Merge pull request #26 from syschmod/master

Improve D-Link eCos RomFS support and add D-link MD5 based langpack signature ReFirmLabs#456

src/binwalk/magic/filesystems

@@ -570,14 +570,17 @@
 
 # Not to be confused with an actual romfs image!
 # ftp://ftp.dlink.eu/Products/dir/dir-600/driver_software/DIR-600_fw_revC1_3-05B15__all_en_20120216.zip
+# based on eCos romfs, but with lzma files compression
 0x10    string          ROMFS\x20v      D-Link ROMFS filesystem,
 >0x17   string          x               version %s,
 >0      string          !\x2EmoR
 >>0     string          !Rom\x2E        {invalid} unknown endianness
 >0      string          \x2EmoR         little endian,
+>>4     lelong          x               %d entries,
 >>8     lelong          x               size: <= %d
 #>>8     lelong-0x20     x               {jump:%d}
 >0      string          Rom\x2E         big endian,
+>>4     belong          x               %d entries,
 >>8     belong          x               size: <= %d
 #>>8     belong-0x20     x               {jump:%d}
 

src/binwalk/magic/misc

@@ -83,3 +83,10 @@
 # Xilinx FPGA Bitstream
 # Ref: http://www.xilinx.com/support/answers/7891.html
 0       ubequad        0xffffffffaa995566  Xilinx Virtex/Spartan FPGA bitstream dummy + sync word
+
+# D-Link MD5 hash based langpack (sealpac.slp used in embedded PHP i18n function)
+0       belong          0x05ea19ac      D-Link MD5 based langpack (sealpac),
+>4      belong          x               %d translations,
+>8      bequad          !0              {invalid} non-zero header padding
+>0x1f   byte            0
+>>0x10  string          x               langcode: %s

src/binwalk/plugins/dlromfsextract.py

@@ -11,6 +11,11 @@
 
 class RomFSCommon(object):
 
+    def _read_next_halfword(self):
+        value = struct.unpack("%sH" % self.endianness, self.data[self.index:self.index + 2])[0]
+        self.index += 2
+        return value
+
     def _read_next_word(self):
         value = struct.unpack("%sL" % self.endianness, self.data[self.index:self.index + 4])[0]
         self.index += 4
@@ -48,20 +53,21 @@ class RomFSEntry(RomFSCommon):
 
     DIR_STRUCT_MASK = 0x00000001
     DATA_MASK = 0x00000008
-    COMPRESSED_MASK = 0x005B0000
+    COMPRESSED_MASK = 0x005B0000 # wrong - probably some permissions
 
     def __init__(self, data, endianness="<"):
         self.data = data
         self.endianness = endianness
         self.index = 0
 
         self.type = self._read_next_word()
-        self.unknown2 = self._read_next_word()
-        self.unknown3 = self._read_next_word()
+        self.nlink = self._read_next_word()
+        self.user_id = self._read_next_halfword()
+        self.group_id = self._read_next_halfword()
         self.size = self._read_next_word()
-        self.unknown4 = self._read_next_word()
+        self.ctime = self._read_next_word()
         self.offset = self._read_next_word()
-        self.unknown5 = self._read_next_word()
+        self.size_decompressed = self._read_next_word() # 0 means no compression
         self.uid = self._read_next_uid()
 
 
@@ -167,6 +173,9 @@ def _process_all_entries(self):
             entries[entry.uid].offset = entry.offset
             entries[entry.uid].size = entry.size
             entries[entry.uid].type = entry.type
+            entries[entry.uid].size_decompressed = entry.size_decompressed
+            entries[entry.uid].ctime = entry.ctime
+            entries[entry.uid].nlink = entry.nlink
             if entry.uid == 0:
                 entries[entry.uid].name = os.path.sep
 
@@ -200,7 +209,7 @@ def _process_all_entries(self):
 class DlinkROMFSExtractPlugin(binwalk.core.plugin.Plugin):
 
     '''
-    Gzip extractor plugin.
+    D-link ROMFS extractor plugin.
     '''
     MODULES = ['Signature']
     BLOCK_SIZE = 10 * 1024