Skip to content

Instantly share code, notes, and snippets.

@bmaia
Created November 9, 2013 14:57
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bmaia/f095fde8cde3dcd2c74b to your computer and use it in GitHub Desktop.
Save bmaia/f095fde8cde3dcd2c74b to your computer and use it in GitHub Desktop.
Extract LZMA sections from cable modem firmware images
#!/usr/bin/python
import os, sys
from binwalk import Binwalk
def lzma_callback(offset, results):
for result in results:
if result['description'].startswith('LZMA compressed data, properties: 0x5D'):
with open(sys.argv[1]) as f:
f.seek(result['offset'])
lzma_header = f.read(5)
uncompressed_size = '\x00\x00\x00\x10\x00\x00\x00\x00'
data = f.read()
output = open(sys.argv[1]+'.lzma', 'w')
output.write(lzma_header+uncompressed_size+data)
f.close()
if __name__ == '__main__':
nargs = len(sys.argv)
if nargs != 2:
print '\
\nLZMA Unpacker: Extract LZMA sections from firmware images\n\
\nTested with the following Cable Modems:\n\
- Cisco DPC3925, DPC2434\n\
- Motorola SB5100, SB5101, SVG6582, SVG1202\n\
- Thomson ACG905, DCM425, DHG534, DHG544, DWG850, DWG874\n\
- Webstar DPC2203\n\
\nBernardo Rodrigues, http://w00tsec.blogspot.com\n\
\nUsage: %s firmware_image.bin' % os.path.basename(sys.argv[0])+'\n'
else:
with Binwalk() as bw:
try:
with open(sys.argv[1], 'rb'):
bw.display.header()
bw.scan(sys.argv[1], callback=lzma_callback, show_invalid_results=True)
try:
with open(sys.argv[1]+'.lzma', 'rb'):
bw.extractor.add_rule('lzma:7z:7zr e -y %e')
bw.scan(sys.argv[1]+'.lzma', callback=bw.display.results)
except Exception:
print 'LZMA 0x5D signature not found'
exit
except IOError:
print 'File not found: '+sys.argv[1]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment