unpacking iDRAC9/iDRAC10 (dracula 🦇)

Awhile back I unpacked some older idrac firmware for fun… had to jump through some hoops to do so, so when I had to unpack idrac9/idrac10 firwmare, decided to improve on the older script with claude code.

So unpack-drac. It requires: unsquashfs, dumpimage, binwalk, unzip (on a mac – brew install squashfs-tools u-boot-tools binwalk)

$ unpack-drac.sh *BIN
==> input : iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.BIN
==> output: iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked
==> Stage 1 — Dell DUP detected (POSIX shell script executable (binary data))
==> Stage 1a — trying zip extraction (iDRAC10-style)
[!] direct unzip failed; carving zip at offset 36556950
[!] zip extraction failed; trying 7z+tar (iDRAC9-style shell self-extractor)
==> Stage 1a(alt) — 7z x DUP -> tar archive
==> Stage 1b(alt) — tar xvf iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00 -> DUP payload
version: 7.10.90.00
==> Stage 2 — unpacking firmimg (iDRAC9, .d9): firmimgFIT.d9
format: U-Boot FIT (iDRAC9-style) -> dumpimage
FIT description: IDRAC multi-image firmware Container
Created: Sun Oct 20 06:06:17 2024
Image 0 (mbr.bin@1)
Description: Master Boot Record
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 512 Bytes = 0.50 KiB = 0.00 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: d419e2aead62f74c2a055ff7b30db7ca14035ef29797824f73475e0727154a60
Image 1 (recovery.itb@1)
Description: Recovery kernel (TODO make itb)
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 8388608 Bytes = 8192.00 KiB = 8.00 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: 32778600f08454454e9a7356331155b2ec433684e0e467f7f6d05de304d4675b
Image 2 (u-boot@1)
Description: U-Boot201510
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 524288 Bytes = 512.00 KiB = 0.50 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: ade594fdf3fdb2882e89fb3efbb67a8f7a2bd51cf63efa9b6e8ec148666b2689
Image 3 (rootfs.squashfs@1)
Description: Rootfs - SquashFS
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Extracted:
Image 0 (mbr.bin@1)
Description: Master Boot Record
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 512 Bytes = 0.50 KiB = 0.00 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: d419e2aead62f74c2a055ff7b30db7ca14035ef29797824f73475e0727154a60
extracted FIT sub-image 0
Extracted:
Image 1 (recovery.itb@1)
Description: Recovery kernel (TODO make itb)
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 8388608 Bytes = 8192.00 KiB = 8.00 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: 32778600f08454454e9a7356331155b2ec433684e0e467f7f6d05de304d4675b
extracted FIT sub-image 1
Extracted: Image 2 (u-boot@1) Description: U-Boot201510 Created: Sun Oct 20 06:06:17 2024 Type: Firmware Compression: uncompressed Data Size: 524288 Bytes = 512.00 KiB = 0.50 MiB
Architecture: ARM
OS: Linux Load Address: 0x00000000 Hash algo: sha256
Hash value: ade594fdf3fdb2882e89fb3efbb67a8f7a2bd51cf63efa9b6e8ec148666b2689
extracted FIT sub-image 2
Extracted:
Image 3 (rootfs.squashfs@1)
Description: Rootfs - SquashFS
Created: Sun Oct 20 06:06:17 2024
Type: Firmware Compression: uncompressed
Data Size: 179564544 Bytes = 175356.00 KiB = 171.25 MiB
Architecture: ARM OS: Linux
Load Address: 0x00000000
Hash algo: sha256 Hash value: dca5a594fbc2bcc1805259b61da59a5336d05a93225d005576c5c6f8cd95bfa6
extracted FIT sub-image 3
Extracted:
Image 4 (platform_data.squashfs@1)
Description: PlatformData - SquashFS
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 26394624 Bytes = 25776.00 KiB = 25.17 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: 84227e6589df711a2419a5169a4562ca4f00d1e67ede0ed560b0993c75fcbe9d
extracted FIT sub-image 4
Extracted:
Image 5 (kmipclient.squashfs@1)
Description: KMIPclient lib - SquashFS
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 294912 Bytes = 288.00 KiB = 0.28 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256 Hash value: 04228f1bb6f9e51fc31427dc3f1c0668377491e48fac4c9e1ec5f6d37f5c524a
extracted FIT sub-image 5
Extracted:
Image 6 (md.itb@1)
Description: unavailable
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 8980534 Bytes = 8770.05 KiB = 8.56 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: 7505425a600f624ea0be1e534ba0c8ed2fd565e5d3c11e715837b044fcf20d4f
extracted FIT sub-image 6
Extracted:
Image 7 (pdtb.itb@1)
Description: Platform pinctrl Data
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 1666 Bytes = 1.63 KiB = 0.00 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: 5b516d3337732960121b72af5bea6f631711027b17a2ae33665a17ad8a22e8dd
extracted FIT sub-image 7
Extracted:
Image 8 (rootfsHashTree@1)
Description: unavailable
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 1425408 Bytes = 1392.00 KiB = 1.36 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: a26cec95759895423492499b7d5240b714dbf191cfa8fa6c05457bb2dcfc97e4
extracted FIT sub-image 8
Extracted:
Image 9 (fecDevice@1)
Description: unavailable
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 7413760 Bytes = 7240.00 KiB = 7.07 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256 Hash value: 0c2e6546e0926e07cf42597a34529e0a73e1f48307f2895c70d74cbc8b080202
extracted FIT sub-image 9
Extracted:
Image 10 (KMIPHashTree@1)
Description: unavailable
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 8192 Bytes = 8.00 KiB = 0.01 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: 99b685d97bbbc8112e2727b83b79feafdee8dc499cf0c25a49a9b3bd70a3fea1
extracted FIT sub-image 10
Extracted:
Image 11 (KMIPfecDevice@1)
Description: unavailable
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 40960 Bytes = 40.00 KiB = 0.04 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: b124f4b0ee863de8d876730ecadf461a15a91d6484b7356f74b473838d5fb140
extracted FIT sub-image 11
Extracted:
Image 12 (PDHashTree@1)
Description: unavailable
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 217088 Bytes = 212.00 KiB = 0.21 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: a3f2502726f2b48981d0d720a20466f9c0819b7bf80a1a6d2737041803fe49a3
extracted FIT sub-image 12
Extracted:
Image 13 (PDfecDevice@1)
Description: unavailable
Created: Sun Oct 20 06:06:17 2024
Type: Firmware
Compression: uncompressed
Data Size: 1105920 Bytes = 1080.00 KiB = 1.05 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Hash algo: sha256
Hash value: ab3f48201d19bd347ee4ea147308a609ba9a0f46776b1f687db7839ac7719788
extracted FIT sub-image 13
renamed fit_img_0 -> mbr.bin
renamed fit_img_1 -> recovery.itb
renamed fit_img_2 -> u-boot
renamed fit_img_3 -> rootfs.squashfs
renamed fit_img_4 -> platform-data.squashfs
renamed fit_img_5 -> kmipclient.squashfs
renamed fit_img_6 -> md.itb
renamed fit_img_7 -> pdtb.itb
renamed fit_img_8 -> rootfsHashTree
renamed fit_img_9 -> fecDevice
renamed fit_img_10 -> KMIPHashTree
renamed fit_img_11 -> KMIPfecDevice
renamed fit_img_12 -> PDHashTree
renamed fit_img_13 -> PDfecDevice
==> Stage 3 — extracting squashfs filesystems
unsquashfs rootfs.squashfs -> fw-filesystems/rootfs/
compression: lzo
-> 16085 files via unsquashfs (145 zero-length); root: iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked/fw-filesystems/rootfs
unsquashfs platform-data.squashfs -> fw-filesystems/platform-data/
compression: gzip
-> 822 files via unsquashfs (1 zero-length); root: iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked/fw-filesystems/platform-data
unsquashfs kmipclient.squashfs -> fw-filesystems/kmipclient/
compression: gzip
-> 1 files via unsquashfs (0 zero-length); root: iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked/fw-filesystems/kmipclient
==> Stage 4 — nested ITB sub-FIT images
dumpimage -l pdtb.itb
dumpimage -l recovery.itb
dumpimage -l md.itb
==> DONE.

