IOS repacking

Dec 13, 2009 21:38


"mz" IOSes can be squeezed using 7zip compression, which is compatible with ZIP format and has better ratio. Typically it's 3-5% reduction of file size.

Caution: this technique violates legal rights and reduces flash memory sales.

I've used this hack for many years and different platforms, it always worked since it touches only the boot phase and if you've booted you're already ok.

Let's do the trick step by step, for example with c1600-sy-mz.122-46a.bin size 4'285'105 that is slightly bigger then 4 MB = 4'194'304 bytes.

Split original binary on two parts, loader and archive. Archive part starts with usual "PK" magic bytes so in our case the loader is 10'540 bytes, and unpacked C1600-SY.BIN is 9'320'776 bytes.

Repack BIN with 7zip "ultimate" "deflate" compression, that will give 4'136'458 bytes instead of original size 4'274'565.

Fix headers in loader, one number is at offset 8 from the beginning and another is at -12 from the end.   There is also a checksum at -8 from the end but it's easier to let router to calculate it instead of guessing it by yourself.

So concatenate fixed loader and repacked archive, try to boot and you will get something like

Error : compressed image checksum is incorrect 0xF7975E88 Expected a checksum of 0x6C794F36

Fix those numbers too and voila:

c1601#sh ver | i IOS|flash IOS (tm) 1600 Software (C1600-SY-M), Version 12.2(46a), RELEASE SOFTWARE (fc1) System image file is "flash:c1600-sy-mz.122-46a-mtve.bin" 4096K bytes of processor board PCMCIA flash (Read/Write) c1601#dir Directory of flash:/ 1 -rw- 4146998 c1600-sy-mz.122-46a-mtve.bin 4194300 bytes total (47236 bytes free)

Better compression (25-30%) could be achieved with LZMA algorithm of 7z but it requires porting and compiling of decompression code to target platform.
Previous post Next post
Up