Netgear DG834 firmware


I wanted to look into the firmware image for my Netgear DG834 router.  In my case, I had a DG834 V3.  I think the DG834G V3 has the same firmware, but other versions have different firmware which may or may not be packaged the same way.  The firmware actual version I was using was: DG834v3 and DG834Gv3 Firmware Version 4.01.40.zip

The steps involved were:

  1. Unzip to find the .IMG firmware image
  2. Split up the firmware image to extract the root filesystem
  3. Unsquash the root filesystem
Unfortunately the steps are not as easy as one might hope.

Unzip

This step is easy.  I had to unzip twice to end up with the .IMG file (in my case dg834v3_v4.01.40.img)


Split

The firmware image contains a header, the kernel and the root filesystem.  There are some notes on this at RouterTech.  That note says that their Firmware Tool will do the split but I used the following manual process (apparently originally from a "Bored_Individual" on Aus Whirlpool forums):

FW=dg834v3_v4.01.40.img

#find position of filesystem
x=$(hexdump -C $FW | grep hsqs)
# take first hex number 
x="${x%% *}"
#add hex prefix
x="0x$x"
dd bs=$((x)) skip=1 if=$FW of=theFS.img
dd bs=$((x)) count=1 if=$FW of=theKernel.img
This leaves the filesystem in theFS.img.

Unsquash

The root filesystem is a SquashFS filesystem, but it seems to be non-standard.  It seems to be little-endian, SquashFS V2, with LZMA compression.  Unfortunately, at least according to the comments in the unsquashfs included in Debian (version 4.2), V2 should only use gzip compression, and even V4 uses XZ instead of the LZMAv1 used here.

Fortunately, we can hack unsquashfs to read this.  To do this, I used the following steps:
apt-get source squashfs-tools
apt-get build-dep squashfs-tools
dpkg-source -b squashfs-tools-4.2
cd squashfs-tools-4.2/squashfs-tools/
	comp = lookup_compressor("gzip");
to read:
	comp = lookup_compressor("lzma");
XZ_SUPPORT = 1

LZMA_XZ_SUPPORT = 1
make clean; make unsquashfs
This creates a version of unsquashfs which should be able to read our filesystem.  It can be used as:

./unsquashfs -x theFS.img
cd squashfs-root