==> Summary:
gen : iDRAC9
version : 7.10.90.00
filesystems : iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked/fw-filesystems/rootfs iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked/fw-filesystems/platform-data iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked/fw-filesystems/kmipclient
manifest : iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked/MANIFEST.txt
output : iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked

It creates a subdir – whatever.unpacked – that has all the goods.

$ cd iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.unpacked/
$ ll
total 48
0 drwx------ 10 zen staff 320 Jun 28 13:45 ./
0 drwx------ 5 zen staff 160 Jun 28 13:45 ../
0 drwx------ 31 zen staff 992 Jun 28 13:45 fw-dup-payload/
0 drwx------ 5 zen staff 160 Jun 28 13:45 fw-filesystems/
0 drwx------ 17 zen staff 544 Jun 28 13:45 fw-fit-blobs/
0 drwx------ 5 zen staff 160 Jun 28 13:45 fw-itb/
4 -rw------- 1 zen staff 2515 Jun 28 13:45 MANIFEST.txt
32 -rwx------ 1 zen staff 32036 Jun 28 13:45 package.xml*
4 -rw------- 1 zen staff 1475 Jun 28 13:45 README.txt
8 -rwx------ 1 zen staff 7286 Jun 28 13:45 Version.txt*
$ cat README.txt
iDRAC9 firmware — version 7.10.90.00
Unpacked by unpack-idrac on Sun Jun 28 13:45:59 PDT 2026
Source: iDRAC-with-Lifecycle-Controller_Firmware_92MM7_LN64_7.10.90.00_A00.BIN

