Firmware Extractor

Many industrial routers, controllers and gateways only get their firmware at the factory. There is no download portal, or the portal requires a contract. The device itself has the firmware, in its flash. The Extractor reads it there, with the SSH access the administrator already has, and hands the image to the analysis.

The upload and the analysis stay as they are; the Extractor only fetches the file.

1. 1

   $ lm-extract install

   Install. A single static binary you just run.

2. 2

   $ lm-extract login

   Sign in. With your LegacyMind account. The token then sits in the operating system's keychain, never in plain text on disk.

3. 3

   $ lm-extract pull --host <device-ip>

   Extract. Connects to the device over SSH, detects the flash partitions, reads them out and hands the image to the analysis.

For running without a terminal there is --json for machine-readable output, and an API token instead of the interactive sign-in. With these the call runs from cron or from a pipeline.

1. The administrator's computer connects to the device over SSH across the local network. Port 22, key from ~/.ssh. No inbound ports, no cloud routing.
2. The tool detects the device's flash partitions and reads them out. It writes nothing to the device and installs nothing.
3. The image goes encrypted into the LegacyMind workspace. The local copy sits in a temporary directory and is deleted after the upload; --keep keeps it.
4. The analysis starts without a second step. The result appears in the platform's device overview, as with an uploaded image.

Name

lm-extract

Status

Closed beta

Form

a single static binary, no runtime dependencies

Operating systems

Linux (amd64, arm64) · macOS (Intel, Apple Silicon) · Windows (amd64)

Device access

SSH over the local network, port 22, key authentication, read-only

Credentials

Token in the operating system's keychain: macOS Keychain, Linux Secret Service or KWallet, Windows Credential Manager. SSH keys from ~/.ssh.

Outbound traffic

only the sign-in to LegacyMind and the upload of the image

Local copy

temporary, deleted after upload; --keep keeps it

Automation

--json, API token for headless operation, schedulable via cron

Linux-based (OpenWrt, DD-WRT, Yocto)

SSH, image via dd or sysupgrade

Generic embedded Linux

SSH, image from /dev/mtdblock

• Devices without SSH

  Without SSH access the tool reads nothing. The firmware file then goes through the upload into the same analysis.

• Vendor-encrypted images

  An image the vendor has encrypted is not decrypted. The analysis reports that it could not read the content and claims nothing about it.

• Changes to the device

  The Extractor only reads. Everything on the device stays as it was.

• Network analysis

  The tool watches no traffic and inventories no network. It reads a file from a device whose address it knows.

• §Use only by authorised people in agreed maintenance windows.
• §Read-only SSH access with its own key. No agent, nothing stays on the device.
• §Manual firmware upload as an equivalent path where SSH access is not permitted.
• §Key handling and access log documented in the platform.

The Extractor is handed out in guided trials. Tell us which device you want to read, with its device class and whether SSH is permitted on it. If the device is not in section 05, we say so beforehand.