POSTS

Epson Printer Reversing

Why

Don’t be my parents. I like printers. There’s nothing bad about it.

Extraction

At first glance two big section are used. They both start with CROM.

  1. Contains uboot image, linux kernel and two sqashfs partition. Respectively one contains the rootfs, the other contains epson proprietary module and maybe a daemon.

    1. Early analysis suggest that the kernel calls /root/PreBoot . After initializing the system, /root/PreBoot calls S99NWControl
    2. S99NWControl seems to be the control script for the low level daemon. It does a few things:
    3. Change the some kinux kernel settings, like ulimits and overcommit_memory
    4. Loads the proprietary kernel module epidc.ko which enables a new ioctl.
    5. Runs nwsoc. A low level printer daemon? For sure it dies in pain if epidc.ko is not loaded

  2. Contains a lot of broken jpegs.

    1. Jpeg appears to be exported using photoshop encode for web feature:

      broken_img_header.png

    2. Most likely it’s the gui part of the printer, but it’s broken. Will study a bit more to understand how to unpack it.

Notes

0x00 padding is important for squashfs. Trim some zeros and it will fail to extract

We are missing the gui part of the printer. Most likely is done in qt. libqtga.so is present. Where is the gui? In the second squashfs?