Looking inside JFFS2 images on a Linux Box.

chi

Inactive User
Joined
Aug 9, 2005
Messages
52
Reaction score
1
How to look inside a JFFS2 image on a Linux based PC
--------------------------------------------------------------------

01. Why would someone want to do this?
=============================

For me, I just ordered a new Nokia DBox (2xIntel version) but I can't
do anything until it arrives. Rather than idling my time away, I have
been reading the vast wealth of guides/tutorials/tips in this forum
to ready myself. That way, I can hit the ground running when the DBox
arrives.

Unashamedly, I am a DBox virgin and a curious one at that. So when I
kept hearing people mention "flashing DBox images", I want to know what
was inside these so called images. Unlike the services.xml or k*ys or
cables.xml files which are essentially just text files, the DBox images
are binary files (which make no sense when viewed - just weird symbols
and numbers).

Curiosity aside, I thought it may be useful to tweak the contents of
these images to my own satisfaction, before the DBox arrives.


02. A brief descriptin of JFFS2
=====================

JFFS2 stands for Journalling Flash File System version 2. A quick
search on the internet tells me this:

"JFFS2 is a log-structured file system designed for use on flash
devices in embedded systems. Rather than using a kind of translation
layer on flash devices to emulate a normal hard drive, as is the case
with older flash solutions, it places the filesystem directly on the
flash chips."

Flash chips have a limited life span. You can write to them a certain
number of times. The way JFFS2 is designed ensures that all the
areas of the flash are all equally written to. This is known as
wear leveling.


03. What you'll need
===============

1. A suitable JFFS2 image (which you can get from the DBox
downloads forum). I chose one at random and ended up using
Sporster 1.73 jffs2 2xI UK.img.

2. A suitable PC running a recent version of Linux. In My case,
I used Fedora Core 2. Make sure the development tools are
installed (e.g. gcc and make) as you might need them later
on.

3. To enable us to see inside the JFFS2 image, you will need to
have the following kernel modules:

o mtdcore
o mtdblock
o mtdram
o jffs2

If you have these already, skip to step 4. The kernel modules
are located in the "/lib/modules" directory. If you don't have
these modules then you'll need to configure and compile your
kernel (just the modules - don't need a new kenrel). The Linux
kernel source normally resides in the "/usr/src" directory.
If you don't have the kernel source, download it from
ftp.kernel.org. To make things easier, get a version that
matches your currently running kernel. Do a "uname -r" to find
out the version on your Linux box.

For information on configuring and building linux kernels.
Search with your favorite search engine.

4. A linux utility called "jffs2dump" which is part of the "mtd"
package. If you don't have the mtd utilities in your Linux
system, do a search in google for "mtd". Download, build,
and install.

You will use jffs2dump to convert the big endian image to
an image that is of little endian. If you don't, then you
will not be able to "mount" the image later on.

To convert the original JFFS2 image (which is B.E), type the
following into your shell. Note the "$" should not be typed,
it is only used to indicate the shell prompt.

$ jffs2dump -r -e /tmp/converted.img -b /tmp/original.img

Change the above command as necessary to reflect where your
own images are stored.

Note you will see several screens of errors/warnings - just
ignore these.

5. Check if the mtdblock devices are available in "/dev". If
they don't exist, create them as follow (again, don't type
the "$" charcater):

$ mkdir /dev/mtdblock
$ mknod /dev/mtdblock/0 b 31 0
$ mknod /dev/mtdblock/1 b 31 1
$ mknod /dev/mtdblock/2 b 31 2


04. Mounting the converted JFFS2 image
=============================

Assuming you have done everything mentioned above. We are now
ready to "mount" the converted JFFS2 image. Again, ignore the
"$" character as it is only shown to indicate the shell prompt.

$ insmod mtdcore
$ modprobe jffs2
$ modprobe mtdram total_size=8192 erase_size=256
$ modprobe mtdblock
$ dd if=/tmp/converted.img of=/dev/mtdblock/0
$ mkdir /mnt/dbox
$ mount -t jffs2 /dev/mtdblock/0 /mnt/dbox

What we have just done is allocated 8 megabytes of memory and have
it pretend to be a flash device. The converted JFFS2 image is then
copied to our flash device (which is not real - only exists in
volatile memory). Lastly, we mount the flash device to the
/mnt/dbox directory.

Now, the moment we've been waiting for. Let's go the mounted area
and see what is in our JFFS2 image:

$ cd /mnt/dbox
$ ls -CF

This is what I see in my shell after doing "ls -CF":

bin/ dev/ etc/ lib/ mnt/ proc/ root@ sbin/ share/ tmp/ var/ vmlinuz

And inside the "var" directory:

$ cd /mnt/dbox/var
$ ls -CF

We see the following sub-directories:

bin/ keys/ mnt/ plugins/ scam/ tmp@
etc/ log@ pid@ run@ scce@ tuxbox/

Cool! We now have access to the contents of the JFFS2 image.
Now, we can do whatever we like, for example, add our own services.xml
file. Maybe change the TCP/IP details. You get the general idea.


05. Create our own JFFS2 image
=======================

Okay, we've customised our JFFS2 image and now we'll save it out so that
we can flash it onto the Dbox.

Firstly, unmount the flash device (note yes - it is "umount"):

$ umount /mnt/dbox

Copy 8 megabytes from /dev/mtdblock/0 (which contains our changes) to a
new JFFS2 image file:

$ dd if=/dev/mtdblock/0 of=/tmp/new_rootfs.img bs=8M count=1

Lastly, convert the image back into the big endian format so the DBox
can read the update JFFS2 image:

$ jffs2dump -r -e /tmp/updated_dbox.img -l /tmp/new_rootfs.img

Ignore all the errors/warnings.

W A R N I N G - remember - I don't have a DBox (yet), the updated image
should work but I have no hardware to confirm this and don't guarantee
anything. Still, it should work, he says perhaps, maybe, absolutely. :)

B U G G E R - I can now confirm the updated image does NOT work on the
DBox! If I have time, I might look into this further. Once again, I state that the
final image using the methods described in this post does NOT work.
Do NOT try it on your DBox. Fortunately, I managed to revive the DBox
using the IFA. Phew.

06. Kudos
========

Thumbs up and hats off to all the guys/gals here for sharing and
helping! Hope this post is useful to someone.
 
Thats a great first post for a newbie don't you think?
Better than the usual "how do i do this bit which has been covered b4" questions we get.

:)
 
I wonder if my DBox will arrive soon....

Thanks for your kind comments - like yourselves, just trying to help out in case someone wanted to do something similar.

I can't wait to get the DBox.......hopefully before the cable providers switch to NVOD or teleport.

Will keep everbody posted on how I get on once the DBox arrives.
 
Re: I wonder if my DBox will arrive soon....

hello all,
I just read this old thread which I found throug google,
I have an image on jffs2, I tried sinces 2 weeks to get the files inside it, but I can't mount it :(

Can anyone help me ?
thank you

here is the result of binwalk on the image



DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
142296 0x22BD8 gzip compressed data, from Unix, last modified: Thu Aug 26 08:29:51 2010, max compression

917504 0xE0000 Squashfs filesystem, little endian, version 3.0, size: 2627760 bytes, 495 inodes, blocksize: 65536 bytes, created: Thu Aug 26 08:31:56 2010

2503832 0x263498 JFFS2 filesystem data big endian, JFFS node length: 835507

4186004 0x3FDF94 gzip compressed data, from NTFS filesystem (NT), DD-WRT date: Thu Jan 1 01:00:00 1970
 
Back
Top