On Wednesday 22 December 2021 20:08:56 Tony Dinh wrote:
*** Run kwboot
# kwboot -t -p -B 115200 /dev/ttyUSB0 -D /localdisk/mtd0.t5335z Patching image boot signature to UART Aligning image header to Xmodem block size Waiting 2s and flushing tty Sending boot image header (512 bytes)... 25 % [.... ] Done Sending boot image data (607664 bytes)... 0 % [......................................................................] 1 % [......................................................................] 2 % [......................................................................]
<snip> 95 % [......................................................................] 97 % [......................................................................] 98 % [.......................................................... ] Done Finishing transfer [Type Ctrl-\ + c to quit]
*** Hung here! BootROM did not execute the image payload.
*** The file mtd0.t5335z is a dd dump from the SPI flash mtd0 with *** this command: *** # dd if=/dev/mtd0 of=mtd0.t5335z bs=768k conv=sync
<End log>
- Pali's observation:
It looks like Dove uses kwbimage v0 format with extensions, at least according to Function Spec. See 'Binary Code Extension' and 'Header Extension'. Currently kwboot and kwbimage supports v0 image only with one extension.
- My comments in response:
Indeed. I've seen that in the Functional Spec, too. The mdt0 binwalk also shows what looks like the extension header.
No. this is not extension header as it is at the beginning of the image.
DECIMAL HEXADECIMAL DESCRIPTION
118161 0x1CD91 Certificate in DER format (x509 v3), header length: 4, sequence length: 3 199169 0x30A01 Certificate in DER format (x509 v3), header length: 4, sequence length: 5464 380652 0x5CEEC CRC32 polynomial table, little endian 387072 0x5E800 CRC32 polynomial table, little endian 608166 0x947A6 LZMA compressed data, properties: 0x66,
These are offsets far away from the beginning. I doubt that binwalk would be able to parse some Marvell extension headers, specially even when native U-Boot tools cannot do it.
dictionary size: 0 bytes, uncompressed size: 147351982848 bytes
Thanks, Tony