16 replies to this topic

[zafeseve]

I need some help reading a configuration (cfg) file from a router. When I opened the file in Notepad to read it, below is an example of what I see:

t(Øy~±ö€èWØéT/ò7¯#©ZÎ ¼tÒFùør Gb³­8ÃÔ¿€9„AŠäÐI·0CY\%“¥<ãêb ÌÝ(ot3ÿN)"žg–±œ¾×Í3k*
6ñ'ýTÂ56†‚e2G»jÊOî¹Ú©åxY‚î™ÿ¬†{“¦ìn¾[`;¨Ä)×=ÑÄÜ×Ú:cŒðq:9ÉïÖôO‰†Ék³àµ0<º2,Më¿õ÷z#ýiñ`ºóQÚvZ3:·ÈÏ®“TP^ðlB+ø'žz½éFwOåJ);Â8}À<3Ç΍å«cÈ‚õ¶[_J1Ko?p ‡— c¹ÓÂÔ]÷Î…/BƒaCˆÛo”‘F÷+I±SQìº@R͉èùÊÊ"ehÃD¼QŸ zð1DÐÚžW¨§Í

I don't think I am the first one to come across this issue? Hopefully, someone in the forum will point me in the right direction. Thank you in advance for your help!

[Sha0]

I need some help reading a configuration (cfg) file from a router. When I opened the file in Notepad to read it, below is an example of what I see:

t(Øy~±ö€èWØéT/ò7¯#©ZÎ ¼tÒFùør Gb³­8ÃÔ¿€9„...

I don't think I am the first one to come across this issue? Hopefully, someone in the forum will point me in the right direction. Thank you in advance for your help!

I am sorry to say that "router configuration file" is not the subject of any universal standard that I'm aware of. There are different companies who make routers. There are different models of routers made by those companies. There are sometimes even choices for different operating systems/firmware on those routers. Then there are also older and newer versions of those operating systems/firmware.

The more details you share, the better.

[steve6375]

Did you try a decompression utility like 7zip to open it with? Maybe it is compressed?

[zafeseve]

@ ShaO: config file is for a Linksys RTP300 ata router with firmware 3.1.28.

@steve6375: 7zip does not help in this case.

Thanks!

[Wonko the Sane]

@ ShaO: config file is for a Linksys RTP300 ata router with firmware 3.1.28.

Start reading here:
http://wiki.openwrt..../linksys/rtp300
http://wiki.openwrt....at.descriptions

Rather obviously you CANNOT open a binary file in a text editor, you may want to open it with a hex viewer/editor instead.
Specifically, the file IS a compressed file BUT it has a "special" header.
You need to (make a copy of it first) strip the header and then access the compressed part with 7-zip or similar and the result should be a .xml file (which you can actually open with Notepad or other text editor).


Wonko

[zafeseve]

@Wonko,
Thanks for the directions. I think it may be important to note that the file in question has .CFG extension (not .BIN). Also, when you say "strip the header" how should I go about that? Can you please elaborate a little more on this? This is my first time using a hex editor. Thanks!

[Wonko the Sane]

@Wonko,
Thanks for the directions. I think it may be important to note that the file in question has .CFG extension (not .BIN). Also, when you say "strip the header" how should I go about that? Can you please elaborate a little more on this? This is my first time using a hex editor. Thanks!

Yep, but still you fail to provide the details on how/where did you find this .cfg file and what/how you would like to do with it.
According to the given link, a Linksys RTP300 config file is stored (on the device) in a RAW partition (hence it cannot have a filename, let alone an extension).

Firmware 3.1.28 is NOT listed among those available (BTW with broken links) on the linked page, so the first question is where did you get it from?

It is very possible that in the firmware (which could be a "raw" image itself or a set of compressed archives or also "whatever") there is a .cfg file (which may or may not be the configuration file of the router that you are after and that consequently may have the file format specified or a completely different one).
But you seem - at first feeling - like being falling in the erroneus belief that a file extension is actually meaningful of the contents of the file (this is NOT the case).
For all it matters, you can save a small text file created in Notepad as (say) mynicetxt.txt, then rename it to either mynicetxt.xls, mynicetxt.exe or mynicetxt.bin (or mynicetxt.cfg).
This change may affect the app that opens it (or completely fails to) when you double click on the file, but the contents will remain "plain text".

