Extracting the firmware for Edimax IC-7110W IP Camera

I got an Edimax IC-7110W IP camera and I liked their firmware, but I was curious what was happening behind the curtains, so I decided to take a look. Step 1: Get the firmware – I got the firmware update binary package from their site for version 1.7 – other versions are probably similar: Step 2: Prepare your environment – I am using Ubuntu Linux 12.04. You will need to download and install the following software:

  • a build environment (gcc, g++, make, tar, zlib1g-dev, tar, gzip)
  • firmware-mod-kit:
  • subversion (sudo apt-get install subversion)

Step 3: Install firmware-mod-kit and compile binwalk and unsquashfs:

[email protected]:~/temp$ mkdir -p edimax/1.7 edimax/fmk[email protected]:~/temp$ cd edimax[email protected]:~/temp/edimax$ svn checkout fmk… output omitted …[email protected]:~/temp/edimax$ cd fmk/src/binwalk-0.4.1/src[email protected]:~/temp/edimax/fmk/src/binwalk-0.4.1/src$ ./configure… output omitted …[email protected]:~/temp/edimax/fmk/src/binwalk-0.4.1/src$ make… output omitted …[email protected]:~/temp/edimax/fmk/src/binwalk-0.4.1/src$ ls -l binwalk -rwxrwxr-x 1 adrianp adrianp 358991 Nov 16 16:15 binwalk [email protected]:~/temp/edimax/fmk/src/binwalk-0.4.1/src$ cd ../../squashfs-3.0/[email protected]:~/temp/edimax/fmk/src/squashfs-3.0$ make… output omitted …[email protected]:~/temp/edimax/fmk/src/squashfs-3.0$ ls -l unsquashfs* -rwxrwxr-x 1 adrianp adrianp  34292 Nov 16 16:18 unsquashfs -rwxrwxr-x 1 adrianp adrianp 227552 Nov 16 16:18 [email protected]:~/temp/edimax/fmk/src/squashfs-3.0$ cd ../../../ [email protected]:~/temp/edimax$

Step 4: Unzip the firmware and extract the bin file:

[email protected]:~/temp/edimax$ cd 1.7[email protected]:~/temp/edimax/1.7$ lsIC-7110_EDIMAX_CLOUD_v1.7_upg.zip [email protected]:~/temp/edimax/1.7$ unzip IC-7110_EDIMAX_CLOUD_v1.7_upg.zip Archive:  IC-7110_EDIMAX_CLOUD_v1.7_upg.zip inflating: IC-7110_EDIMAX_CLOUD_v1.7_upg.bin [email protected]:~/temp/edimax/1.7$ ls -l total 7296 -rw-rw-r– 1 adrianp adrianp 3751945 Apr 18  2012 IC-7110_EDIMAX_CLOUD_v1.7_upg.bin -r——– 1 adrianp adrianp 3709299 Nov 16 15:47 IC-7110_EDIMAX_CLOUD_v1.7_upg.zip

Step 5: Use binwalk to extract the root filesystem from the firmware (change the relative path to binwalk if needed) (note – analysing the firmware might take up to 5-10 minutes):

[email protected]:~/temp/edimax/1.7$ ../fmk/src/binwalk-0.4.1/src/binwalk -m ../fmk/src/binwalk-0.4.1/src/magic.binwalk  IC-7110_EDIMAX_CLOUD_v1.7_upg.bin DECIMAL       HEX           DESCRIPTION ——————————————————————————————————- 11388         0x2C7C        gzip compressed data, from Unix, last modified: Wed Apr 18 05:12:23 2012, max compression 786440        0xC0008       Squashfs filesystem, little endian, version 3.0, size: 2961974 bytes, 221 inodes, blocksize: 65536 bytes, created: Wed Apr 18 05:12:31 2012

I am not sure what the first entry is – could be the kernel, but we are currently interested in the second one – the root file system.  Step 6: Extract the root file system from the firmware file. Right now the root file system is embedded in the firmware file, starting from offset 0xC0008 (786440 bytes into the file). We need to make it a standalone file. The file size is 2961974 bytes. We will use dd for the job:

[email protected]:~/temp/edimax/1.7$ dd if=IC-7110_EDIMAX_CLOUD_v1.7_upg.bin skip=786440 bs=1 count=2961974 of=rootfs.squasfs2961974+0 records in2961974+0 records out2961974 bytes (3.0 MB) copied, 8.89102 s, 333 kB/s

[email protected]:~/temp/edimax/1.7$ file rootfs.squasfs rootfs.squasfs: Squashfs filesystem, little endian, version 3.0, 2961974 bytes, 221 inodes, blocksize: 65536 bytes, created: Wed Apr 18 05:12:31 2012

Step 7: Unsquash the squashfs file. This action decompresses the filesystem and recreates the folder structure it came from. The particular bit is you need to use the same unsquashfs version (3.0) it was created with. One more important detail is that squashfs usually uses gzip as a compressor, but in Edimax’s case they used lzma, so you need to use the following command:

[email protected]:~/temp/edimax/1.7$ ../fmk/src/squashfs-3.0/unsquashfs-lzma rootfs.squasfs created 66 files created 27 directories created 128 symlinks created 0 devices created 0 fifos

Step 8: Profit! Your firmware’s root file system is now dumped in the folder squashfs-root:

[email protected]t:~/temp/edimax/1.7$ cd squashfs-root/[email protected]:~/temp/edimax/1.7/squashfs-root$ lsbin  dev  etc  lib  linuxrc  mnt  proc  sbin  storage  tmp  usr  var

I will explore some of the hidden features of the firmware in a following blog post.

Leave a Reply