[U-Boot] Save flash from U-Boot

[U-Boot] Save flash from U-Boot

[Szabolcs Sipos]

I have a ZTE ZXV10 H201L, and want to back its flash up for future recovery
and for getting the VOIP settings. Since the firmware is modified by the
ISP, I have no access to it. It has U-Boot (with serial console) but some
commands are missing:

 

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.06.24 17:35:15
=~=~=~=~=~=~=~=~=~=~=~=

ROM VER: 1.?

ROM VER: 1.1.3

CFG 01

DDR Access auto data-eye tuning Rev 0.3c

DDR size from 0xa0000000 - 0xa1ffffff

DDR check ok... start booting...

 

 

 

ZTE U-Boot V1.0.09 (Sep  9 2011 - 11:28:12)

 

Boot from NOR flash

AR9 BOARD

CLOCK CPU 333M RAM 166M

DRAM:  32 MB

 

relocate_code start

relocate_code finish.

Flash:  8 MB

*** Warning - bad CRC, using default environment

 

parse tag param success

In:    serial

Out:   serial

Err:   serial

Net:   

switch chip id=0000c852!!

amazon_s Switch

 

Type run flash_nfs to mount root filesystem over NFS

 

*** Press 1 means entering boot mode***

***Press 2 means entering testing mode***

***Press 3 means entering norm mode***

Hit key to stop autoboot:  3 \b\b\b 2 \b\b\b 0 

Entering boot mode ...

 

AMAZON_S # ?

 

?       - alias for 'help'

askenv  - get environment variables from stdin

autoscr - run script from memory

base    - print or set address offset

bdinfo  - print Board Info structure

bootm   - boot application image from memory

bootp    - boot image via network using BootP/TFTP protocol

cmp     - memory compare

cp      - memory copy

crc32   - checksum calculation

echo    - echo args to console

erase   - erase FLASH memory

flinfo  - print FLASH memory information

go      - start application at address 'addr'

help    - print online help

httpd    - start http server

imls    - list all images found in flash

loop    - infinite loop on address range

md      - memory display

mm      - memory modify (auto-incrementing)

mtest   - simple RAM test

mw      - memory write (fill)

nm      - memory modify (constant address)

printenv- print environment variables

protect - enable or disable FLASH write protection

rarpboot- boot image via network using RARP/TFTP protocol

reset   - Perform RESET of the CPU

run     - run commands in an environment variable

setenv  - set environment variables

SPI flash sub-systemsflash  - SPI FLASH sub-system

sleep   - delay execution for some time

tag     - set or get or list tag parmeters

version - print monitor version

AMAZON_S # base

 

Base Address: 0x00000000

AMAZON_S # bdinfo

 

boot_params = 0x81DDEFB0

memstart    = 0x80000000

memsize     = 0x02000000

flashstart  = 0xB0000000

flashsize   = 0x00800000

flashoffset = 0x00000000

ethaddr     = (a mac addr)

ip_addr     = 192.168.1.254

baudrate    = 115200 bps

AMAZON_S # printenv

 

bootcmd=run flash_flash

bootdelay=3

baudrate=115200

preboot=echo;echo Type "run flash_nfs" to mount root filesystem over
NFS;echo

serverip=192.168.1.55

netdev=eth0

baudrate=115200

rootpath=/opt/nfs

nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)

ramargs=setenv bootargs root=/dev/ram rw

addip=setenv bootargs $(bootargs)
ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):on

mem=32M

vpe0mem=30M

vpe1mem=2M

vpe1_load_addr=0x81e00000

addmisc=setenv bootargs $(bootargs) console=ttyS1,$(baudrate)
ethaddr=$(ethaddr) phym=$(mem) mem=$(vpe0mem) panic=1
vpe1_load_addr=$(vpe1_load_addr) vpe1_mem=$(vpe1mem)
vpe1_wired_tlb_entries=1

flash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)

ramdisk_addr=B0100000

flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)

img_uboot=u-boot.ifx

net_nfs=tftp 80500000 $(img_kernel);run nfsargs addip addmisc;bootm

net_ram=tftp 80500000 $(img_kernel);run ramargs addip addmisc;bootm

load=tftp 80500000 $(img_uboot)

flash_flash=run addip addmisc; bootm $(kernel_addr)

f_ubootconfig_addr=0xB001A000

f_ubootconfig_size=0x1000

ethaddr=(a mac addr)

ipaddr=192.168.1.254

netmask=255.255.255.0

stdin=serial

stdout=serial

stderr=serial

ethact=amazon_s Switch

 

Environment size: 1254/4092 bytes

AMAZON_S # 

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.06.24 17:35:15
=~=~=~=~=~=~=~=~=~=~=~=

 

As I know cp can copy from TFTP to flash. Is it possible backward? If it
cannot be solved through serial port, I may use JTAG. I just want to do it
as simply as possible.

[U-Boot] Save flash from U-Boot

[Wolfgang Denk]

Dear "Szabolcs Sipos",

In message <000301ce7196$32f25b20$98d71160$@balfug.com> you wrote:
> 
> I have a ZTE ZXV10 H201L, and want to back its flash up for future
> recovery
> and for getting the VOIP settings. Since the firmware is modified by the
> ISP, I have no access to it. It has U-Boot (with serial console) but
> some
> commands are missing:

The easiest way (at least in theory) is to ask your provider for the
source code.  AsU-Boot is covered by GPL, they must provide you the
full source code when you request it.


Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
Testing can show the presense of bugs, but not their absence.
                                                   -- Edsger Dijkstra

[U-Boot] Save flash from U-Boot

[Szabolcs Sipos]

Dear Wolfgang Denk,

Unfortunately the bootloader isn't modified by the ISP, only the main firmware. If a knew that the main firmware was also covered by GPL, I would ask them but I am sure they would tell me nothing, they don't tell even my VOIP password.

