cnu-fpu

OK, we've got root access at the phone, and can do further researches inside the live system, there are many interesting things. But in my case it is easier to deal with firmware itself, as phone operating system doesn't have tools I need. Actually neither I have the phone itself. So I have to continue coping firmware binary trash.

Firmware is unpacked so now it's time to decide what are we trying to do with it. Let's start with simple things. Guys from http://voip-info.org wandered if it was possible to have root access to phone. Since there is Unix running on the phone, there should be a passwd file somewhere.  Begin with cutting signature out from file.

$./unsign.pl jar41sip.8-3-0-50.sbn cnu jar41sip.8-3-0-50.sbn-unsigned
Found signature offset: 408

Now unpack the file:

From the moment firmware tool I was writing evolved to be able to unpack firmwares, it has become possible to unpack Cisco 7941/7961 firmware for research purposes.

I'll write separate article about Cisco phones in general, and now some basics about firmware.

Main firmware package structure

So there is new shiny firmware, let's say cmterm-7941_7961-sip.8-3-1.zip.

After unpack there is such an exiting file list:

dsp41.8-3-0-50.sbn

jar41sip.8-3-0-50.sbn