SL3000/SL8500 bfe Snapshot unpacking
Disclaimer: there is NO password provided somewhere in the post, you need to get actual firmware/microcode and do some steps manually. Also you need carefuly read the f.cking manuals provided by vendor, manufacturer, ODM or OEM vendor to avoid getting some unexpected results before run any commands or apply any configurations. All steps provided is abnormal and should not be used in prod environment. In some extraodinry cases you simply ruin your whole installation ;)
# you can install this tools OR just use 7z for cramfs unpacking and loop mount for initrd
# also you dont need to unpack initrd
# skip this step if you only keys
trizen -S e2tools cramfs-tools # AUR
# ... or just p7zip
trizen -S p7zip
mkdir sl3000_fw && cd sl3000_fw
7z x sl3000/FRS_x.yy/SL3000_FRSxyy_firmware.jar
Check-in:
$ binwalk controller.cramfs
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x8D6ABC11, created: 2019-12-18 20:35:30, image size: 5849088 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x6B53CEFC, OS: Linux, CPU: PowerPC, image type: Filesystem Image, compression type: none, image name: "controller.cramfs 8.36.01"
64 0x40 CramFS filesystem, big endian, size 5849088, version 2, sorted_dirs, CRC 0x9643B574, edition 0, 3017 blocks, 364 files
$ # just if you want to check some steps, you don't need this for unpacking
$ binwalk disk.hbc.pImage
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x5D23CEA2, created: 2019-11-25 18:47:47, image size: 1605099 bytes, Data Address: 0xFFFFFFFF, Entry Point: 0xFFFFFFFF, data CRC: 0x991CE92F, OS: Linux, CPU: PowerPC, image type: RAMDisk Image, compression type: gzip, image name: "disk.hbc.pImage 8.30.07"
64 0x40 gzip compressed data, maximum compression, has original file name: "initrd.img", from Unix, last modified: 2019-11-25 18:47:45
Prepare images, extracting files:
dd if=controller.cramfs of=controller.cramfs.initrd.img skip=64 iflag=skip_bytes
7z x controller.cramfs.initrd.img
# skip this step if you need keys only
dd if=disk.hbc.pImage of=disk.hbc.pImage.initrd.gz skip=64 iflag=skip_bytes
7z x disk.hbc.pImage.initrd.gz
e2ls initrd.img:/usr/bin/log_snapshot # e2tools
e2cp initrd.img:/usr/bin/log_snapshot . # e2tools
Check keys for bcrypt:
egrep -v "BEGIN|END" keys/sl3000_license2048.pem | awk '{print}' ORS='' ; echo
Download http://bcrypt.sourceforge.net bcrypt, use key you got in last step.
tar xfz ~/downloads/bcrypt-1.1.tar.gz
cd bcrypt-1.1 && make && cd ..
cp ../SL3000_571000abcdef_Thu_Apr_29_2021_UTC_12_37_37_logs.tar.bfe .
mkdir SL3000_571000abcdef_Thu_Apr_29_2021_UTC_12_37_37_logs && egrep -v "BEGIN|END" keys/sl3000_license2048.pem | \
awk '{print}' ORS='' | \
./bcrypt-1.1/bcrypt -o SL3000_571000abcdef_Thu_Apr_29_2021_UTC_12_37_37_logs.tar.bfe > \
SL3000_571000abcdef_Thu_Apr_29_2021_UTC_12_37_37_logs/SL3000_571000abcdef_Thu_Apr_29_2021_UTC_12_37_37_logs.tar
Happy troubleshooting!