Szabolcs Sipos

-----Original Message-----
From: Wolfgang Denk [mailto:wd at denx.de] 
Sent: Tuesday, June 25, 2013 6:49 PM
To: Szabolcs Sipos
Cc: u-boot at lists.denx.de
Subject: Re: [U-Boot] Save flash from U-Boot

Dear "Szabolcs Sipos",

In message <000301ce7196$32f25b20$98d71160$@balfug.com> you wrote:
> 
> I have a ZTE ZXV10 H201L, and want to back its flash up for future 
> recovery and for getting the VOIP settings. Since the firmware is 
> modified by the ISP, I have no access to it. It has U-Boot (with 
> serial console) but some commands are missing:

The easiest way (at least in theory) is to ask your provider for the source code.  AsU-Boot is covered by GPL, they must provide you the full source code when you request it.


Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de Testing can show the presense of bugs, but not their absence.
                                                   -- Edsger Dijkstra

[U-Boot] Save flash from U-Boot

[Wolfgang Denk]

Dear "Szabolcs Sipos",

In message <000101ce71cd$34a620a0$9df261e0$@balfug.com> you wrote:
> 
> Unfortunately the bootloader isn't modified by the ISP, only the main
> firmware. If a knew that the main firmware was also covered by GPL, I
> would ask them but I am sure they would tell me nothing, they don't tell
> even my VOIP password.

I'm afraid I don't understand your situation.  If you have the U-Boot
code, you could add the missing commands, and just install teh new
U-Boot, leaving the rest of the firmware untouched?


As for backup, if everything else goes wrong, you can just run a "md"
over the whole U-Boot code area, and capture the outpput to a file
(say, by running your terminal program in a "script" session if it
does not support recording directly).  Recoding the "md" output into a
binary blob is a trivial thing to do; a quick & dirty hack could look
like that:

--------------------------- snip ---------------------------
#!/usr/bin/perl -w

# Un-dump hexdump listing and write binary image to stdout.
#	002044F4  3C353E5B 20202020 302E3030 30303030  <5>[    0.000000
#	00204504  5D204C69 6E757820 76657273 696F6E20  ] Linux version
#	00204514  322E362E 32322E36 20286D61 7263656C  2.6.22.6 (marcel
#	00204524  40736861 646F776C 61702920 28676363  @shadowlap) (gcc
#	00204534  20766572 73696F6E 20342E31 2E322028   version 4.1.2 (
#	...
#

while (<>) {
	chomp;
	my (@tmp) = split;
	for ($i=1; $i<5; $i++) {
		syswrite(STDOUT, pack ("N", hex ($tmp[$i])));
	}
}
--------------------------- snip ---------------------------

Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd@denx.de
Here is an Appalachian version of management's answer  to  those  who
are  concerned  with  the fate of the project: "Don't worry about the
mule. Just load the wagon."         - Mike Dennison's hillbilly uncle

[U-Boot] Save flash from U-Boot

[Szabolcs Sipos]

Dear Wolfgang Denk,

My ISP doesn't have the source of U-Boot because they left the original one (from ZTE) on the router. They modified the main firmware only. I want to make a dump from the hall flash and then install a new main firmware. I tried md but it made the router restart (except with address 0x00000000).

Szabolcs Sipos

-----Original Message-----
From: Wolfgang Denk [mailto:wd at denx.de] 
Sent: Tuesday, June 25, 2013 8:32 PM
To: Szabolcs Sipos
Cc: u-boot at lists.denx.de
Subject: Re: [U-Boot] Save flash from U-Boot

Dear "Szabolcs Sipos",

In message <000101ce71cd$34a620a0$9df261e0$@balfug.com> you wrote:
> 
> Unfortunately the bootloader isn't modified by the ISP, only the main 
> firmware. If a knew that the main firmware was also covered by GPL, I 
> would ask them but I am sure they would tell me nothing, they don't 
> tell even my VOIP password.

I'm afraid I don't understand your situation.  If you have the U-Boot code, you could add the missing commands, and just install teh new U-Boot, leaving the rest of the firmware untouched?


As for backup, if everything else goes wrong, you can just run a "md"
over the whole U-Boot code area, and capture the outpput to a file (say, by running your terminal program in a "script" session if it does not support recording directly).  Recoding the "md" output into a binary blob is a trivial thing to do; a quick & dirty hack could look like that:

--------------------------- snip --------------------------- #!/usr/bin/perl -w

# Un-dump hexdump listing and write binary image to stdout.
#	002044F4  3C353E5B 20202020 302E3030 30303030  <5>[    0.000000
#	00204504  5D204C69 6E757820 76657273 696F6E20  ] Linux version
#	00204514  322E362E 32322E36 20286D61 7263656C  2.6.22.6 (marcel
#	00204524  40736861 646F776C 61702920 28676363  @shadowlap) (gcc
#	00204534  20766572 73696F6E 20342E31 2E322028   version 4.1.2 (
#	...
#

while (<>) {
	chomp;
	my (@tmp) = split;
	for ($i=1; $i<5; $i++) {
		syswrite(STDOUT, pack ("N", hex ($tmp[$i])));
	}
}
--------------------------- snip ---------------------------

Best regards,

Wolfgang Denk

-- 
DENX Software Engineering GmbH,     MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd@denx.de Here is an Appalachian version of management's answer  to  those  who are  concerned  with  the fate of the project: "Don't worry about the
mule. Just load the wagon."         - Mike Dennison's hillbilly uncle