How to look inside a JFFS2 image on a Linux based PC
01. Why would someone want to do this?
For me, I just ordered a new Nokia DBox (2xIntel version) but I can't
do anything until it arrives. Rather than idling my time away, I have
been reading the vast wealth of guides/tutorials/tips in this forum
to ready myself. That way, I can hit the ground running when the DBox
Unashamedly, I am a DBox virgin and a curious one at that. So when I
kept hearing people mention "flashing DBox images", I want to know what
was inside these so called images. Unlike the services.xml or k*ys or
cables.xml files which are essentially just text files, the DBox images
are binary files (which make no sense when viewed - just weird symbols
Curiosity aside, I thought it may be useful to tweak the contents of
these images to my own satisfaction, before the DBox arrives.
02. A brief descriptin of JFFS2
JFFS2 stands for Journalling Flash File System version 2. A quick
search on the internet tells me this:
"JFFS2 is a log-structured file system designed for use on flash
devices in embedded systems. Rather than using a kind of translation
layer on flash devices to emulate a normal hard drive, as is the case
with older flash solutions, it places the filesystem directly on the
Flash chips have a limited life span. You can write to them a certain
number of times. The way JFFS2 is designed ensures that all the
areas of the flash are all equally written to. This is known as
03. What you'll need
1. A suitable JFFS2 image (which you can get from the DBox
downloads forum). I chose one at random and ended up using
Sporster 1.73 jffs2 2xI UK.img.
2. A suitable PC running a recent version of Linux. In My case,
I used Fedora Core 2. Make sure the development tools are
installed (e.g. gcc and make) as you might need them later
3. To enable us to see inside the JFFS2 image, you will need to
have the following kernel modules:
If you have these already, skip to step 4. The kernel modules
are located in the "/lib/modules" directory. If you don't have
these modules then you'll need to configure and compile your
kernel (just the modules - don't need a new kenrel). The Linux
kernel source normally resides in the "/usr/src" directory.
If you don't have the kernel source, download it from
ftp.kernel.org. To make things easier, get a version that
matches your currently running kernel. Do a "uname -r" to find
out the version on your Linux box.
For information on configuring and building linux kernels.
Search with your favorite search engine.
4. A linux utility called "jffs2dump" which is part of the "mtd"
package. If you don't have the mtd utilities in your Linux
system, do a search in google for "mtd". Download, build,
You will use jffs2dump to convert the big endian image to
an image that is of little endian. If you don't, then you
will not be able to "mount" the image later on.
To convert the original JFFS2 image (which is B.E), type the
following into your shell. Note the "$" should not be typed,
it is only used to indicate the shell prompt.
$ jffs2dump -r -e /tmp/converted.img -b /tmp/original.img
Change the above command as necessary to reflect where your
own images are stored.
Note you will see several screens of errors/warnings - just
5. Check if the mtdblock devices are available in "/dev". If
they don't exist, create them as follow (again, don't type
the "$" charcater):
$ mkdir /dev/mtdblock
$ mknod /dev/mtdblock/0 b 31 0
$ mknod /dev/mtdblock/1 b 31 1
$ mknod /dev/mtdblock/2 b 31 2
04. Mounting the converted JFFS2 image
Assuming you have done everything mentioned above. We are now
ready to "mount" the converted JFFS2 image. Again, ignore the
"$" character as it is only shown to indicate the shell prompt.
$ insmod mtdcore
$ modprobe jffs2
$ modprobe mtdram total_size=8192 erase_size=256
$ modprobe mtdblock
$ dd if=/tmp/converted.img of=/dev/mtdblock/0
$ mkdir /mnt/dbox
$ mount -t jffs2 /dev/mtdblock/0 /mnt/dbox
What we have just done is allocated 8 megabytes of memory and have
it pretend to be a flash device. The converted JFFS2 image is then
copied to our flash device (which is not real - only exists in
volatile memory). Lastly, we mount the flash device to the
Now, the moment we've been waiting for. Let's go the mounted area
and see what is in our JFFS2 image:
$ cd /mnt/dbox
$ ls -CF
This is what I see in my shell after doing "ls -CF":
bin/ dev/ etc/ lib/ mnt/ proc/ root@ sbin/ share/ tmp/ var/ vmlinuz
And inside the "var" directory:
$ cd /mnt/dbox/var
$ ls -CF
We see the following sub-directories:
bin/ keys/ mnt/ plugins/ scam/ tmp@
etc/ log@ pid@ run@ scce@ tuxbox/
Cool! We now have access to the contents of the JFFS2 image.
Now, we can do whatever we like, for example, add our own services.xml
file. Maybe change the TCP/IP details. You get the general idea.
05. Create our own JFFS2 image
Okay, we've customised our JFFS2 image and now we'll save it out so that
we can flash it onto the Dbox.
Firstly, unmount the flash device (note yes - it is "umount"):
$ umount /mnt/dbox
Copy 8 megabytes from /dev/mtdblock/0 (which contains our changes) to a
new JFFS2 image file:
$ dd if=/dev/mtdblock/0 of=/tmp/new_rootfs.img bs=8M count=1
Lastly, convert the image back into the big endian format so the DBox
can read the update JFFS2 image:
$ jffs2dump -r -e /tmp/updated_dbox.img -l /tmp/new_rootfs.img
Ignore all the errors/warnings.
W A R N I N G - remember - I don't have a DBox (yet), the updated image
should work but I have no hardware to confirm this and don't guarantee
anything. Still, it should work, he says perhaps, maybe, absolutely.
B U G G E R - I can now confirm the updated image does NOT work on the
DBox! If I have time, I might look into this further. Once again, I state that the
final image using the methods described in this post does NOT work.
Do NOT try it on your DBox. Fortunately, I managed to revive the DBox
using the IFA. Phew.
Thumbs up and hats off to all the guys/gals here for sharing and
helping! Hope this post is useful to someone.