Broadcom CFE backup

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 17:21, 11 December 2008 (edit)
Soulstace (Talk | contribs)
m (How to backup your CFE - added link to CFE collection project)
← Previous diff
Revision as of 15:10, 25 September 2020 (edit) (undo)
Jeremywh7 (Talk | contribs)
m (separate section of the jpg method)
Next diff →
(17 intermediate revisions not shown.)
Line 1: Line 1:
-[[Category:jtag]]+{{languages}}
-[[Category:English documentation]]+
=How to backup your CFE= =How to backup your CFE=
-So you're afraid you will ever need to use a backup of your [http://www.linux-mips.org/wiki/Common_Firmware_Environment CFE] in case you brick your router sooner or later.+In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the [http://www.linux-mips.org/wiki/Common_Firmware_Environment CFE] bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the [http://www.wlan-skynet.de/download/index.shtml Skynet repairkit] to make a new one. CFEs for these and other various models may also be found at [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=151032 CFE collection project] and [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=25971 the "old" one].
-If you own a Linksys WRT54G/GL/GS and your CFE is already screwed, you could try the [http://www.wlan-skynet.de/download/index.shtml Skynet repairkit] to make yourself a new one. CFEs for these and other various models may also be found at [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=25971 CFE collection project].+There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents):
-There are several methods to backup the CFE, as follows:+===by web interface (preferred method)===
 +CFE backup is easy via web browser (this works since svn8428, post-RC5):
 +<pre>http://{router IP address}/backup/cfe.bin</pre>
 +E.g. for the DD-WRT default IP address (192.168.1.1):
 +<pre>http://192.168.1.1/backup/cfe.bin</pre>
-==by web interface==+===by telnet/SSH===
-this is working with dd-wrt post RC5 svn8428+For non-micro builds, connect to the router via telnet or ssh (SSH must be enabled!) and enter the following:
-backing up your cfe is easy, all you need to do is to point your browser to:+
-<pre>http://router_ip/backup/cfe.bin</pre>+
- +
- +
-==by telnet/SSH==+
-this maybe works on other 3rd party firmwares, too. connect to the router via telnet or ssh (SSH must be enabled!) +
-just enter the following command for all, except dd-wrt micro builds:+
<pre>dd if=/dev/mtd/0 of=/tmp/cfe.bin</pre> <pre>dd if=/dev/mtd/0 of=/tmp/cfe.bin</pre>
-With v24 (mini and mega), paste that line into the Commands box on the Administration/Commands tab (Diagnostics.asp), and click the Run Commands button.+*Or paste into Commands at the ''Administration''->''Commands'' tab (Diagnostics.asp) and click ''Run Commands''.
- +
Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, [[WinSCP]]). Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, [[WinSCP]]).
- +===by cfe.jpg trick===
-On micro builds it's little more tricky:+This method is required for micro builds, but also works for all builds and is very simple:
<pre>cat /dev/mtd/0 > /tmp/www/cfe.jpg</pre> <pre>cat /dev/mtd/0 > /tmp/www/cfe.jpg</pre>
-Then point your browser to http://routerip/user/cfe.jpg and do a "save page as" cfe.bin to your disk drive. The resulting file should be 256K in size for a cfe.bin file.+Then point your browser to ''<nowiki>http://routerip/user/cfe.jpg</nowiki>'' and do a ''File''->"Save Page/As" to cfe.bin to the local disk drive. The resulting file should be 256K in size for a cfe.bin file, but varies by router and model.
 +*'''Note:''' "/user/cfe.jpg" points to "/tmp/www/cfe.jpg"
-'''Note:''' "/user/cfe.jpg" points to "/tmp/www/cfe.jpg"+The same can be done for mtd/1 ''linux'' (firmware including kernel), mtd/2, mtd/3, and others.
 +*Run ''`cat /proc/mtd`'' to see the mtd partitions.
- +===by JTAG===
-''You could do the same for mtd/1 (kernel, firmware), mtd/2 (jffs part if any) and mtd/3 (nvram)''+Connect a [[JTAG-Adapter]] cable to the router and use the following command:
- +
-==by JTAG==+
-this assumes you already have a [[JTAG-Adapter]] cable ready to use on your router, use the following command:+
<pre>wrt54g -backup:cfe</pre> <pre>wrt54g -backup:cfe</pre>
-you can do the same with the nvram, kernel, etc.+The same can be done with the ''nvram'', ''kernel'', etc.
=Restoring the CFE= =Restoring the CFE=
-==by JTAG==+<font color=red>'''WARNING:'''</font> ''Do not flash the CFE (mtd 0) by telnet/SSH unless the risk is understood, as this could render the router unbootable. Only JTAG or soldering a new flash chip could fix it from that point.''
-Use JTAG to restore the unit's CFE. For example,+===by telnet/SSH===
 +First copy the CFE file to the router's /tmp directory (e.g. using something like [[WinSCP]] or wget), then:
 + mtd unlock cfe
 + mtd write -f /tmp/cfe_new.bin cfe
 +===by JTAG===
 +Use JTAG to restore the unit's CFE. For example:
<pre>tjtag -flash:cfe</pre> <pre>tjtag -flash:cfe</pre>
 +
 +
 +[[Category:Bootloaders]][[Category:jtag]][[Category:Low-level settings]][[Category:Advanced tutorials]]

Revision as of 15:10, 25 September 2020


Contents

How to backup your CFE

In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the CFE bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the Skynet repairkit to make a new one. CFEs for these and other various models may also be found at CFE collection project and the "old" one.

There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents):

by web interface (preferred method)

CFE backup is easy via web browser (this works since svn8428, post-RC5):

http://{router IP address}/backup/cfe.bin

E.g. for the DD-WRT default IP address (192.168.1.1):

http://192.168.1.1/backup/cfe.bin

by telnet/SSH

For non-micro builds, connect to the router via telnet or ssh (SSH must be enabled!) and enter the following:

dd if=/dev/mtd/0 of=/tmp/cfe.bin
  • Or paste into Commands at the Administration->Commands tab (Diagnostics.asp) and click Run Commands.

Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, WinSCP).

by cfe.jpg trick

This method is required for micro builds, but also works for all builds and is very simple:

cat /dev/mtd/0 > /tmp/www/cfe.jpg

Then point your browser to http://routerip/user/cfe.jpg and do a File->"Save Page/As" to cfe.bin to the local disk drive. The resulting file should be 256K in size for a cfe.bin file, but varies by router and model.

  • Note: "/user/cfe.jpg" points to "/tmp/www/cfe.jpg"

The same can be done for mtd/1 linux (firmware including kernel), mtd/2, mtd/3, and others.

  • Run `cat /proc/mtd` to see the mtd partitions.

by JTAG

Connect a JTAG-Adapter cable to the router and use the following command:

wrt54g -backup:cfe

The same can be done with the nvram, kernel, etc.

Restoring the CFE

WARNING: Do not flash the CFE (mtd 0) by telnet/SSH unless the risk is understood, as this could render the router unbootable. Only JTAG or soldering a new flash chip could fix it from that point.

by telnet/SSH

First copy the CFE file to the router's /tmp directory (e.g. using something like WinSCP or wget), then:

mtd unlock cfe
mtd write -f /tmp/cfe_new.bin cfe

by JTAG

Use JTAG to restore the unit's CFE. For example:

tjtag -flash:cfe