Splitting and decompressing:
$ binwalk se366_fw_v3.07.bin DECIMAL HEXADECIMAL DESCRIPTION 0 0x0 Siemens SE366 firmware header 256 0x100 Linux kernel (LZMA compressed) 1024000 0xFA000 SquashFS filesystem, little endian Siemens gigaset se366 wlan router firmware
struct se366_fw_header uint32_t magic; // 0x53453636 ("SE66") uint32_t version; uint32_t kernel_offset; uint32_t kernel_size; uint32_t rootfs_offset; uint32_t rootfs_size; uint32_t crc32; char board_name[32]; // "SE366" char build_date[16]; uint8_t reserved[180]; ; Using binwalk reveals: Splitting and decompressing: $ binwalk se366_fw_v3
/bin/ # BusyBox applets (ln, cat, echo, etc.) /sbin/ # init, ifconfig, route, arp, sysctl /usr/sbin/ # httpd, hostapd, dnsmasq, iptables, pppd /etc/ # Configuration scripts and default settings /lib/ # uClibc 0.9.28, kernel modules (wireless, switch) /var/ # tmpfs for runtime data (logs, DHCP leases) | Binary | Origin | Purpose | |--------|--------|---------| | httpd | Proprietary | Web management interface (CGI-like, uses environment variables) | | switch_config | Siemens | Configures Marvell 88E6060 switch via MDIO | | wireless_config | Siemens | Sets radio parameters, triggers hostapd | | led_control | Siemens | Manages front-panel LEDs (Power, WLAN, WAN, LAN1-4) | | nvram_tool | Siemens | Reads/writes NVRAM (stored in mtd3) | 4.3 Configuration Storage ( /dev/mtd3 ) The config partition contains a key-value store (similar to Broadcom NVRAM). Format: little endian struct se366_fw_header uint32_t magic