Releases: onekey-sec/sasquatch
Releases · onekey-sec/sasquatch
sasquatch-v4.5.1-4
fix: rewrite sanity check to handle malformed filesystem from D-Link. squashfs-tools maintainer introduced a sanity check with commits 3954bbb8e44f54a7081d84ddb968c2c2f210ad09 and 734a85f5f117c2d92829a1874b952efa6c1d4f4d. These checks means sasquatch can't extract squashfs v2 filesystems from D-Link. Reproduction samples can be found here: - http://legacyfiles.us.dlink.com/DIR-600L/REVA/FIRMWARE/ - http://legacyfiles.us.dlink.com/DIR-515/REVA/FIRMWARE/ I'm still not sure if the error lies on D-Link for building malformed images or squashfs-tools for confusing squashfs v2 and v3 super block content. At this point I don't care and chose to disable the sanity check while keeping overflows in check. I don't see any side effects in terms of memory access or usage.
sasquatch-v4.5.1-3
fix: remove regression introduced by b269533. When the maintainers of squashfs-tools introduced non-fatal error hardening, they also introduced a regression for sasquatch. This was introduced by commit b26953313f99bff53f8d4f029ab8615d172791b7, where "If the writer thread fails to write a block to the output filesystem, treat this as a fatal error.". The problem is that these non-fatal error will happen when sasquatch enumerate through the different compression implementation, and especially with LZMA adaptive it appears. The fix is to explicitly ignore errors during the decompression attempts.
sasquatch-v4.5.1-2
Merge pull request #13 from onekey-sec/squashfsv2-support add proper support for squashfs v2
sasquatch-v4.5.1-1
Rebased on top of squashfs-tools 4.5.1
sasquatch-v1.0.1
build releases for aarch64 and arm32
sasquatch-v1.0
build release on sasquatch-v* tags