[U-Boot] Save flash from U-Boot
I have a ZTE ZXV10 H201L, and want to back its flash up for future recovery and for getting the VOIP settings. Since the firmware is modified by the ISP, I have no access to it. It has U-Boot (with serial console) but some commands are missing:
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.06.24 17:35:15 =~=~=~=~=~=~=~=~=~=~=~=
ROM VER: 1.ñ
ROM VER: 1.1.3
CFG 01
DDR Access auto data-eye tuning Rev 0.3c
DDR size from 0xa0000000 - 0xa1ffffff
DDR check ok... start booting...
ZTE U-Boot V1.0.09 (Sep 9 2011 - 11:28:12)
Boot from NOR flash
AR9 BOARD
CLOCK CPU 333M RAM 166M
DRAM: 32 MB
relocate_code start
relocate_code finish.
Flash: 8 MB
*** Warning - bad CRC, using default environment
parse tag param success
In: serial
Out: serial
Err: serial
Net:
switch chip id=0000c852!!
amazon_s Switch
Type run flash_nfs to mount root filesystem over NFS
*** Press 1 means entering boot mode***
***Press 2 means entering testing mode***
***Press 3 means entering norm mode***
Hit key to stop autoboot: 3 2 0
Entering boot mode ...
AMAZON_S # ?
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bdinfo - print Board Info structure
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
echo - echo args to console
erase - erase FLASH memory
flinfo - print FLASH memory information
go - start application at address 'addr'
help - print online help
httpd - start http server
imls - list all images found in flash
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
setenv - set environment variables
SPI flash sub-systemsflash - SPI FLASH sub-system
sleep - delay execution for some time
tag - set or get or list tag parmeters
version - print monitor version
AMAZON_S # base
Base Address: 0x00000000
AMAZON_S # bdinfo
boot_params = 0x81DDEFB0
memstart = 0x80000000
memsize = 0x02000000
flashstart = 0xB0000000
flashsize = 0x00800000
flashoffset = 0x00000000
ethaddr = (a mac addr)
ip_addr = 192.168.1.254
baudrate = 115200 bps
AMAZON_S # printenv
bootcmd=run flash_flash
bootdelay=3
baudrate=115200
preboot=echo;echo Type "run flash_nfs" to mount root filesystem over NFS;echo
serverip=192.168.1.55
netdev=eth0
baudrate=115200
rootpath=/opt/nfs
nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):on
mem=32M
vpe0mem=30M
vpe1mem=2M
vpe1_load_addr=0x81e00000
addmisc=setenv bootargs $(bootargs) console=ttyS1,$(baudrate) ethaddr=$(ethaddr) phym=$(mem) mem=$(vpe0mem) panic=1 vpe1_load_addr=$(vpe1_load_addr) vpe1_mem=$(vpe1mem) vpe1_wired_tlb_entries=1
flash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)
ramdisk_addr=B0100000
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
img_uboot=u-boot.ifx
net_nfs=tftp 80500000 $(img_kernel);run nfsargs addip addmisc;bootm
net_ram=tftp 80500000 $(img_kernel);run ramargs addip addmisc;bootm
load=tftp 80500000 $(img_uboot)
flash_flash=run addip addmisc; bootm $(kernel_addr)
f_ubootconfig_addr=0xB001A000
f_ubootconfig_size=0x1000
ethaddr=(a mac addr)
ipaddr=192.168.1.254
netmask=255.255.255.0
stdin=serial
stdout=serial
stderr=serial
ethact=amazon_s Switch
Environment size: 1254/4092 bytes
AMAZON_S #
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.06.24 17:35:15 =~=~=~=~=~=~=~=~=~=~=~=
As I know cp can copy from TFTP to flash. Is it possible backward? If it cannot be solved through serial port, I may use JTAG. I just want to do it as simply as possible.
Dear "Szabolcs Sipos",
In message 000301ce7196$32f25b20$98d71160$@balfug.com you wrote:
I have a ZTE ZXV10 H201L, and want to back its flash up for future recovery and for getting the VOIP settings. Since the firmware is modified by the ISP, I have no access to it. It has U-Boot (with serial console) but some commands are missing:
The easiest way (at least in theory) is to ask your provider for the source code. AsU-Boot is covered by GPL, they must provide you the full source code when you request it.
Best regards,
Wolfgang Denk
Dear Wolfgang Denk,
Unfortunately the bootloader isn't modified by the ISP, only the main firmware. If a knew that the main firmware was also covered by GPL, I would ask them but I am sure they would tell me nothing, they don't tell even my VOIP password.
