Reading binary dump of flash memory

Question

I've been looking for a way to deal with this file and haven't found anything specific enough yet. I'm trying to find login credentials hardcoded into a router's firmware, and I think I'm about halfway to my goal, but I've hit a snag though.

I pulled the thing apart, found an internal serial interface, managed to solder pins in/hook up to a Raspberry Pi/get a console, but I'm stuck at a login prompt with no credentials. So…

I managed to stop the boot and get to a bootloader prompt (CFE). I thought I'd change the boot parameters to include init=/bin/sh, but the bootloader's crippled (intentional I think), so I can't change environment variables or specify a boot command or anything.

What I can do, though, is dump the flash. If I dump the entire thing and end up with a binary file (.bin) (I'm on Arch Linux BTW), how do I read it?

It would be straightforward except this file is a disk image, so it should contain multiple files and directories, but I have no idea what to do with that. Could I mount it as a (probably FAT) filesystem? How?

I stopped finding information about this project about five steps ago, I'm in uncharted territory here, and a bit out of my depth. More than anything, I'm trying to find an /etc/passwd or /etc/shadow; would there be a recognizable pattern in the data in those files that I could search for?

Answer 1

binwalk is a very handy tool to analyze firmware dumps, and extract the contents of filesystem(s) they may contain.

Answer 2

If it is a filesystem (it sounds like it is) you should be able to mount it, the tricky part is figuring out the offset. Never hurts to try! Here's an example, I have no idea what might work for you....

mount -o loop,ro,offset=32256 whatever.bin /mnt/my.image

The file command can maybe help guess what kind of file you have, and for looking at its contents, you'll certainly want to get familiar with a hex editor (there are lots of options there, you probably already have ghex installed)