2025-12-22 03:54:38 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文详细分析了TD路由器AX3000_Pro_V16.03.49.26固件，发现固件经过了修改，squashfs的SQUASHFS_MAGIC由hsqs更改为nice，xz的lzma_header_magic由ý7zXZ更改为Tenda。作者通过编译OpenWRT源码生成带符号的内核文件，用于IDA分析，并提供了修改xz-5.2.5和squashfs-tools源码的补丁，成功解压了固件。文章提供了完整的技术路径和代码补丁，对于路由器固件分析具有实用价值。 综合评分： 93 文章分类： 二进制安全,漏洞分析,逆向分析,IoT安全,安全工具

cover_image

TD路由器固件分析

易之生生

看雪学苑

2025年12月19日 17:59 上海

环境配置

版本 :AX3000_Pro_V16.03.49.26

源码 :openwrt

#

固件分析

首先使用binwalk -E分析固件的熵，虽然已经解密了，但是固件的格式binwalk无法有效的识别。

binwalk&nbsp;US_AX3000.Pro_V16.03.49.26_cn_JAX01.bin

DECIMAL&nbsp; &nbsp; &nbsp; &nbsp;HEXADECIMAL&nbsp; &nbsp; &nbsp;DESCRIPTION
--------------------------------------------------------------------------------
64&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0x40&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Flattened&nbsp;device&nbsp;tree,&nbsp;size:3625955&nbsp;bytes,&nbsp;version:17
296&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0x128&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LZMA&nbsp;compressed&nbsp;data,&nbsp;properties:0x6D,&nbsp;dictionary size:8388608&nbsp;bytes,&nbsp;uncompressed size:10719240&nbsp;bytes
3607560&nbsp; &nbsp; &nbsp; &nbsp;0x370C08&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Flattened&nbsp;device&nbsp;tree,&nbsp;size:16962&nbsp;bytes,&nbsp;version:17
5273660 &nbsp; &nbsp; &nbsp; 0x50783C &nbsp; &nbsp; &nbsp; &nbsp;PGP RSA encrypted session key - keyid:3B592D4E&nbsp;D1353F41&nbsp;RSA&nbsp;(Encrypt&nbsp;or&nbsp;Sign)&nbsp;1024b

但是使用file命令，可以识别出u-boot和Linux的内核信息。

file&nbsp;US_AX3000.Pro_V16.03.49.26_cn_JAX01.bin
US_AX3000.Pro_V16.03.49.26_cn_JAX01.bin:u-boot&nbsp;legacy&nbsp;uImage,&nbsp;\002,&nbsp;Linux/ARM,&nbsp;OS&nbsp;Kernel&nbsp;Image&nbsp;(lzma),&nbsp;14553088&nbsp;bytes,&nbsp;Fri&nbsp;Jan&nbsp;10&nbsp;06:24:02&nbsp;2025,&nbsp;Load Address:0X46000000,&nbsp;Entry Point:0XFFFFFFFF,&nbsp;Header CRC:0XB19671AF,&nbsp;Data CRC:0XC47DB558