Let's do a simple experiment.
Open a command prompt and in it type (you can copy and paste in the command window the following):

md C:testdir

ECHO HEADER>C:testdirheader.txt

ECHO This is some senseless content of a text file>C:testdirtextbody.txt

COPY /B C:testdirheader.txt+C:testdirtextbody.txt C:testdirfulltxt.txt

(press [ENTER])
Then open Notepad and use it to open the three created files:

• C:testdirheader.txt
• C:testdirtextbody.txt
• C:testdirfulltxt.txt

It should be easy to understand how a particular program can be made to simply skip the "header" and access just the "body", so that when you open the C:testdirfulltxt.txt you see just the contents of C:testdirtextbody.txt, whilst Notepad (which is not programmed in such a way) will show you the "header" also.
Now, if you open in a hex editor the C:testdirfulltxt.txt, make a copy of it, then select everything from the beginning to the first capital T (excluded) and delete the selection, and save the file to (say) C:testdirstripped.bin, you can open this latter in Notepad and/or in the hex editor and it will be identical to C:testdirtextbody.txt, or alternatively you can select everything starting from the capital T (included) and copy /paste it to a new file)
You have effectively stripped a header . (admittedly, since in the test the source was a text file, you could have done the same with a text editor)


Wonko

[zafeseve]

Thank you for the thorough explanation! The firmware version I provided is the firmware version of the device itself as I understood ShaO's question. I got the cfg file from somebody and I am not sure what the actual firmware version of the cfg file is. I will try to follow your guide and see what happens. I will post back later to update everyone. Thank you for your help and patience!.

[zafeseve]

Rather obviously you CANNOT open a binary file in a text editor, you may want to open it with a hex viewer/editor instead. Specifically, the file IS a compressed file BUT it has a "special" header. You need to (make a copy of it first) strip the header and then access the compressed part with 7-zip or similar and the result should be a .xml file (which you can actually open with Notepad or other text editor).

Update: I stripped the header using HxD and saved the file. Now, I do not see in 7zip where and how to get the xml file that can be opened with Notepad. Link of pictures of the file with and without header are below:

http://www.freeimagehosting.net/soi8g
http://www.freeimagehosting.net/pafzl

[steve6375]

Your header appears to start with LINKSYSRTP, but according to the format description, a configuration file should start with LMMC - so it does not look like the correct format to me?
I am not sure why you are trying to do this, but the page also says:
If when the router boots the flash partition is found to be empty, the configuration is initialized by loading /etc/config.xml from the root partition.,
so maybe look at etcconfig.xml and you might get a better clue - also, you could delete the raw file in the flash partition (or maybe just change the first byte so it was not recognised?) and edit the config.xml if you wanted to change the default config in some way?

[zafeseve]

@steve 6375
My understanding, from the explanations provided so far, is that when you stripped the header and save the new file you will then be able to access the compressed part of the file with 7zip to get a xml file. However when I accessed the stripped file, I am not sure how to get to the xml result that would allow me to be able to read the file. For now, I only need to read the contents of the file so that I can get some info from it.Thanks!

[steve6375]

but the file you have been given does not look like the same file that is described in the specification. Maybe you should ask exactly where and how this file was obtained?

[Wonko the Sane]

For all we (and you BTW) know that file could be the secret plans of a nuclear installation that was compressed, encrypted and stegangraphed on a file given the extension .cfg and with added to it the header "LINKSYSRTP", besides you have no actual documentation for that particular file format (as it appears in the screenshot):
http://www.freeimagehosting.net/pafzl
so the actual size of the header you assumed is (no offence intended ) "moot", as well as the assumption that the later data is zlib compressed (or any other format 7zip parses correctly).
Right now - still with all due respect - you are after a nonsensical task that furthermore you fail to provide meaningful details about, so that actually helping you is not only extremely difficult, but utterly impossible.
Review - if needed - these:
http://homepage.ntlw...ard-litany.html
http://homepage.ntlw...red-banana.html

Since the stupid thingy is AR7 based, it is likely that you can find some useful hint/tool/whatever here:
http://www.routertech.org/



Wonko

[zafeseve]

I can see your point and understand your frustration; it looks like we are working in the dark here. What I think was a simple exercise of opening a config file turns out to be impossible.
Thank you all or your help! I think I will just give it a rest if I can't get help from the forum. Regardless of the outcome, I can now say that I have at least learned to play with hex editor. what troubles me though is that the backup file from my wireless D-Link router looks the same (different header of course) when opened with the hex editor.

[Sha0]

...
... Regardless of the outcome, I can now say that I have at least learned to play with hex editor. ...

Learn to play with binwalk, which is like the file command, only it exhaustively scans a file for "sub-files". If it finds some in your file, then you'll know just what to extract with the hex-editor.

http://lmgtfy.com/?q=binwalk

[zafeseve]

@ ShaO
Thanks for the advice! I will read about binwalk to have a better idea of how it works and what it does, After playing with it, I will update this thread if it helps any. Thanks!

[Wonko the Sane]

what troubles me though is that the backup file from my wireless D-Link router looks the same (different header of course) when opened with the hex editor.

What should trouble you is actually that *any* non plain txt files (and html/XML/INI et simlia) will actually look similar ot that (with different or no header) when seen in a hex editor, including your .pdf, .xls., .jpg. .exe, .dll and what not.
The whole point is that *any* non plain txt file (i.e. any binary file) will have a peculiar format, with (possibly) a header, a number of fields and data either saved as plain ASCII or compressed, or compressed and encrypted, etc.
A good tool to identify file formats is TriD:
http://mark0.net/soft-trid-e.html
but I doubt that it will be of use for those files (which are most probably something "proprietary" and uncommon)


Wonko