This looks like shell scrips for patches and config files. Is there another place with the source that actually used to compile the binaries like this: http://downloads.commotionwireless.net/router/1.0/ar71xx/gen...

It uses the OpenWRT build system to produce those binaries. Try pulling the source code and building it yourself :)

https://github.com/opentechinstitute/commotion-router#instal...

I would be more interested in the decompiled binaires at this point, you know the stuff being released directly into the wild from the site :)

Unless you could point me in the direction of a repo that looks like this[0] (posted in this thread, and project I've been following along with others), that corresponds to the binary I posted above.

[0] https://github.com/cjdelisle/cjdns

Hey, I am one of the developers of the Commotion project. OpenWRT can be a confusing system. Let me help you find what you are looking for. The Commotion-router repo above is contains our setup scripts that make it easier for new users like you to build our software from source. If you look at the feeds.conf file you will find the exact sources we are pulling in to the openWRT build system for compilation. The most important line, for your concerns about backdoors would be the third line of that file. That line pulls in the master branch of the repo commotion-feed. This repository is full of makefiles. These makefiles specify how to build the source code into the compiled binary your pointed to before. If you follow the follow the install instructions that were poster earlier and then explore the curses (command line GUI) menu for make menuconfig you can explore the exactly what packages are going to be built for the specific architecture. (If you are curious about tampering we sadly have not had the time or funding to do deterministic builds, so I suggest you build it from source yourself so that you can examine the code.) Now, each item in the menuconfig references a "feed." You can look at the feeds.conf file in the current directory, and the various makefiles in the feeds folder to explore where exactly things are being pulled from. Our source code will use the git repo's specified in the makefiles in commotion-feed on the master branch. You can find all of those in our github, because we are an open-source project. If you have any concerns about specific lines of code that have been implemented I beg of you to submit a bug to the repo you find a problem with. We want every possible opportunity better our code. While we have done internal testing, I hope that with eyes like yours looking over the code we will find more bugs that we can address in the future. If you have any questions I will try to follow this thread the best I can, and am elationfoundation on github. You can also find most of the developers and our field experts on freenode at #commotion. I have built, and debugged, far too many openWRT images. So, If you do need assistance jump on #commotion during Americas East Coast working hours and I will be glad to help you.

I hope this helped. OpenWRT's build system is a beautiful, but complex being.

Thanks for the response. I have to be honest and say I'm probably not going to dig through a bunch of the makefiles listed in the third repo in feeds.conf (at least right now).

But at least from you even mentioning deterministic builds, must mean that the thought has crossed your minds? I know the Tor project has to deal with concerns like that, and I figure firmware providers for mesh-networks will increasingly have to deal with the same.

These sorts of things have piqued my interest lately and right now I'm in the middle of digging through the linksys e1000 firmware[0][1] (from yesterdays hubbub, too bad the script didn't work for me :/) and my cousin telling me about open ports (10080,1780,51000) on 192.168.1.1 on his network with some interesting traffic (his words). So, if I hear any stories relating to traffic on ports from postings online relating to this firmware, I'll probably take a look for fun (though there are probably many other people better at these things like yourself).

[0] http://support.linksys.com/en-us/support/routers/E1000 [1] http://i.imgur.com/jWebamh.png

From your screenshot, I don't think that squashfs detection is right, you may have to play around with dd and unsquashfs.

Also try a newer version of binwalk [-1] and/or the 2.0 branch [0]

-1: https://github.com/devttys0/binwalk/

0: https://github.com/devttys0/binwalk/tree/binwalk-2.0

Here are some of the steps that I use to unsquash the binary Commotion images to make changes:

1. Find the PARTs

2. Extract them

3. unsquash: unsquashfs -d image/ squashfs.bin

4. Make the changes.

5. squash: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/mksquashfs4 image/ squashfs-made.bin -nopad -noappend -root-owned -comp xz -Xpreset 9 -Xe -Xlc 0 -Xlp 2 -Xpb 2 -b 256k

6. pad: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/padjffs2 squashfs-made.bin 64

7. mkfwimage: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/mkfwimage -B XM -k kernel.img -r squashfs-made.bin -v XM.ar7240.v6.0.0-OpenWrt-r36682 -o openwrt-ar71xx-generic-ubnt-nano-m-squashfs-factory-DR2-tn.bin

If you are modifying a sysugrade image: Extract 0-1048576 (bytes): that's the kernel Extract the rest: that's the squashfs

Put them back together with ( dd if=vmlinux bs=1048576 conv=sync; dd if=squashfs-made.bin ) > openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-sysupgrade-DR2-custom.bin

These are just my notes. Feel free to contact me if you want more information.

I saw your comment yesterday, which made me want to take a stab at it. Thanks alot!

I used dd to get squashfs filesystem by itself[i], and unsquashfs [unsquashfs -v unsquashfs version 4.2 (2011/02/28)][i^2] but that gave that error, then I tried compiling with lzma,xz, lzo by their selfs and neither worked. But your right about the old version of binwalk, I was using v1.2.1.

[i] http://i.imgur.com/Vk35XL0.png

[i^2] http://i.imgur.com/HxTE0rR.png

You're at the point where I normally get stuck. From the slides yesterday, see if you can find the version of squashfs that was used when the firmware was built.

That makes sense, cant access linksys website now to check (glad I got this binary in time :P) binwalk says "Squashfs filesystem, little endian, version 3.0" so I'm going to dl that and try again. Who knows, if I can get this to work, I can make a new wifi cracking script[0] that wont take hours with the vulns found so far by going through the backdoor, for security research purposes of course ;)

[0] https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_...

You may also want to send a request for GPL'd sources to Linksys for this device.

I have another way to extract this for you - can you please contact me?