Giters

onekey-sec / ubi_reader

Collection of Python scripts for reading information about and extracting data from UBI and UBIFS images.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

ubireader_display_info displays information about the ubi file but I can't extract them

DMirror opened this issue · comments

commented

Hello Jason,

I have a problem here and wanted to ask you if you might know what I can do to fix this.
I dumped the content of a NAND flash. Binwalk extracted an ubi file from the dump and when I used ubireader_display_info I got the following output:

`UBI File

Min I/O: 2048
LEB Size: 126976
PEB Size: 131072
Total Block Count: 847
Data Block Count: 377
Layout Block Count: 2
Internal Volume Block Count: 468
Unknown Block Count: 0
First UBI PEB Number: 10

Image: 1681423409
---------------------
	Image Sequence Num: 1681423409
	Volume Name:spare
	Volume Name:data1
	Volume Name:root1
	Volume Name:root0
	Volume Name:data0
	PEB Range: 0 - 855

	Volume: spare
	---------------------
		Vol ID: 4
		Name: spare
		Block Count: 142

		Volume Record
		---------------------
			alignment: 1
			crc: '0x743003a9'
			data_pad: 0
			errors: ''
			flags: 0
			name: u'spare'
			name_len: 5
			padding: u'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
			rec_index: 4
			reserved_pebs: 386
			upd_marker: 0
			vol_type: 'dynamic'


	Volume: data1
	---------------------
		Vol ID: 3
		Name: data1
		Block Count: 8

		Volume Record
		---------------------
			alignment: 1
			crc: '0xefc3e0d'
			data_pad: 0
			errors: ''
			flags: 0
			name: u'data1'
			name_len: 5
			padding: u'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
			rec_index: 3
			reserved_pebs: 34
			upd_marker: 0
			vol_type: 'dynamic'


	Volume: root1
	---------------------
		Vol ID: 1
		Name: root1
		Block Count: 110

		Volume Record
		---------------------
			alignment: 1
			crc: '0x4a7089bd'
			data_pad: 0
			errors: ''
			flags: 0
			name: u'root1'
			name_len: 5
			padding: u'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
			rec_index: 1
			reserved_pebs: 232
			upd_marker: 0
			vol_type: 'dynamic'


	Volume: root0
	---------------------
		Vol ID: 0
		Name: root0
		Block Count: 108

		Volume Record
		---------------------
			alignment: 1
			crc: '0x38a2ed27'
			data_pad: 0
			errors: ''
			flags: 0
			name: u'root0'
			name_len: 5
			padding: u'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
			rec_index: 0
			reserved_pebs: 232
			upd_marker: 0
			vol_type: 'dynamic'


	Volume: data0
	---------------------
		Vol ID: 2
		Name: data0
		Block Count: 9

		Volume Record
		---------------------
			alignment: 1
			crc: '0x7c2e5a97'
			data_pad: 0
			errors: ''
			flags: 0
			name: u'data0'
			name_len: 5
			padding: u'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
			rec_index: 2
			reserved_pebs: 34
			upd_marker: 0
			vol_type: 'dynamic'`

This looked promising to me. The problem is when I try to extract the files with ubireader_extract_files I receive an error message:

Extracting files to: ubifs-root/1681423409/spare extract_files Error: No inodes found Extracting files to: ubifs-root/1681423409/data1 read Error: LEB: 10 is corrupted or has no data. extract_files Error: 1 UBIFS Fatal: Super block error: Wrong node type.

Is it possible that the dump itself is incomplete and if that is the case can I do something to extract files anyways without having to dump it again?

commented
commented

Hello Jason,

I removed the OOB Bytes before using the tool and I also used the -w flag. The error message that you can see in my first post was the output with -w flag.
As far as my knowledge goes the filesystem that is used on top of UBI is SquashFS.
To be more specific the idea is to get the content of the SquashFS filesystem but I can't extract the files because it is on top of ubi which seems to be a problem for unsquash and sasquatch.

Also the NAND flash that I work with has internal ECC enabled. In the datasheet it sais "During a READ operation, the page data is read from the array to the cache register, where the ECC code is calculated and compared with the ECC code value read from the array. If error bits are detected, the error is corrected in the cache register. Only corrected data is output on the I/O bus."
Since the NAND flash is powered up and I perform several read operations to dump the conent this should be not an issue I guess.

Do you think that the tools from the test branch could deal with this problem?

commented
commented

Hey,

thank you fo your help. I could use the extract images script and I found indeed a SquashFS filesystem within.
Still having trouble in reading it but that is an other problem.
Thank you for your time.