Szabolcs Sipos
-----Original Message----- From: Wolfgang Denk [mailto:wd@denx.de] Sent: Tuesday, June 25, 2013 6:49 PM To: Szabolcs Sipos Cc: u-boot@lists.denx.de Subject: Re: [U-Boot] Save flash from U-Boot
Dear "Szabolcs Sipos",
In message 000301ce7196$32f25b20$98d71160$@balfug.com you wrote:
I have a ZTE ZXV10 H201L, and want to back its flash up for future recovery and for getting the VOIP settings. Since the firmware is modified by the ISP, I have no access to it. It has U-Boot (with serial console) but some commands are missing:
The easiest way (at least in theory) is to ask your provider for the source code. AsU-Boot is covered by GPL, they must provide you the full source code when you request it.
Best regards,
Wolfgang Denk
Dear "Szabolcs Sipos",
In message 000101ce71cd$34a620a0$9df261e0$@balfug.com you wrote:
Unfortunately the bootloader isn't modified by the ISP, only the main firmware. If a knew that the main firmware was also covered by GPL, I would ask them but I am sure they would tell me nothing, they don't tell even my VOIP password.
I'm afraid I don't understand your situation. If you have the U-Boot code, you could add the missing commands, and just install teh new U-Boot, leaving the rest of the firmware untouched?
As for backup, if everything else goes wrong, you can just run a "md" over the whole U-Boot code area, and capture the outpput to a file (say, by running your terminal program in a "script" session if it does not support recording directly). Recoding the "md" output into a binary blob is a trivial thing to do; a quick & dirty hack could look like that:
--------------------------- snip --------------------------- #!/usr/bin/perl -w
# Un-dump hexdump listing and write binary image to stdout. # 002044F4 3C353E5B 20202020 302E3030 30303030 <5>[ 0.000000 # 00204504 5D204C69 6E757820 76657273 696F6E20 ] Linux version # 00204514 322E362E 32322E36 20286D61 7263656C 2.6.22.6 (marcel # 00204524 40736861 646F776C 61702920 28676363 @shadowlap) (gcc # 00204534 20766572 73696F6E 20342E31 2E322028 version 4.1.2 ( # ... #
while (<>) { chomp; my (@tmp) = split; for ($i=1; $i<5; $i++) { syswrite(STDOUT, pack ("N", hex ($tmp[$i]))); } } --------------------------- snip ---------------------------
Best regards,
Wolfgang Denk
Dear Wolfgang Denk,
My ISP doesn't have the source of U-Boot because they left the original one (from ZTE) on the router. They modified the main firmware only. I want to make a dump from the hall flash and then install a new main firmware. I tried md but it made the router restart (except with address 0x00000000).
Szabolcs Sipos
-----Original Message----- From: Wolfgang Denk [mailto:wd@denx.de] Sent: Tuesday, June 25, 2013 8:32 PM To: Szabolcs Sipos Cc: u-boot@lists.denx.de Subject: Re: [U-Boot] Save flash from U-Boot
Dear "Szabolcs Sipos",
In message 000101ce71cd$34a620a0$9df261e0$@balfug.com you wrote:
Unfortunately the bootloader isn't modified by the ISP, only the main firmware. If a knew that the main firmware was also covered by GPL, I would ask them but I am sure they would tell me nothing, they don't tell even my VOIP password.
I'm afraid I don't understand your situation. If you have the U-Boot code, you could add the missing commands, and just install teh new U-Boot, leaving the rest of the firmware untouched?
As for backup, if everything else goes wrong, you can just run a "md" over the whole U-Boot code area, and capture the outpput to a file (say, by running your terminal program in a "script" session if it does not support recording directly). Recoding the "md" output into a binary blob is a trivial thing to do; a quick & dirty hack could look like that:
--------------------------- snip --------------------------- #!/usr/bin/perl -w
# Un-dump hexdump listing and write binary image to stdout. # 002044F4 3C353E5B 20202020 302E3030 30303030 <5>[ 0.000000 # 00204504 5D204C69 6E757820 76657273 696F6E20 ] Linux version # 00204514 322E362E 32322E36 20286D61 7263656C 2.6.22.6 (marcel # 00204524 40736861 646F776C 61702920 28676363 @shadowlap) (gcc # 00204534 20766572 73696F6E 20342E31 2E322028 version 4.1.2 ( # ... #
while (<>) { chomp; my (@tmp) = split; for ($i=1; $i<5; $i++) { syswrite(STDOUT, pack ("N", hex ($tmp[$i]))); } } --------------------------- snip ---------------------------
Best regards,
Wolfgang Denk
participants (2)
-
Szabolcs Sipos -
Wolfgang Denk