I am trying to reverse engineer a router's firmware. The device has a NAND chip, and has a cripled version of BusyBox v1.14.1.
nanddump command exists but with intresting parameters, as I wasn't able to find any info on Google. Also
nandwrite command doesn't exist, instead they wrote a different tool called
psi to write to the chip. Here are the outputs of their usage with compare to the original counterparts.
$ nanddump Usage: nanddump mtdX [noswap || swap] [nospare || spare] sector_count sector_count can be provided as "0" which means the whole partition
So, what are these swap and spare options for? When I try to dump with
noswap I got the same file when I use the command
cat /dev/mtd* > mtd*.bin. However using
spare parameter gives a slightly bigger file. Here is what I got from full fledged busybox
$ nanddump BusyBox v1.21.1 (2013-07-08 10:56:01 CDT) multi-call binary. Usage: nanddump [-o] [-b] [-s ADDR] [-f FILE] MTD_DEVICE Dump the specified MTD device -o Dump oob data -b Omit bad block from the dump -s ADDR Start address -l LEN Length -f FILE Dump to file ('-' for stdout)
And for the other tool,
$ psi usage: psi -o <command> -t <configtype> -f <filename|env.var.name> -s <flashsize> -r <rebootflag> supported commands: <read> <write> <erase> supported config types: <asd> <cfg> <env> <flash> <firmware> supported reboot flags: <yes> <no> Note: -s parameter is for flash dump/undump only
It seems like this tool reads and writes at the same time. Well this is hard to figure out as I wasn't able to use it to read mtd partitions, and it doesn't let firmware partition to be read. It only writes to that partition. Here is the
nandwrite command from busybox.
$ nandwrite BusyBox v1.21.1 (2013-07-08 10:56:01 CDT) multi-call binary. Usage: nandwrite [-p] [-s ADDR] MTD_DEVICE [FILE] Write to the specified MTD device -p Pad to page size -s ADDR Start address
So I believe
psicommand has something to do with these two parameters.
Also here is the list of
$ cat /proc/mtd dev: size erasesize name mtd0: 01000000 00004000 "RootFS" mtd1: 08000000 00020000 "FlashAll" mtd2: 00020000 00020000 "Bootloader" mtd3: 00220000 00020000 "BootloaderConfig" mtd4: 00220000 00020000 "Config" mtd5: 00220000 00020000 "ASD" mtd6: 02200000 00020000 "Kernel" mtd7: 02200000 00020000 "KernelBackup" mtd8: 02e60000 00020000 "disk" mtd9: 00220000 00020000 "edr" mtd10: 00500000 00020000 "bbt"
nanddump throws an error while reading
RootFS. These are all I got for now.