LAYOUT
fw-dup-payload/ Files extracted from the DUP self-installer.
Version.txt and package.xml are the authoritative version source.
fw-fit-blobs/ Raw FIT sub-image blobs, named by FIT label.
FIT.listing.txt maps every blob to its index, description, and hash.
fw-filesystems/ Extracted squashfs filesystem trees, one dir per squashfs image:
rootfs/ (16085 files)
platform-data/ (822 files)
kmipclient/ (1 files)
fw-itb/ Listings of nested ITB sub-FIT images (kernel/dtb).
Typically empty for iDRAC9; populated for iDRAC10.
MANIFEST.txt Machine-readable log: sha256s, extractor used, file counts.

IDENTIFYING THE iDRAC GENERATION
Dell does not embed a generation field in the DUP or Version.txt.
Generation is identified by:
1. firmimg extension (.d9 = iDRAC9, .d10 = iDRAC10, .d8 = iDRAC8) [most reliable]
2. fw-filesystems/rootfs/etc/yocto-machine.env -> MACHINE=mach-idrac9
3. Version.txt firmware version range (3.x-7.x = iDRAC9, 1.x = iDRAC10)
4. Supported system models in Version.txt (14G/15G/16G = iDRAC9, 17G+ = iDRAC10)
This firmware: iDRAC9 (detected from firmimg extension .d9)
$

And the filesystems/unpacked files are all there –

$ ll fw-filesystems/
total 0
0 drwx------ 5 zen staff 160 Jun 28 13:45 ./
0 drwx------ 10 zen staff 320 Jun 28 13:45 ../
0 drwxr-xr-x 3 zen staff 96 Apr 5 2011 kmipclient/
0 drwxr-xr-x 131 zen staff 4192 Apr 5 2011 platform-data/
0 drwxr-xr-x 26 zen staff 832 Apr 5 2011 rootfs/

$ ll fw-filesystems/rootfs/
total 0
0 drwxr-xr-x 26 zen staff 832 Apr 5 2011 ./
0 drwx------ 5 zen staff 160 Jun 28 13:45 ../
0 drwxr-xr-x 3 zen staff 96 Apr 5 2011 avct/
0 drwxr-xr-x 290 zen staff 9280 Apr 5 2011 bin/
0 drwxr-xr-x 2 zen staff 64 Apr 5 2011 boot/
0 drwxr-xr-x 3 zen staff 96 Apr 5 2011 com/
0 drwxr-xr-x 2 zen staff 64 Apr 5 2011 dev/
0 drwxr-xr-x 175 zen staff 5600 Apr 5 2011 etc/
0 drwxr-xr-x 10 zen staff 320 Apr 5 2011 flash/
0 drwxr-xr-x 6 zen staff 192 Apr 5 2011 home/
0 drwxr-xr-x 102 zen staff 3264 Apr 5 2011 lib/
0 drw-r--r-- 3 zen staff 96 Apr 5 2011 maser-zip/
0 drwxr-xr-x 2 zen staff 64 Apr 5 2011 media/
0 lrwx------ 1 zen staff 35 Apr 5 2011 messages -> /mnt/persistent_data/data0/messages
0 lrwx------ 1 zen staff 25 Apr 5 2011 mmc1 -> /mnt/persistent_data/mmc1
0 lrwx------ 1 zen staff 25 Apr 5 2011 mmc2 -> /mnt/persistent_data/mmc2
0 drwxr-xr-x 9 zen staff 288 Apr 5 2011 mnt/
0 drwxr-xr-x 3 zen staff 96 Apr 5 2011 opt/
0 drwxr-xr-x 2 zen staff 64 Apr 5 2011 out/
0 dr-xr-xr-x 2 zen staff 64 Apr 5 2011 proc/
0 drwxr-xr-x 2 zen staff 64 Apr 5 2011 run/
0 drwxr-xr-x 126 zen staff 4032 Apr 5 2011 sbin/
0 dr-xr-xr-x 2 zen staff 64 Apr 5 2011 sys/
0 drwxrwxrwt 2 zen staff 64 Apr 5 2011 tmp/
0 drwxr-xr-x 12 zen staff 384 Apr 5 2011 usr/
0 drwxr-xr-x 15 zen staff 480 Apr 5 2011 var/
$

Also tested on iDRAC10 download – iDRAC-with-Lifecycle-Controller_Firmware_YP95X_LN64_1.30.10.50_A00.BIN

Attachments

unpack-idrac (13 kB)

unpacking iDRAC9/iDRAC10 (dracula 🦇)

Attachments

You May Also Like

unpacking Dell’s iDRAC schtuff

mega mega mega… chan chan chan….

Leave a Reply Cancel