I got an e-mail back from the Software Freedom Law Center regarding my complaint of D-Link violating the GPL for busybox for the DIR-615 rev A1. It was nothing exciting, merely a note that they would look into it, but I felt I would further expound upon my findings.

As mentioned before, the firmware images available on D-Link’s website are merely jffs2 images which are uploaded directly to the device, which are then used to overwrite the root drive on the system. As autopsy can’t analyze these images just yet, and the MTD driver complains when I try to mount the image loopback, I’m left merely analyzing the filesystem dump from jffs2dump, a program available in the mtd-tools package in Ubuntu.

Luckily, there are no shortage of damning dirents in the output:

Dirent node at 0x00000240, totlen 0x0000002f, #pino 1, version 11, #ino 7, nsize 7, name linuxrc

Dirent node at 0x00110a8c, totlen 0x0000002f, #pino 2, version 35, #ino 19, nsize 7, name busybox

Other entries for libc, the 2.4.27 lib directory, etc, make it clear the this is definitely running Linux, and D-Link is definitely distributing GPL software on their devices. With any luck, the SFLC will succeed in bringing D-Link into compliance.

As it stands, I’m still working on my analysis of the JFFS2 filesystem, a slight challenge as I currently have next to no filesystem experience. It does help that I have JFFS2 documentation, some experience reverse engineering file formats, and a good hex editor.

Unfortunately, all is not roses. The JFFS2 documentation suggests that a clean marker is placed on a node just after it’s been cleaned. These markers occur within the dlink image every 0x10000 bytes, which confuses me because they occur in blocks which I know are “dirty” because they contain data. It seems that, unlike what the documentation suggests, a sector is dirty if it contains a clean marker, and any other node, which would immediately follow the clean marker.

I’ve been busy lately, and I see that continuing, but hopefully I’ll be able to get a rough version of support into task by this weekend.