Issuing some commands for the dumped firmware:
$ du -h fw.bin
4.0 M
$ file fw.bin
fw.bin: data
$ file -i fw.bin
fw.bin: application/octet-stream; charset=binary
$ binwalk fw.bin
-
$ enca -L none fw.bin
-
The way that I have dumped the firmware is by using the JTAG port:
And the pins on the linksys router are set according to the figure described in the datasheet (www.cse.buffalo.edu/~bina/amrita/cse524/wrt54gl.pdf):
And the corresponding pins from the BusPirate v3.6 is put on based on the reference (dangerousprototypes.com/docs/Bus_Pirate_I/O_Pin_Descriptions):
The OpenOCD command has been issued such as:
sudo openocd -f interface/buspirate.cfg -f board/linksys-wrt54gl.cfg -c "init"
The configurations for BusPirate
interace/buspirate.cfg
:
interface buspirate
buspirate_port /dev/ttyUSB0
buspirate_speed normal
reset_config srst_only
and the board/linksys-wrt54gl.cfg
:
# Linksys WRT54GL v1.1
#
source [find target/bcm5352e.cfg]
set partition_list {
CFE { Bootloader 0x1c000000 0x00040000 }
firmware { "Kernel+rootfs" 0x1c040000 0x003b0000 }
nvram { "Config space" 0x1c3f0000 0x00010000 }
}
# External 4MB NOR Flash (Intel TE28F320C3BD90 or similar)
set _FLASHNAME $_CHIPNAME.flash
flash bank $_FLASHNAME cfi 0x1c000000 0x00400000 2 2 $_TARGETNAME
and the source, target/bcm5352e.cfg
, it refers to:
set _CHIPNAME bcm5352e
set _CPUID 0x0535217f
jtag newtap $_CHIPNAME cpu -irlen 8 -ircapture 0x1 -irmask 0x1f -expected-id $_CPUID
set _TARGETNAME $_CHIPNAME.cpu
target create $_TARGETNAME mips_m4k -endian little -chain-position $_TARGETNAME
gdb_memory_map disable
$_TARGETNAME configure -event gdb-attach {
reset
halt
}
I open a new terminal and telnet into the socket openocd has opened for communication and I dump the firmware as follows:
dump_image fw.bin 0x1c000000 0x00400000
The values are adapted from the linksys-wrt54gl.cfg
file shown previously.
Any Ideas what might be wrong using/connecting the JTAG and dumping the firmware?
Info about the current Linksys-Wrt54gl:
Model: WRT54GL-EU
Firmware Version: v4.30.7, Jun.20, 2006
A copy of the "dumped" firmware can be obtained here: https://www.dropbox.com/s/kl02cnc5qqddx1x/fw.bin?dl=0
-EB
?set partition_list { CFE { Bootloader 0x1c000000 0x00040000 } firmware { "Kernel+rootfs" 0x1c040000 0x003b0000 } nvram { "Config space" 0x1c3f0000 0x00010000 }
It appears you might be dumping the bootloader instead of the firmware.dump_image fw.bin 0x1c040000 0x003b0000
do? if0x1c040000 0x003b0000
is the offsets for the kernel+rootfs shouldn't you be using those values?