feat(handler): add support for non-standard squashfs v2 signature.

onekey-sec · Aug 8, 2023 · aff6a7a · aff6a7a
1 parent fe1b17c
commit aff6a7a
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/unblob/handlers/__init__.py b/unblob/handlers/__init__.py
@@ -44,6 +44,7 @@
     ntfs.NTFSHandler,
     romfs.RomFSFSHandler,
     squashfs.SquashFSv2Handler,
+    squashfs.SquashFSv2NonStandardHandler,
     squashfs.SquashFSv3Handler,
     squashfs.SquashFSv3DDWRTHandler,
     squashfs.SquashFSv3BroadcomHandler,

diff --git a/unblob/handlers/filesystem/squashfs.py b/unblob/handlers/filesystem/squashfs.py
@@ -115,6 +115,25 @@ class SquashFSv2Handler(_SquashFSBase):
     HEADER_STRUCT = "squashfs2_super_block_t"
 
 
+class SquashFSv2NonStandardHandler(SquashFSv2Handler):
+    NAME = "squashfs_v2_nonstandard"
+
+    BIG_ENDIAN_MAGIC = 0x73_71_6C_7A
+
+    EXTRACTOR = SquashFSExtractor(0x73_71_6C_7A)
+
+    PATTERNS = [
+        HexString(
+            """
+            // 00000000  73 71 6c 7a 00 00 03 3f  00 21 99 d7 00 21 99 c7  |sqlz...?........|
+            // 00000010  00 00 00 00 00 21 71 7c  00 21 82 89 00 02 00 01  |.!...!.......!q.|
+            // squashfs_v2_magic_non_standard_be
+            73 71 6c 7a [24] 00 02
+        """
+        ),
+    ]
+
+
 class SquashFSv3Handler(_SquashFSBase):
     NAME = "squashfs_v3"