Issuing some commands for the dumped firmware:

$ du -h fw.bin
4.0 M

$ file fw.bin
fw.bin: data

$ file -i fw.bin
fw.bin: application/octet-stream; charset=binary

$ binwalk fw.bin

$ enca -L none fw.bin

The way that I have dumped the firmware is by using the JTAG port:

And the pins on the linksys router are set according to the figure described in the datasheet (www.cse.buffalo.edu/~bina/amrita/cse524/wrt54gl.pdf):

And the corresponding pins from the BusPirate v3.6 is put on based on the reference (dangerousprototypes.com/docs/Bus_Pirate_I/O_Pin_Descriptions):

The OpenOCD command has been issued such as:

sudo openocd -f interface/buspirate.cfg -f board/linksys-wrt54gl.cfg -c "init"

The configurations for BusPirate interace/buspirate.cfg:

interface buspirate
buspirate_port /dev/ttyUSB0
buspirate_speed normal
reset_config srst_only

and the board/linksys-wrt54gl.cfg:

# Linksys WRT54GL v1.1
source [find target/bcm5352e.cfg]
set partition_list {
    CFE         { Bootloader                    0x1c000000 0x00040000 }
    firmware    { "Kernel+rootfs"               0x1c040000 0x003b0000 }
    nvram       { "Config space"                0x1c3f0000 0x00010000 }

# External 4MB NOR Flash (Intel TE28F320C3BD90 or similar)
flash bank $_FLASHNAME cfi 0x1c000000 0x00400000 2 2 $_TARGETNAME

and the source, target/bcm5352e.cfg , it refers to:

set _CHIPNAME bcm5352e
set _CPUID 0x0535217f

jtag newtap $_CHIPNAME cpu -irlen 8 -ircapture 0x1 -irmask 0x1f -expected-id $_CPUID

target create $_TARGETNAME mips_m4k -endian little -chain-position $_TARGETNAME

gdb_memory_map disable
$_TARGETNAME configure -event gdb-attach {

I open a new terminal and telnet into the socket openocd has opened for communication and I dump the firmware as follows:

dump_image fw.bin 0x1c000000 0x00400000

The values are adapted from the linksys-wrt54gl.cfg file shown previously.

Any Ideas what might be wrong using/connecting the JTAG and dumping the firmware?

Info about the current Linksys-Wrt54gl:

Model: WRT54GL-EU

Firmware Version: v4.30.7, Jun.20, 2006

A copy of the "dumped" firmware can be obtained here: https://www.dropbox.com/s/kl02cnc5qqddx1x/fw.bin?dl=0

  • what if you try -EB?
    – Igor Skochinsky
    Jun 8 '17 at 19:08
  • then its andi instruction that is repeated all the way.
    – alperc
    Jun 9 '17 at 7:28
  • from the set partition_list { CFE { Bootloader 0x1c000000 0x00040000 } firmware { "Kernel+rootfs" 0x1c040000 0x003b0000 } nvram { "Config space" 0x1c3f0000 0x00010000 } It appears you might be dumping the bootloader instead of the firmware. Jun 29 '17 at 13:54
  • But shouldn't I be able to see this in $binwalk. The dumped data looks garbage. And even though I only dump the "Kernel+rootfs" which is the core of the firmware, it still cannot recognize anything.
    – alperc
    Jun 29 '17 at 14:41
  • what does dump_image fw.bin 0x1c040000 0x003b0000 do? if 0x1c040000 0x003b0000 is the offsets for the kernel+rootfs shouldn't you be using those values? Jun 29 '17 at 14:47

The firmware itself most likely is not a binary. Also usually when you run file it will tell you something like:
file busybox busybox: ELF 32-bit MSB executable, MIPS, MIPS32 version 1. My guess is that you haven't actually extracted any binaries yet. My advice would be to use something like binwalk to extract specific files and binaries from the firmware. Running objdump on an entire firmware will probably give you an object dump of every single binary in your firmware and that could be a lot.

  • 1
    Actually, I have issued binwalk but it couldn't recognize anything. I used enca to detect the encoding, but it couldn't either. Do you have any suggestions?
    – alperc
    Jun 28 '17 at 12:56
  • I can offer a few. I would like to gather some more information about your router. If you could post what firmware version you are using, what hardware version your wrt54gl is, and if its not too lengthly, what steps you've taken to dump the firmware. I did go to the linksys page and download the Ver.4.30.18 (build 6) firmware and then I ran a simple binwalk against it and found a few things. I'm thinking maybe what is going on is that you got that flash memory from the device instead of the firmware Jun 28 '17 at 13:14
  • Actually,I am not sure if I have dumped the firmware correctly using the JTAG, but I will make an edit section on the actual post, where I will explain further details.
    – alperc
    Jun 28 '17 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.