使用binwalk -Me US_AX3000.Pro_V16.03.49.26_cn_JAX01.bin 解压固件后，得到Linux的内核文件。

binwalk&nbsp;128

DECIMAL &nbsp; &nbsp; &nbsp; HEXADECIMAL &nbsp; &nbsp; DESCRIPTION
--------------------------------------------------------------------------------
0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0x0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Linux kernel ARM64 image, load offset:&nbsp;0x80000, image size:&nbsp;11046912&nbsp;bytes, little endian,&nbsp;4k page size,
5498800&nbsp; &nbsp; &nbsp; &nbsp;0x53E7B0&nbsp; &nbsp; &nbsp; &nbsp; MPEG transport stream data
7561216&nbsp; &nbsp; &nbsp; &nbsp;0x736000&nbsp; &nbsp; &nbsp; &nbsp; ELF,&nbsp;64-bit LSB shared object, version&nbsp;1&nbsp;(SYSV)
7580200&nbsp; &nbsp; &nbsp; &nbsp;0x73AA28&nbsp; &nbsp; &nbsp; &nbsp; gzip compressed data, maximum compression, from Unix,&nbsp;last&nbsp;modified:&nbsp;1970-01-01&nbsp;00:00:00&nbsp;(null date)
7719424&nbsp; &nbsp; &nbsp; &nbsp;0x75CA00&nbsp; &nbsp; &nbsp; &nbsp; CRC32 polynomial table, little endian
7988227&nbsp; &nbsp; &nbsp; &nbsp;0x79E403&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor get requestrequest"
7988277&nbsp; &nbsp; &nbsp; &nbsp;0x79E435&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor get request get request"
7988332&nbsp; &nbsp; &nbsp; &nbsp;0x79E46C&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor get request"
7988601&nbsp; &nbsp; &nbsp; &nbsp;0x79E579&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor get requestrequest"
7988651&nbsp; &nbsp; &nbsp; &nbsp;0x79E5AB&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor get requestest"
7988697&nbsp; &nbsp; &nbsp; &nbsp;0x79E5D9&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor get request"
7988739&nbsp; &nbsp; &nbsp; &nbsp;0x79E603&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor dump requestbor dump request"
7988797&nbsp; &nbsp; &nbsp; &nbsp;0x79E63D&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor dump request dump request"
7988852&nbsp; &nbsp; &nbsp; &nbsp;0x79E674&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor dump request attribute in neighbor dump request"
7988929&nbsp; &nbsp; &nbsp; &nbsp;0x79E6C1&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor dump requeste dump request"
7988979&nbsp; &nbsp; &nbsp; &nbsp;0x79E6F3&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor table dump requestbor table dump request"
7989037&nbsp; &nbsp; &nbsp; &nbsp;0x79E72D&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor table dump request neighbor table dump request"
7989101&nbsp; &nbsp; &nbsp; &nbsp;0x79E76D&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"neighbor table dump request"
7989600&nbsp; &nbsp; &nbsp; &nbsp;0x79E960&nbsp; &nbsp; &nbsp; &nbsp; Neighborly text,&nbsp;"Neighbor entry is now dead"
9111144&nbsp; &nbsp; &nbsp; &nbsp;0x8B0668&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/lib/firmware/updates/5.4.231
9200744&nbsp; &nbsp; &nbsp; &nbsp;0x8C6468&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/mtketh/reset
9208205&nbsp; &nbsp; &nbsp; &nbsp;0x8C818D&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/cpu_reason
9208344&nbsp; &nbsp; &nbsp; &nbsp;0x8C8218&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/cpu_reason
9210484&nbsp; &nbsp; &nbsp; &nbsp;0x8C8A74&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/hnat_entry
9210552&nbsp; &nbsp; &nbsp; &nbsp;0x8C8AB8&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/hnat_entry
9211260&nbsp; &nbsp; &nbsp; &nbsp;0x8C8D7C&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/hnat_setting
9211336&nbsp; &nbsp; &nbsp; &nbsp;0x8C8DC8&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/hnat_setting
9213298&nbsp; &nbsp; &nbsp; &nbsp;0x8C9572&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/static_entry
9214074&nbsp; &nbsp; &nbsp; &nbsp;0x8C987A&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/qos_toggle
9214151&nbsp; &nbsp; &nbsp; &nbsp;0x8C98C7&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/qos_toggle
9214239&nbsp; &nbsp; &nbsp; &nbsp;0x8C991F&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/qos_toggle
9214334&nbsp; &nbsp; &nbsp; &nbsp;0x8C997E&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/qos_toggle
9214440&nbsp; &nbsp; &nbsp; &nbsp;0x8C99E8&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/qos_toggle
9214535&nbsp; &nbsp; &nbsp; &nbsp;0x8C9A47&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/qos_toggle
9214623&nbsp; &nbsp; &nbsp; &nbsp;0x8C9A9F&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/kernel/debug/hnat/qos_toggle
9319056&nbsp; &nbsp; &nbsp; &nbsp;0x8E3290&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/firmware/devicetree/base
9320161&nbsp; &nbsp; &nbsp; &nbsp;0x8E36E1&nbsp; &nbsp; &nbsp; &nbsp; Unix path:&nbsp;/sys/firmware/fdt': CRC check failed
9333281 &nbsp; &nbsp; &nbsp; 0x8E6A21 &nbsp; &nbsp; &nbsp; &nbsp;Neighborly text, "neighbor table overflow!app_solicit"
9367608 &nbsp; &nbsp; &nbsp; 0x8EF038 &nbsp; &nbsp; &nbsp; &nbsp;Neighborly text, "NeighborSolicits"
9367632 &nbsp; &nbsp; &nbsp; 0x8EF050 &nbsp; &nbsp; &nbsp; &nbsp;Neighborly text, "NeighborAdvertisementsErrors"
9372050 &nbsp; &nbsp; &nbsp; 0x8F0192 &nbsp; &nbsp; &nbsp; &nbsp;Neighborly text, "neighbor %.2x%.2x.%pM losthas been deprecated and is always %u"
9386416 &nbsp; &nbsp; &nbsp; 0x8F39B0 &nbsp; &nbsp; &nbsp; &nbsp;Unix path: /sys/module/wifi_core/parameters/wifi_driver_debug
10257728 &nbsp; &nbsp; &nbsp;0x9C8540 &nbsp; &nbsp; &nbsp; &nbsp;AES S-Box
10257984 &nbsp; &nbsp; &nbsp;0x9C8640 &nbsp; &nbsp; &nbsp; &nbsp;AES Inverse S-Box

