dumpifs-linux

This is a dirty hack of QNX's dumpifs utility, intended for use on non-QNX Linux systems. A compiled x86-64 ELF is included in the repository, along with the resources to compile the tool on a system without the QNX SDP.

Credit: This tool was originally forked from askac's dumpifs hack, with sickcodes' contributions merged in. I decided to create my own fork after the original one went dormant in 2020.

Running dumpifs

A compiled x86-64 ELF has been included in the repository. To run it, it must first be made executable:

git clone git@github.com:ttepatti/dumpifs-linux.git
cd dumpifs-linux/
chmod +x dumpifs
./dumpifs

Example Usage

View IFS File Structure: dumpifs <image.ifs>

Decompress IFS and write to a new file: dumpifs -u <image_uncompressed.ifs> <image.ifs>

Extract all files from IFS to current directory: dumpifs -b -x <image.ifs>

Options

dumpifs - dump an image file system
dumpifs	[-mvxbz -u file] [-f file] image_file_system_file [files]
 -b           Extract to basenames of files
 -u file      Put a copy of the uncompressed image file here
 -d directory The directory to which to extract files. The default is the current working directory. 
 -v           Verbose
 -x           Extract files
 -m           Display MD5 Checksum
 -f file      Extract named file
 -z           Disable the zero check while searching for the startup header.
              This option should be avoided as it makes the search for the
              startup header less reliable.
              Note: this may not be supported in the future.

Additional documentation about dumpifs may be found on the QNX Developer Docs Website.

Building dumpifs

Install Requirements:

sudo apt install liblzo2-dev libucl-dev

Build Instructions:

git clone git@github.com:ttepatti/dumpifs-linux.git
cd dumpifs-linux/
rm dumpifs
make

The rm command is used to remove the existing binary distributed alongside the source code.

dumpifs-folderized.sh

In addition to the basic dumpifs tool, this repository contains the dumpifs-folderized.sh script.

This script creates a folderized IFS dump, preserving the directory structure of the IFS file (which is usually lost when using dumpifs alone)

Usage: dumpifs-folderized.sh <image.ifs>

This script was originally contributed by sickcodes and created by bertelsmann.

Specific Use Cases

MIB2 Firmware IFS Extraction and Modification

This information has been paraphrased from the original dumpifs repo, and is courtesy of askac:

For those who are interested in hacking MIB2 firmware, the compress tool only supports ucl and lzo compressed images. Use this tool at your own risk.

Basic Idea

Get firmware *.ifs.
Get an decompressed image copy by -u command
Modify the decompressed image using hex editor to bypass login (for example, the login script)
Compress the modified image by uuu or zzz (depends on original modified type)
Use dd to repack it, verify using dumpifs again (some padding bytes may need to be manually added). You can also use the helper script to do that
Get into IPL, rz to retrive the modified ifs and get into the emergency shell. You might want to kill MIBEmergency (directly modify the binary by hex editor or slay command after boot) to stop the emergency boot after seconds which will lock you out again. or you can replace the original shadow file in system with yours.

Reference

The original code is from https://github.com/vocho/openqnx

ttepatti / dumpifs-linux