I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy Bootloader binary from memory and save it?

=> printenv
update_uboot=tftpboot 0x80000100 u-boot.bin && protect off 0x48000000 +${filesize} && erase 0x48000000 +${filesize} && sleep ${sdelay} && cp.b ${fileaddr} 0x48000000 ${filesize} && protect on 0x48000000 +${filesize}



5 cmdlinepart partitions found on MTD device spansion
partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }

0x00000000-0x00020000 : "U-Boot"

EDIT: netcat is not present in Busybox on embedded device.

BusyBox v1.19.2 built-in shell (ash)
Enter 'help' for a list of built-in commands.
# help
Built-in commands:
        . : [ [[ bg break cd chdir continue echo eval exec exit export
        false fg getopts hash help jobs kill local printf pwd read readonly
        return set shift source test times trap true type ulimit umask
        unset wait

3 Answers 3


The bootloader is in the flash, so you have to dump it first by using:

dd if=/dev/mtd0 of=/tmp/mtd0


nandump -of /tmp/mtd0 /dev/mtd0

After it you have to copy to an SD card, USB device or send via netcat (nc) to a socket. Of course you can do it in one step also.


You can send files via netcat with 2 easy steps.

  1. Start netcat in your PC in listening mode to receive data and save the data to a file

    nc -l -p 1337 >mtd0.bin

  2. Start netcat in the embedded device to send the data to your PC

    nc ip_address 1337 </tmp/mtd0

  • There is no SD card and no USB on device: how to send dump via netcat?
    – fxgreen
    Sep 22, 2016 at 12:33
  • I edited my answer
    – ebux
    Sep 22, 2016 at 13:01
  • Can be used tftp for this as well?
    – fxgreen
    Sep 22, 2016 at 14:46
  • You can use tftp also, or wget, curl, ftp and other tools as well, but I think netcat is the easiest and most common tool you may have in an embedded linux.
    – ebux
    Sep 23, 2016 at 5:39
  • In case I am facing a problem with netcat implementation, how to dump bootloader raw data to the telnet screen?(then copy and save output as binary)
    – fxgreen
    Sep 23, 2016 at 7:22

Please try https://ohse.de/uwe/software/lrzsz.html And also, read about kermit, xmodem, ymodem and zmodem protocols - these are file transfer protocols over serial lines.

U-boot has a support to receive files with "loady" command. We use it together with lsz command from lrzsz package, to update the bootloader. I cannot see any support for sending files, but with good understanding of the *modem protocol, you could emulate proper string to activate minicom's file transfer and send whole file to your computer.

u-boot => help loady
loady - load binary file over serial line (ymodem mode)

loady [ off ] [ baud ]
- load binary file over serial line with offset 'off' and baudrate 'baud'

The second solution might be enabling minicom's logging to file, print the whole memory region with u-boot's md command, and then parse the log file with a script to convert from ascii to real bytes.

  • loady(ymodem) and loadbimplemented in U-boot allow transfer files only in one direction - from computer to the device RAM address.
    – Lexx Luxx
    Nov 28, 2017 at 14:54

dd and netcat should work just fine.

If any problem with that, try doing an hexdump to stdout

hexdump -C -n 64 /dev/mtdblock0 > bootloader.bin

But needs a reverse shell on the target, like:

nc.exe [local IP] [port] -e cmd.exe

(cmd.exe is for MS windows, /bin/sh on linux)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.