小米ax6000路由器固件分析

johnnyit

固件分析用到的工具 binwalk、ubi_reader、unsquashfs
1. 解压固件

ubireader_extract_images   miwifi_ra72_firmware_59812_1.0.41.bin

复制代码

UBI_File Warning: end_offset - start_offset length is not block aligned, could mean missing data.

2.进入目录准备

cd ubifs-root/&&ls -FR

复制代码

miwifi_ra72_firmware_59812_1.0.41.bin/

./miwifi_ra72_firmware_59812_1.0.41.bin:

img-1961083533_vol-kernel.ubifs                img-1961083533_vol-ubi_rootfs.ubifs

3.提取固件内容： 文件img-1961083533_vol-ubi_rootfs.ubifs为系统文件

cd miwifi_ra72_firmware_59812_1.0.41.bin/

复制代码

unsquashfs img-1961083533_vol-ubi_rootfs.ubifs

复制代码

Parallel unsquashfs: Using 8 processors

4075 inodes (3772 blocks) to write

create_inode: could not create character device squashfs-root/dev/console, because you're not superuser!

[===============================================================================================================================| ] 7846/7847  99%

created 3605 files

created 260 directories

created 469 symlinks

created 0 devices

created 0 fifos

created 0 sockets

created 0 hardlinks

提取完成；squashfs-root文件夹下的内容即为路由器系统文件；
接下来可以查看系统代码了；
反编译lua文件需要用到https://github.com/NyaMisty/unluac_miwifi

java -jar ./unluac.jar XQBackup.lua > XQBackup2.lua

ciasdmxhxjjpd@c

so, 发现漏洞了没有，如何利用啊

johnnyit

有兴趣的可以根据源码再找找其他功能