{"id":19615240,"url":"https://github.com/leonrinkel/laughing-parakeet","last_synced_at":"2026-03-03T15:34:36.550Z","repository":{"id":97000967,"uuid":"49366680","full_name":"leonrinkel/laughing-parakeet","owner":"leonrinkel","description":null,"archived":false,"fork":false,"pushed_at":"2016-01-10T14:49:13.000Z","size":4520,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-09T10:34:47.645Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/leonrinkel.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-01-10T12:52:47.000Z","updated_at":"2020-10-06T07:02:46.000Z","dependencies_parsed_at":"2023-03-13T16:20:08.837Z","dependency_job_id":null,"html_url":"https://github.com/leonrinkel/laughing-parakeet","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leonrinkel%2Flaughing-parakeet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leonrinkel%2Flaughing-parakeet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leonrinkel%2Flaughing-parakeet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/leonrinkel%2Flaughing-parakeet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/leonrinkel","download_url":"https://codeload.github.com/leonrinkel/laughing-parakeet/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240907142,"owners_count":19876684,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T10:55:55.060Z","updated_at":"2026-03-03T15:34:31.502Z","avatar_url":"https://github.com/leonrinkel.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# laughing-parakeet\n\nI am trying to build my own Linux derivative to run on an TI-AR7 board. I took the board from an old Telekom Speedport W 501V router. To understand how firmware is flashed onto the device I have downloaded the most recent [official firmware](https://www.telekom.de/hilfe/geraete-zubehoer/router/weitere-router/speedport-w-5xx-serie/speedport-w-501v?samChecked=true). Using the Linux ```file``` command I determined the image is a tar archive, which can be extracted easily.\n\n```\nubuntu@ip-172-31-23-210:~/reverse$ ls\nfw_speedport_w501v_v_28.04.38.image\nubuntu@ip-172-31-23-210:~/reverse$ file fw*\nfw_speedport_w501v_v_28.04.38.image: POSIX tar archive (GNU)\nubuntu@ip-172-31-23-210:~/reverse$ tar -xvf fw*\n./var/\n./var/tmp/\n./var/tmp/kernel.image\n./var/tmp/filesystem.image\n./var/flash_update.ko\n./var/flash_update.o\n./var/info.txt\n./var/install\n./var/chksum\n./var/regelex\n./var/signature\nubuntu@ip-172-31-23-210:~/reverse$\n```\n\nAccording to a [wiki (Firmware-Image)](http://www.wehavemorefun.de/fritzbox/Firmware-Image) that I have found, ```./var/tmp/kernel.image``` contains the actual firmware. During the update process this image is written to the ```mtd1``` device. As stated in the [wiki (LZMA-Kernel)](http://www.wehavemorefun.de/fritzbox/LZMA-Kernel) the lzma compressed kernel starts with the magic number ```0xfeed1281```. A hexdump of  ```kernel.image``` contains that number at its beginning.\n\n```\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ hexdump -n 4 kernel.image\n0000000 1281 feed\n0000004\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$\n```\n\nThe following script given on the last wiki entry should decompress the kernel.\n\n```perl\n#! /usr/bin/perl\n\nuse Compress::unLZMA;\nuse Archive::Zip;\n\nopen INPUT, \"\u003c$ARGV[0]\" or die \"can't open $ARGV[0]: $!