Binwalk misses the first instance of JFFS2 magics leading to messed up extractions

[Bendimester23]

I have a 16Mb dump from an SPI flash that has the following partitions:

U-Boot at 0x0
Linux kernel at 0x80000
Root JFFS2 at 0x280000
App JFFS2 at 0x500000

But binwalk recognises it as this:

Here is the start of the rootfs vs where binwalk thinks it is:

[drygdryg]

Try to build binwalk from the master (the latest development version).
I faced a similar issue, and it was recently fixed in #890

[devttys0]

Interesting, that first JFFS2 marker's node type (0x0003) does not appear to correspond to any node type defined in jffs2.h. Can you provide a copy of the firmware image?

[Bendimester23]

ipcam.zip

[devttys0]

@Bendimester23 Thank you! I took a look at the JFFS2 image.

That first JFFS2 node at offset 0x280000 is not valid. It has a non-standard node type, and the node checksum is invalid.

@drygdryg is correct that the recent changes to the master branch do fix the multiple JFFS2 images reported by binwalk. With the master branch, it reports only a single JFFS2 image starting with the first valid JFFS2 node at offset 0x280198.

However, extraction still appears to be incorrect. While the resulting directory structure in jffs2-root looks correct, the file contents are not correct (/etc/passwd, for example, appears to contain some javascript code). It would seem to me that either the image is corrupted (maybe a bad flash dump?) or there is a bug in the jefferson utility, which is what binwalk uses to extract JFFS2 images.