Once the structure is mapped, we extract the contents. If zsz53rla81 uses a standard SquashFS file system (common in Linux-based embedded devices), we can use unsquashfs to decompress the root filesystem.
Suddenly, the black box of the device opens up. You can see the /etc/config files, the busybox binaries, and the startup scripts. This is where the "secrets" live—hidden admin passwords, debug modes, or hardcoded server addresses.
Mount the squashfs partition:
sudo unsquashfs -d /tmp/zsz_root 120.squashfs
Now, make your changes. Common repack reasons for zsz53rla81:
After modifications, repack:
sudo mksquashfs /tmp/zsz_root new_root.squashfs -comp xz -b 256k
Re-assemble kernel + new rootfs + original header.
Method A: Using binwalk's dd templates
# Concatenate original header (0 to kernel_end) + new rootfs
dd if=zsz53rla81_firmware.bin of=header.bin bs=1 count=<kernel_end_offset>
cat header.bin new_rootfs.squashfs > zsz53rla81_modified.bin
Method B: Using firmware-tool.py (if available for this chipset)
python3 firmware-tool.py --build --vendor zsz --model 53rla81 --kernel vmlinux.bin --rootfs new_rootfs.squashfs