Improve cramfs CRC checking.

qkaiser · qkaiser · commit 32320fdb88bc · 2022-06-09T17:08:21.000+02:00
We observed a sample from Cisco where the CRC value was stored in a different endianness. This is non standard but we decided to support it anyway. We also added a check for old cramfs format. If it's an old format, the CRC check always returns true because it's not supported. More information about CRC validation and old format: https://github.com/secularbird/cramfs/blob/master/cramfsck.c
diff --git a/tests/integration/filesystem/cramfs/big_endian/__input__/fruits.crc_swap.cramfs_be b/tests/integration/filesystem/cramfs/big_endian/__input__/fruits.crc_swap.cramfs_be
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:de1d6be79d816470ff54836760a0a1574fba6c2efa9ed13108f0669eb329d749
+size 4096
diff --git a/tests/integration/filesystem/cramfs/big_endian/__input__/fruits.old.cramfs_be b/tests/integration/filesystem/cramfs/big_endian/__input__/fruits.old.cramfs_be
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ad4972ed94445a852d88ecee148fe34699b417d9885a84e47d328a300c0d7a37
+size 4096
diff --git a/tests/integration/filesystem/cramfs/big_endian/__output__/fruits.crc_swap.cramfs_be_extract/apple.txt b/tests/integration/filesystem/cramfs/big_endian/__output__/fruits.crc_swap.cramfs_be_extract/apple.txt
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:303980bcb9e9e6cdec515230791af8b0ab1aaa244b58a8d99152673aa22197d0
+size 6
diff --git a/tests/integration/filesystem/cramfs/big_endian/__output__/fruits.crc_swap.cramfs_be_extract/cherry.txt b/tests/integration/filesystem/cramfs/big_endian/__output__/fruits.crc_swap.cramfs_be_extract/cherry.txt
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:86baf3529da550a44b0681ffa031b6b676e620e9e06dc5ac1119d0cd21cbcf55
+size 7
diff --git a/tests/integration/filesystem/cramfs/big_endian/__output__/fruits.old.cramfs_be_extract/apple.txt b/tests/integration/filesystem/cramfs/big_endian/__output__/fruits.old.cramfs_be_extract/apple.txt
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:303980bcb9e9e6cdec515230791af8b0ab1aaa244b58a8d99152673aa22197d0
+size 6
diff --git a/tests/integration/filesystem/cramfs/big_endian/__output__/fruits.old.cramfs_be_extract/cherry.txt b/tests/integration/filesystem/cramfs/big_endian/__output__/fruits.old.cramfs_be_extract/cherry.txt
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:86baf3529da550a44b0681ffa031b6b676e620e9e06dc5ac1119d0cd21cbcf55
+size 7
diff --git a/tests/integration/filesystem/cramfs/little_endian/__input__/fruits.crc_swap.cramfs_le b/tests/integration/filesystem/cramfs/little_endian/__input__/fruits.crc_swap.cramfs_le
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8e594657cd8a394eb7abb2a10041681a925edb95e829d37a7a4ac5168f026b9e
+size 4096
diff --git a/tests/integration/filesystem/cramfs/little_endian/__input__/fruits.old.cramfs_le b/tests/integration/filesystem/cramfs/little_endian/__input__/fruits.old.cramfs_le
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9bd27287c45ce34df662963e1541f5f13cf8b22f30e14942031dabd80a1596ea
+size 4096
diff --git a/tests/integration/filesystem/cramfs/little_endian/__output__/fruits.crc_swap.cramfs_le_extract/apple.txt b/tests/integration/filesystem/cramfs/little_endian/__output__/fruits.crc_swap.cramfs_le_extract/apple.txt
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:303980bcb9e9e6cdec515230791af8b0ab1aaa244b58a8d99152673aa22197d0
+size 6
diff --git a/tests/integration/filesystem/cramfs/little_endian/__output__/fruits.crc_swap.cramfs_le_extract/cherry.txt b/tests/integration/filesystem/cramfs/little_endian/__output__/fruits.crc_swap.cramfs_le_extract/cherry.txt
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:86baf3529da550a44b0681ffa031b6b676e620e9e06dc5ac1119d0cd21cbcf55
+size 7
diff --git a/tests/integration/filesystem/cramfs/little_endian/__output__/fruits.old.cramfs_le_extract/apple.txt b/tests/integration/filesystem/cramfs/little_endian/__output__/fruits.old.cramfs_le_extract/apple.txt
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:303980bcb9e9e6cdec515230791af8b0ab1aaa244b58a8d99152673aa22197d0
+size 6
diff --git a/tests/integration/filesystem/cramfs/little_endian/__output__/fruits.old.cramfs_le_extract/cherry.txt b/tests/integration/filesystem/cramfs/little_endian/__output__/fruits.old.cramfs_le_extract/cherry.txt
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:86baf3529da550a44b0681ffa031b6b676e620e9e06dc5ac1119d0cd21cbcf55
+size 7
diff --git a/unblob/handlers/filesystem/cramfs.py b/unblob/handlers/filesystem/cramfs.py
@@ -1,4 +1,5 @@
 import binascii
+import struct
 from typing import Optional
 
 from dissect.cstruct import Instance
@@ -8,9 +9,14 @@
 from ...file_utils import Endian, convert_int32, get_endian
 from ...models import File, HexString, StructHandler, ValidChunk
 
+CRAMFS_FLAG_FSID_VERSION_2 = 0x00000001
 BIG_ENDIAN_MAGIC = 0x28_CD_3D_45
 
 
+def swap_int32(i):
+    return struct.unpack("<I", struct.pack(">I", i))[0]
+
+
 class CramFSHandler(StructHandler):
 
     NAME = "cramfs"
@@ -56,11 +62,15 @@ def _is_crc_valid(
         header: Instance,
         endian: Endian,
     ) -> bool:
+        # old cramfs format do not support crc
+        if not (header.flags & CRAMFS_FLAG_FSID_VERSION_2):
+            return True
         file.seek(start_offset)
         content = bytearray(file.read(header.size))
         file.seek(start_offset + 32)
         crc_bytes = file.read(4)
         header_crc = convert_int32(crc_bytes, endian)
         content[32:36] = b"\x00\x00\x00\x00"
         computed_crc = binascii.crc32(content)
-        return header_crc == computed_crc
+        # some vendors like their CRC's swapped, don't ask why
+        return header_crc == computed_crc or header_crc == swap_int32(computed_crc)

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:de1d6be79d816470ff54836760a0a1574fba6c2efa9ed13108f0669eb329d749`
	`3`	`+size 4096`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:ad4972ed94445a852d88ecee148fe34699b417d9885a84e47d328a300c0d7a37`
	`3`	`+size 4096`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:303980bcb9e9e6cdec515230791af8b0ab1aaa244b58a8d99152673aa22197d0`
	`3`	`+size 6`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:86baf3529da550a44b0681ffa031b6b676e620e9e06dc5ac1119d0cd21cbcf55`
	`3`	`+size 7`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:8e594657cd8a394eb7abb2a10041681a925edb95e829d37a7a4ac5168f026b9e`
	`3`	`+size 4096`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+version https://git-lfs.github.com/spec/v1`
	`2`	`+oid sha256:9bd27287c45ce34df662963e1541f5f13cf8b22f30e14942031dabd80a1596ea`
	`3`	`+size 4096`