IDA ARM64位的方式打开128固件，虽然可以搜索到大量的squashf函数字符串，但是都无法查看调用地址和引用地址。

这时就可以使用openwrt的源码来编译生成带符号链接的内核文件，然后生成签名文件，导入到IDA进行函数重命名。

内核编译

首先收集内核配置信息，发现固件是基于f86f8e568461681fc85caf3c972489045367030e版本生成的。

下载openwrt源码

git&nbsp;clone&nbsp;https://github.com/openwrt/openwrt.git
cd&nbsp;openwrt
git checkout openwrt-21.02
git checkout f86f8e568461681fc85caf3c972489045367030e

安装编译环境

sudo apt-get&nbsp;install subversion g++ zlib1g-dev build-essential git python3 libncurses5-dev gawk gettext unzip libssl-dev wget

下载安装软件包

./scripts/feeds update -a
./scripts/feeds install -a

生成.config配置文件，然后进入配置选项。

make&nbsp;defconfig
make&nbsp;menuconfig

在Global build settings中，选择Binary stripping method为none来保留符号编译。

保存退出后运行make来编译固件。

make&nbsp;-j8 V=s

将vmlinux.debug导出到Windows系统，使用IDA打开生成vmlinux.sig签名文件,即可还原函数名称。

find . -name vmlinux.debug
./build_dir/target-aarch64_cortex-a53_musl/linux-armvirt_64/vmlinux.debug

#

格式分析

跳转到固件地址0x380040,原来的squashfs的SQUASHFS_MAGIC由hsqs更变为了nice，xz的lzma_header_magic由ý7zXZ更变为了Tenda。

#

squashfs的SQUASHFS_MAGIC判断是在mtd_check_rootfs_magic函数中，但是因为源码经过了修改，找不到mtd_check_rootfs_magic函数，可以通过mtd_check_oob_ops的引用找到sub_3AC088。

xz的lzma_header_magic是在xz_dec_run中判断的，源码经过了修改，可以通过xz_dec_reset的引用找到，是sub_2B0DC0函数。

进入crc32_le_0_0,发现crc32_table的值发生了改变。

#

代码补丁

xz-5.2.5

xz-5.2.5的源码目录是./build_dir/host/xz-5.2.5

coder.c

374c374,375
<&nbsp;    static&nbsp;const&nbsp;uint8_t&nbsp;magic[6]&nbsp;=&nbsp;{&nbsp;0xFD,&nbsp;0x37,&nbsp;0x7A,&nbsp;0x58,&nbsp;0x5A,&nbsp;0x00&nbsp;};
---
>&nbsp;    //&nbsp;static&nbsp;const&nbsp;uint8_t&nbsp;magic[6]&nbsp;=&nbsp;{&nbsp;0xFD,&nbsp;0x37,&nbsp;0x7A,&nbsp;0x58,&nbsp;0x5A,&nbsp;0x00&nbsp;};
>&nbsp;    static&nbsp;const&nbsp;uint8_t&nbsp;magic[6]&nbsp;=&nbsp;{&nbsp;0x54,&nbsp;0x65,&nbsp;0x6E,&nbsp;0x64,&nbsp;0x61,&nbsp;0x00&nbsp;};

