Mounting
Raw File
VM with partitions
Useful when you're not able to access the VM through ssh or login.
mkdir /mnt/168
mount -o ro,loop,offset=1048576 -t auto /var/lib/vz/images/168/vm-168-disk-1.raw /mnt/168
Notes:
offset
is computed fromstart sector * size of a sector in bytes
. You can retrieve these informations throughfdisk -u sectors -l /var/lib/vz/images/168/vm-168-disk-1.raw
- remove
ro,
if you need to write
LXC
Mounting
losetup /dev/loop0 /var/lib/vz/images/100/vm-100-disk-1.raw
mount /dev/loop0p1 /mnt/tmpdiskrescue
Note: I think it's possible to avoid losetup ...
by using mount -o loop
which will automatically find an available loopX
Umounting
umount /mnt/tmpdiskrescue
losetup -d /dev/loop0
Get informations from a binary image
You can use binwalk
See an example with an OpenWRT image:
binwalk openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 Flattened device tree, size: 3879108 bytes, version: 17
236 0xEC LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 12048392 bytes
3848628 0x3AB9B4 Flattened device tree, size: 29127 bytes, version: 17
3932160 0x3C0000 Squashfs filesystem, little endian, version 4.0, compression:xz, size: 5916012 bytes, 1096 inodes, blocksize: 262144 bytes, created: 2023-11-14 13:38:11
However, binwalk is heavy. An alternative is to use simple commands (less verbose, but lightweight) permitting to spot the partitions (if you know which one are in the image), then mount it (to read).
# search for partition SquashFS header (list of header available at https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/magic.h)
# which is 0x73717368
hexdump openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin -C | grep '73 71 73'
#003c0000 68 73 71 73 48 04 00 00 43 78 53 65 00 00 04 00 |hsqsH...CxSe....|
# extract the squashfs partition
# first let see the sector size
fdisk -lu openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin
#Disk openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin: 9.5 MiB, 9961984 bytes, 19457 sectors
#Units: sectors of 1 * 512 = 512 bytes
#Sector size (logical/physical): 512 bytes / 512 bytes
#I/O size (minimum/optimal): 512 bytes / 512 bytes
# its 512 bytes, let start at the right place (header offset bytes / sector size)
dd if=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin of=openwrt.squashfs skip=$((16#003C0000 / 512))
# NOTE 1: in this case squashfs was the latest partition and occupied all the remaining space.
# in other scenarios you might have to set seek=
# NOTE 2: with binwalk you can extract all FS with `binwalk --dd='.*' openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin`
# in a container you might need `--run-as=root`
# control we extract what we want
file openwrt.squashfs
#openwrt.squashfs: Squashfs filesystem, little endian, version 4.0, xz compressed, 5916012 bytes, 1096 inodes, blocksize: 262144 bytes, created: Tue Nov 14 13:38:11 2023
# we can mount (yay)
sudo mount -o ro,loop -t squashfs openwrt.squashfs /mnt/tmp
ls /mnt/tmp/
#bin dev etc init lib lib64 mnt overlay proc rom root sbin sys tmp usr var www
# alternatively to a mount you can do `unsquashfs openwrt.squashfs`
# in case of ohter simplier file system you might directly use offset=
mount -o ro,loop,offset=... -t squashfs openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-squashfs-sysupgrade.bin /mnt/tmp