  • B isn't a valid suffix. Please read the documentation man dd (search for suffix) Commented Jul 4, 2024 at 11:35

0

Reset to default

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.