how to unsquashfs or mount a firmware image?

Question

i want to extract my routers firmware, and modify it. so i used bitsum's firmware mod kit. it seems there is no error. i can get image_parts directory also there is rootfs.img (squashfs image) file. but the problem is i can neither mount it nor unsquashfs.

This is extraction output:

# ./extract-ng.sh AirTies_Air5021RU_FW_1.2.0.16_FullImage.bin
Firmware Mod Kit (extract-ng) 0.69 beta, (c)2011 Craig Heffner, Jeremy Collake
http://www.bitsum.com

Scanning firmware...

DECIMAL    HEX          DESCRIPTION
-------------------------------------------------------------------------------------------------------
65228      0xFECC       Squashfs filesystem, big endian, version 2.0, size: 1369418 bytes, 382 inodes, blocksize: 65536 bytes, created: Tue May  3 13:44:22 2011

Extracting 65228 bytes of  header image at offset 0
Extracting squashfs file system at offset 65228
Extracting 160 byte footer from offset 1972107
Extracting squashfs files...
Firmware extraction successful!
Firmware parts can be found in 'fmk/*'

Mount attempt output:

fmk# ls
image_parts  logs  rootfs
fmk# cd image_parts/
fmk/image_parts# ls
footer.img  header.img  rootfs.img
fmk/image_parts# file rootfs.img 
rootfs.img: Squashfs filesystem, big endian, version 2.0, 1369418 bytes, 382 inodes, blocksize: 65536 bytes, created: Tue May  3 13:44:22 2011
fmk/image_parts# mount rootfs.img /mnt/rootfs/ -o loop -t squashfs
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
fmk/image_parts# dmesg | tail -n 1
[24799.284066] SQUASHFS error: Can't find a SQUASHFS superblock on loop0

unsquashfs attempt output:

fmk/image_parts# unsquashfs rootfs.img 
Reading a different endian SQUASHFS filesystem on rootfs.img
Parallel unsquashfs: Using 1 processor
336 inodes (377 blocks) to write

[=============================|                                                                                  ]  99/377  26%
gzip uncompress failed with error code -3

Failed to write squashfs-root/lib/libqueue.so, skipping
[=============================|                                                                                  ] 100/377  26%
gzip uncompress failed with error code -3

gzip uncompress failed with error code -3

gzip uncompress failed with error code -3

...


Failed to write squashfs-root/lib/modules/2.6.8.1/extra/blaa_dd.ko, skipping
[====================================|                                                                           ] 123/377  32%
gzip uncompress failed with error code -3

gzip uncompress failed with error code -3

...

Failed to write squashfs-root/webs/management/ui_password.html, skipping
[========================================================|                                                       ] 191/377  50%
gzip uncompress failed with error code -3

Failed to write squashfs-root/webs/index.html, skipping
[========================================================|                                                       ] 192/377  50%
gzip uncompress failed with error code -3

...


Failed to write squashfs-root/usr/sbin/brctl, skipping
[===============================================================================================================|] 377/377 100%
created 188 files
created 46 directories
created 52 symlinks
created 95 devices
created 1 fifos

i searched "error code -3", it is Z_DATA_ERROR ( data is corrupted or incomplete ). now what should i do?

thanks

Answer 1

Bcm63xx firmware images has a special format like squashfs-lzma. i got some tools to extract firmware images named bcm tools (brfwmod.exe). It has a command named lzma-unsquash. i successfully unaquash it with theese tools.