stream_flags_common.c

15,16c15,16
<
<&nbsp;const&nbsp;uint8_t&nbsp;lzma_header_magic[6]&nbsp;=&nbsp;{&nbsp;0xFD,&nbsp;0x37,&nbsp;0x7A,&nbsp;0x58,&nbsp;0x5A,&nbsp;0x00&nbsp;};
---
>&nbsp;//&nbsp;const&nbsp;uint8_t&nbsp;lzma_header_magic[6]&nbsp;=&nbsp;{&nbsp;0xFD,&nbsp;0x37,&nbsp;0x7A,&nbsp;0x58,&nbsp;0x5A,&nbsp;0x00&nbsp;};
>&nbsp;const&nbsp;uint8_t&nbsp;lzma_header_magic[6]&nbsp;=&nbsp;{&nbsp;0x54,&nbsp;0x65,&nbsp;0x6E,&nbsp;0x64,&nbsp;0x61,&nbsp;0x00&nbsp;};

crc32_table_le.h

5,523c5,523
<         0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA,
<         0x076DC419, 0x706AF48F, 0xE963A535, 0x9E6495A3,
<         0x0EDB8832, 0x79DCB8A4, 0xE0D5E91E, 0x97D2D988,
<         0x09B64C2B, 0x7EB17CBD, 0xE7B82D07, 0x90BF1D91,
<         0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
<         0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7,
<         0x136C9856, 0x646BA8C0, 0xFD62F97A, 0x8A65C9EC,
<         0x14015C4F, 0x63066CD9, 0xFA0F3D63, 0x8D080DF5,
<         0x3B6E20C8, 0x4C69105E, 0xD56041E4, 0xA2677172,
<         0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
<         0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940,
<         0x32D86CE3, 0x45DF5C75, 0xDCD60DCF, 0xABD13D59,
<         ...省略,更多请“阅读原帖”

squashfs-tools

squashfs-tools的源码路径是./build_dir/host/squashfskit-v4.14/squashfs-tools

修改squashfs-tools的Makefile，将XZ_SUPPORT = 1，引入liblzma.a的静态库路径。

XZ_SUPPORT = 1
LZMA_LIB := ../../xz-5.2.5/src/liblzma/.libs/liblzma.a

修改squashfs_fs.h头文件的SQUASHFS_MAGIC为0x6563696E。

#define&nbsp;SQUASHFS_CACHED_FRAGMENTS &nbsp; &nbsp; &nbsp; CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE
#define&nbsp;SQUASHFS_MAJOR &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;4
#define&nbsp;SQUASHFS_MINOR &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0
//#define SQUASHFS_MAGIC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0x73717368
#define&nbsp;SQUASHFS_MAGIC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0x6563696E
//#define SQUASHFS_MAGIC_SWAP &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x68737173
#define&nbsp;SQUASHFS_MAGIC_SWAP &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0x6E696365
#define&nbsp;SQUASHFS_START &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0

#

固件解压

首先编译xz-5.2.5的静态库文件。

#

cd&nbsp;./build_dir/host/xz-5.2.5
./configure
make

然后编译生成unsquashfs程序。

cd&nbsp;./build_dir/host/squashfskit-v4.14/squashfs-tools
make

使用dd命令从0x380040开始导出固件文件US_AX3000.squashfs，然后就可以使用编译好的unsquashfs程序进行解压了。

./unsquashfs US_AX3000.squashfs
Parallel unsquashfs: Using&nbsp;10&nbsp;processors
879&nbsp;inodes (998&nbsp;blocks) to write

create_inode: could&nbsp;not&nbsp;create character device squashfs-root/dev/console, because you're not superuser!

create_inode: could not create character device squashfs-root/dev/ttyAMA0, because you're&nbsp;not&nbsp;superuser!

create_inode: could&nbsp;not&nbsp;create character device squashfs-root/dev/ttyS0, because you're not superuser!

create_inode: could not create character device squashfs-root/dev/ttyS1, because you're&nbsp;not&nbsp;superuser!

create_inode: could&nbsp;not&nbsp;create character device squashfs-root/dev/ttyS2, because you're not superuser!

create_inode: could not create character device squashfs-root/dev/ttyS3, because you're&nbsp;not&nbsp;superuser!

create_inode: could&nbsp;not&nbsp;create character device squashfs-root/dev/ttyS4, because you're not superuser!
[==========================================================================================================================================| ] 991/998 &nbsp;99%

created 697 files
created 97 directories
created 175 symlinks
created 0 devices
created 0 fifos