Broadcom CFE backup

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 00:38, 4 March 2020 (edit)
Jeremywh7 (Talk | contribs)
m (fix syntax)
← Previous diff
Current revision (18:25, 25 November 2023) (edit) (undo)
Tmittelstaedt (Talk | contribs)
(How to backup your CFE)
 
(8 intermediate revisions not shown.)
Line 2: Line 2:
=How to backup your CFE= =How to backup your CFE=
-In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the [http://www.linux-mips.org/wiki/Common_Firmware_Environment CFE] bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the [http://www.wlan-skynet.de/download/index.shtml Skynet repairkit] to make a new one. CFEs for these and other various models may also be found at [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=151032 CFE collection project] and [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=25971 the "old" one].+In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the [http://www.linux-mips.org/wiki/Common_Firmware_Environment CFE] bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the [https://web.archive.org/web/20180131072638/https://www.wlan-skynet.de/download/index.shtml (archive of http://www.wlan-skynet.de/download/index.shtml) Skynet repairkit] to make a new one. CFEs for these and other various models may also be found at [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=151032 CFE collection project] and [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=25971 the "old" one].
 + 
 +Note that as of 11/25/2023 the URLs in the dd-wrt forums threads are all dead. A mirror of the barryware archive was collected and is located on [ftp://gakinaction.ddns.net ftp://gakinaction.ddns.net] however it is not browsable via web browser, and a copy of this was collected by me on 11/25/2023 and placed on [http://www.mittelstaedt.us/cfe/gakinaction.ddns.net/cfe_collection_project/ http://www.mittelstaedt.us/cfe/gakinaction.ddns.net/cfe_collection_project/] and that is browsable. I have added some additional CFE's to [http://www.mittelstaedt.us/cfe/additional-cfes/ http://www.mittelstaedt.us/cfe/additional-cfes/] Another archive of the Barryware CFE project is located here [https://www.linksysinfo.org/index.php?threads/bootloader-collection-project.75258/#post-322731 https://www.linksysinfo.org/index.php?threads/bootloader-collection-project.75258/#post-322731]
There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents): There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents):
Line 18: Line 20:
Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, [[WinSCP]]). Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, [[WinSCP]]).
-For micro builds there is a trick that can be used, that also works for non-micro builds:+===by cfe.jpg trick===
 +This method is required for micro builds, but also works for all builds and is very simple:
<pre>cat /dev/mtd/0 > /tmp/www/cfe.jpg</pre> <pre>cat /dev/mtd/0 > /tmp/www/cfe.jpg</pre>
Then point your browser to ''<nowiki>http://routerip/user/cfe.jpg</nowiki>'' and do a ''File''->"Save Page/As" to cfe.bin to the local disk drive. The resulting file should be 256K in size for a cfe.bin file, but varies by router and model. Then point your browser to ''<nowiki>http://routerip/user/cfe.jpg</nowiki>'' and do a ''File''->"Save Page/As" to cfe.bin to the local disk drive. The resulting file should be 256K in size for a cfe.bin file, but varies by router and model.

Current revision


Contents

[edit] How to backup your CFE

In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the CFE bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the (archive of http://www.wlan-skynet.de/download/index.shtml) Skynet repairkit to make a new one. CFEs for these and other various models may also be found at CFE collection project and the "old" one.

Note that as of 11/25/2023 the URLs in the dd-wrt forums threads are all dead. A mirror of the barryware archive was collected and is located on ftp://gakinaction.ddns.net however it is not browsable via web browser, and a copy of this was collected by me on 11/25/2023 and placed on http://www.mittelstaedt.us/cfe/gakinaction.ddns.net/cfe_collection_project/ and that is browsable. I have added some additional CFE's to http://www.mittelstaedt.us/cfe/additional-cfes/ Another archive of the Barryware CFE project is located here https://www.linksysinfo.org/index.php?threads/bootloader-collection-project.75258/#post-322731

There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents):

[edit] by web interface (preferred method)

CFE backup is easy via web browser (this works since svn8428, post-RC5):

http://{router IP address}/backup/cfe.bin

E.g. for the DD-WRT default IP address (192.168.1.1):

http://192.168.1.1/backup/cfe.bin

[edit] by telnet/SSH

For non-micro builds, connect to the router via telnet or ssh (SSH must be enabled!) and enter the following:

dd if=/dev/mtd/0 of=/tmp/cfe.bin
  • Or paste into Commands at the Administration->Commands tab (Diagnostics.asp) and click Run Commands.

Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, WinSCP).

[edit] by cfe.jpg trick

This method is required for micro builds, but also works for all builds and is very simple:

cat /dev/mtd/0 > /tmp/www/cfe.jpg

Then point your browser to http://routerip/user/cfe.jpg and do a File->"Save Page/As" to cfe.bin to the local disk drive. The resulting file should be 256K in size for a cfe.bin file, but varies by router and model.

  • Note: "/user/cfe.jpg" points to "/tmp/www/cfe.jpg"

The same can be done for mtd/1 linux (firmware including kernel), mtd/2, mtd/3, and others.

  • Run `cat /proc/mtd` to see the mtd partitions.

[edit] by JTAG

Connect a JTAG-Adapter cable to the router and use the following command:

wrt54g -backup:cfe

The same can be done with the nvram, kernel, etc.

[edit] Restoring the CFE

WARNING: Do not flash the CFE (mtd 0) by telnet/SSH unless the risk is understood, as this could render the router unbootable. Only JTAG or soldering a new flash chip could fix it from that point.

[edit] by telnet/SSH

First copy the CFE file to the router's /tmp directory (e.g. using something like WinSCP or wget), then:

mtd unlock cfe
mtd write -f /tmp/cfe_new.bin cfe

[edit] by JTAG

Use JTAG to restore the unit's CFE. For example:

tjtag -flash:cfe