Is it possible copy and save bootloader using CLI telnet commands?

Question

I need get copy of original Bootloader from device running embedded Linux. Is it possible copy and save bootloader using CLI telnet commands? I have full access to CLI interface. Is there way copy Bootloader binary from memory and save it?

=> printenv
...
update_uboot=tftpboot 0x80000100 u-boot.bin && protect off 0x48000000 +${filesize} && erase 0x48000000 +${filesize} && sleep ${sdelay} && cp.b ${fileaddr} 0x48000000 ${filesize} && protect on 0x48000000 +${filesize}
...

ubootpartsize=0x20000

mtdinfo=0x20000(U-Boot)ro
mtdparts=spansion:0x20000(U-Boot)ro

5 cmdlinepart partitions found on MTD device spansion
partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }

0x00000000-0x00020000 : "U-Boot"

EDIT: netcat is not present in Busybox on embedded device.

BusyBox v1.19.2 built-in shell (ash)
Enter 'help' for a list of built-in commands.
# help
Built-in commands:
------------------
        . : [ [[ bg break cd chdir continue echo eval exec exit export
        false fg getopts hash help jobs kill local printf pwd read readonly
        return set shift source test times trap true type ulimit umask
        unset wait

Answer 1

The bootloader is in the flash, so you have to dump it first by using:

dd if=/dev/mtd0 of=/tmp/mtd0

or

nandump -of /tmp/mtd0 /dev/mtd0

After it you have to copy to an SD card, USB device or send via netcat (nc) to a socket. Of course you can do it in one step also.

EDIT

You can send files via netcat with 2 easy steps.

1. Start netcat in your PC in listening mode to receive data and save the data to a file

   nc -l -p 1337 >mtd0.bin

2. Start netcat in the embedded device to send the data to your PC

   nc ip_address 1337 </tmp/mtd0

Answer 2

Please try https://ohse.de/uwe/software/lrzsz.html And also, read about kermit, xmodem, ymodem and zmodem protocols - these are file transfer protocols over serial lines.

U-boot has a support to receive files with "loady" command. We use it together with lsz command from lrzsz package, to update the bootloader. I cannot see any support for sending files, but with good understanding of the *modem protocol, you could emulate proper string to activate minicom's file transfer and send whole file to your computer.

u-boot => help loady
loady - load binary file over serial line (ymodem mode)

Usage:
loady [ off ] [ baud ]
- load binary file over serial line with offset 'off' and baudrate 'baud'

The second solution might be enabling minicom's logging to file, print the whole memory region with u-boot's md command, and then parse the log file with a script to convert from ascii to real bytes.

Answer 3

dd and netcat should work just fine.

If any problem with that, try doing an hexdump to stdout

hexdump -C -n 64 /dev/mtdblock0 > bootloader.bin

But needs a reverse shell on the target, like:

nc.exe [local IP] [port] -e cmd.exe

(cmd.exe is for MS windows, /bin/sh on linux)