\";\n\nread INPUT, $buf, 4;\n$magic = unpack(\"V\", $buf);\nif ($magic != 0xfeed1281) {\n  die \"bad magic\";\n}\n\nread INPUT, $buf, 4;\n$len = unpack(\"V\", $buf);\n\nread INPUT, $buf, 4*2; # address, unknown\n\nread INPUT, $buf, 4;\n$clen = unpack(\"V\", $buf);\nread INPUT, $buf, 4;\n$dlen = unpack(\"V\", $buf);\nread INPUT, $buf, 4;\n$cksum = unpack(\"V\", $buf);\nprintf \"Archive checksum: 0x%08x\\n\", $cksum;\n\nread INPUT, $buf, 1+4; # properties, dictionary size\nread INPUT, $dummy, 3; # alignment\n$buf .= pack('VV', $dlen, 0); # 8 bytes of real size\n#$buf .= pack('VV', -1, -1); # 8 bytes of real size\nread INPUT, $buf2, $clen;\n\n$crc = Archive::Zip::computeCRC32($buf2);\nprintf \"Input CRC32: 0x%08x\\n\", $crc;\nif ($cksum != $crc) {\n  die \"wrong checksum\";\n}\n$buf .= $buf2;\n\n$data = Compress::unLZMA::uncompress($buf);\nunless (defined $data) {\n  die \"uncompress: $@\";\n}\n\nopen OUTPUT, \"\u003e$ARGV[1]\" or die \"can't write $ARGV[1]\";\nprint OUTPUT $data;\n#truncate OUTPUT, $dlen;\n```\n\nTo use the script you may need to install [Compress::unLZMA](http://search.cpan.org/~ferreira/Compress-unLZMA-0.04/lib/Compress/unLZMA.pm) and [Archive::Zip](http://search.cpan.org/~phred/Archive-Zip-1.56/lib/Archive/Zip.pm) perl modules.\n\n```\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ tar -xvf Compress*\nCompress-unLZMA-0.04/\nCompress-unLZMA-0.04/Makefile.PL\nCompress-unLZMA-0.04/ppport.h\nCompress-unLZMA-0.04/Changes\nCompress-unLZMA-0.04/lzma_sdk/\n[...]\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ cd Compress*\nubuntu@ip-172-31-23-210:~/reverse/var/tmp/Compress-unLZMA-0.04$ perl Makefile.PL\nChecking if your kit is complete...\nLooks good\nWriting Makefile for Compress::unLZMA\nWriting MYMETA.yml and MYMETA.json\nubuntu@ip-172-31-23-210:~/reverse/var/tmp/Compress-unLZMA-0.04$ make\ncp lib/Compress/unLZMA.pm blib/lib/Compress/unLZMA.pm\n/usr/bin/perl /usr/share/perl/5.18/ExtUtils/xsubpp  -typemap /usr/share/perl/5.18/ExtUtils/typemap  unLZMA.xs \u003e unLZMA.xsc \u0026\u0026 mv unLZMA.xsc unLZMA.c\ncc -c  -I. -Ilzma_sdk/Source -D_REENTRANT -D_GNU_SOURCE\n[...]\nubuntu@ip-172-31-23-210:~/reverse/var/tmp/Compress-unLZMA-0.04$ sudo make install\nFiles found in blib/arch: installing files in blib/lib into architecture dependent library tree\nInstalling /usr/local/lib/perl/5.18.2/auto/Compress/unLZMA/unLZMA.bs\nInstalling /usr/local/lib/perl/5.18.2/auto/Compress/unLZMA/unLZMA.so\nInstalling /usr/local/lib/perl/5.18.2/Compress/unLZMA.pm\nInstalling /usr/local/man/man3/Compress::unLZMA.3pm\nAppending installation info to /usr/local/lib/perl/5.18.2/perllocal.pod\nubuntu@ip-172-31-23-210:~/reverse/var/tmp/Compress-unLZMA-0.04$ # same for Archive::Zip module\n```\n\nAfter installing these dependencies the script decompressed the kernel successfully.\n\n```\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ ./decompress.pl kernel.image kernel.decompressed\nArchive checksum: 0x29176e12\nInput CRC32: 0x29176e12\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$\n```\n\nBut what kind of file is ```kernel.decompressed``` and how do I generate a similar file from my Linux kernel source? I continued analyzing it using ```file``` and [binwalk](https://github.com/devttys0/binwalk).\n\n```\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ file kernel.decompressed\nkernel.decompressed: data\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ binwalk kernel.decompressed\n\nDECIMAL       HEXADECIMAL     DESCRIPTION\n--------------------------------------------------------------------------------\n1509632       0x170900        Linux kernel version \"2.6.13.1-ohio (686) (gcc version 3.4.6) #9 Wed Apr 4 13:48:08 CEST 2007\"\n1516240       0x1722D0        CRC32 polynomial table, little endian\n1517535       0x1727DF        Copyright string: \"Copyright 1995-1998 Mark Adler \"\n1549488       0x17A4B0        Unix path: /usr/gnemul/irix/\n1550920       0x17AA48        Unix path: /usr/lib/libc.so.1\n1618031       0x18B06F        Neighborly text, \"neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)\"\n1966080       0x1E0000        gzip compressed data, maximum compression, from Unix, last modified: 2007-04-04 11:45:13\n\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$\n```\n\nSo the Linux kernel starts at ```1509632``` and ends at ```1516240```. What kind of data is stored in front the Linux kernel (```0``` to ```1509632```)? I extracted the kernel and that piece of unknown data using ```dd```.\n\n```\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ dd if=kernel.decompressed of=unknown.data bs=1 count=1509632\n1509632+0 records in\n1509632+0 records out\n1509632 bytes (1.5 MB) copied, 1.62137 s, 931 kB/s\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ dd if=kernel.decompressed of=kernel bs=1 skip=1509632 count=6608\n6608+0 records in\n6608+0 records out\n6608 bytes (6.6 kB) copied, 0.0072771 s, 908 kB/s\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$\n```\n\nI need to ask again: What kind of file is ```kernel``` and how do I generate a similar file from my Linux kernel source? I used ```xxd``` and ```strings``` to look at the file more closely.\n\n```\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ xxd -l 100 kernel\n0000000: 4c69 6e75 7820 7665 7273 696f 6e20 322e  Linux version 2.\n0000010: 362e 3133 2e31 2d6f 6869 6f20 2836 3836  6.13.1-ohio (686\n0000020: 2920 2867 6363 2076 6572 7369 6f6e 2033  ) (gcc version 3\n0000030: 2e34 2e36 2920 2339 2057 6564 2041 7072  .4.6) #9 Wed Apr\n0000040: 2034 2031 333a 3438 3a30 3820 4345 5354   4 13:48:08 CEST\n0000050: 2032 3030 370a 0000 0000 0000 0000 0000   2007...........\n0000060: 0000 0000                                ....\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$ strings kernel\nLinux version 2.6.13.1-ohio (686) (gcc version 3.4.6) #9 Wed Apr 4 13:48:08 CEST 2007\ndo_be\ndo_bp\ndo_tr\ndo_ri\ndo_cpu\nnmi_exception_handler\ndo_ade\nemulate_load_store_insn\ndo_page_fault\ncontext_switch\n__put_task_struct\ndo_exit\nlocal_bh_enable\nrun_workqueue\n2.6.13.1-ohio gcc-3.4\nenable_irq\n__free_pages_ok\nfree_hot_cold_page\nprep_new_page\nkmem_cache_destroy\nkmem_cache_create\npageout\nvunmap_pte_range\nvmap_pte_range\n__vunmap\n__brelse\nsync_dirty_buffer\nbio_endio\nqueue_kicked_iocb\nproc_get_inode\nremove_proc_entry\nsysfs_get\nsysfs_fill_super\nkref_get\nkref_put\n0123456789abcdefghijklmnopqrstuvwxyz\n0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ\nvsnprintf\n{zt^f\npw0Gm\n0cIZ-\n68BG+\nQC]S%\nv,;Zk\nubuntu@ip-172-31-23-210:~/reverse/var/tmp$\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleonrinkel%2Flaughing-parakeet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fleonrinkel%2Flaughing-parakeet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fleonrinkel%2Flaughing-parakeet/lists"}