Broadcom CFE backup

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 17:21, 11 December 2008 (edit)
Soulstace (Talk | contribs)
m (How to backup your CFE - added link to CFE collection project)
← Previous diff
Current revision (18:25, 25 November 2023) (edit) (undo)
Tmittelstaedt (Talk | contribs)
(How to backup your CFE)
 
(25 intermediate revisions not shown.)
Line 1: Line 1:
-[[Category:jtag]]+{{languages}}
-[[Category:English documentation]]+
=How to backup your CFE= =How to backup your CFE=
-So you're afraid you will ever need to use a backup of your [http://www.linux-mips.org/wiki/Common_Firmware_Environment CFE] in case you brick your router sooner or later.+In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the [http://www.linux-mips.org/wiki/Common_Firmware_Environment CFE] bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the [https://web.archive.org/web/20180131072638/https://www.wlan-skynet.de/download/index.shtml (archive of http://www.wlan-skynet.de/download/index.shtml) Skynet repairkit] to make a new one. CFEs for these and other various models may also be found at [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=151032 CFE collection project] and [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=25971 the "old" one].
-If you own a Linksys WRT54G/GL/GS and your CFE is already screwed, you could try the [http://www.wlan-skynet.de/download/index.shtml Skynet repairkit] to make yourself a new one. CFEs for these and other various models may also be found at [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=25971 CFE collection project].+Note that as of 11/25/2023 the URLs in the dd-wrt forums threads are all dead. A mirror of the barryware archive was collected and is located on [ftp://gakinaction.ddns.net ftp://gakinaction.ddns.net] however it is not browsable via web browser, and a copy of this was collected by me on 11/25/2023 and placed on [http://www.mittelstaedt.us/cfe/gakinaction.ddns.net/cfe_collection_project/ http://www.mittelstaedt.us/cfe/gakinaction.ddns.net/cfe_collection_project/] and that is browsable. I have added some additional CFE's to [http://www.mittelstaedt.us/cfe/additional-cfes/ http://www.mittelstaedt.us/cfe/additional-cfes/] Another archive of the Barryware CFE project is located here [https://www.linksysinfo.org/index.php?threads/bootloader-collection-project.75258/#post-322731 https://www.linksysinfo.org/index.php?threads/bootloader-collection-project.75258/#post-322731]
-There are several methods to backup the CFE, as follows:+There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents):
-==by web interface==+===by web interface (preferred method)===
-this is working with dd-wrt post RC5 svn8428+CFE backup is easy via web browser (this works since svn8428, post-RC5):
-backing up your cfe is easy, all you need to do is to point your browser to:+<pre>http://{router IP address}/backup/cfe.bin</pre>
-<pre>http://router_ip/backup/cfe.bin</pre>+E.g. for the DD-WRT default IP address (192.168.1.1):
 +<pre>http://192.168.1.1/backup/cfe.bin</pre>
- +===by telnet/SSH===
-==by telnet/SSH==+For non-micro builds, connect to the router via telnet or ssh (SSH must be enabled!) and enter the following:
-this maybe works on other 3rd party firmwares, too. connect to the router via telnet or ssh (SSH must be enabled!) +
-just enter the following command for all, except dd-wrt micro builds:+
<pre>dd if=/dev/mtd/0 of=/tmp/cfe.bin</pre> <pre>dd if=/dev/mtd/0 of=/tmp/cfe.bin</pre>
-With v24 (mini and mega), paste that line into the Commands box on the Administration/Commands tab (Diagnostics.asp), and click the Run Commands button.+*Or paste into Commands at the ''Administration''->''Commands'' tab (Diagnostics.asp) and click ''Run Commands''.
- +
Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, [[WinSCP]]). Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, [[WinSCP]]).
- +===by cfe.jpg trick===
-On micro builds it's little more tricky:+This method is required for micro builds, but also works for all builds and is very simple:
<pre>cat /dev/mtd/0 > /tmp/www/cfe.jpg</pre> <pre>cat /dev/mtd/0 > /tmp/www/cfe.jpg</pre>
-Then point your browser to http://routerip/user/cfe.jpg and do a "save page as" cfe.bin to your disk drive. The resulting file should be 256K in size for a cfe.bin file.+Then point your browser to ''<nowiki>http://routerip/user/cfe.jpg</nowiki>'' and do a ''File''->"Save Page/As" to cfe.bin to the local disk drive. The resulting file should be 256K in size for a cfe.bin file, but varies by router and model.
 +*'''Note:''' "/user/cfe.jpg" points to "/tmp/www/cfe.jpg"
-'''Note:''' "/user/cfe.jpg" points to "/tmp/www/cfe.jpg"+The same can be done for mtd/1 ''linux'' (firmware including kernel), mtd/2, mtd/3, and others.
 +*Run ''`cat /proc/mtd`'' to see the mtd partitions.
- +===by JTAG===
-''You could do the same for mtd/1 (kernel, firmware), mtd/2 (jffs part if any) and mtd/3 (nvram)''+Connect a [[JTAG-Adapter]] cable to the router and use the following command:
- +
-==by JTAG==+
-this assumes you already have a [[JTAG-Adapter]] cable ready to use on your router, use the following command:+
<pre>wrt54g -backup:cfe</pre> <pre>wrt54g -backup:cfe</pre>
-you can do the same with the nvram, kernel, etc.+The same can be done with the ''nvram'', ''kernel'', etc.
=Restoring the CFE= =Restoring the CFE=
-==by JTAG==+<font color=red>'''WARNING:'''</font> ''Do not flash the CFE (mtd 0) by telnet/SSH unless the risk is understood, as this could render the router unbootable. Only JTAG or soldering a new flash chip could fix it from that point.''
-Use JTAG to restore the unit's CFE. For example,+===by telnet/SSH===
 +First copy the CFE file to the router's /tmp directory (e.g. using something like [[WinSCP]] or wget), then:
 + mtd unlock cfe
 + mtd write -f /tmp/cfe_new.bin cfe
 +===by JTAG===
 +Use JTAG to restore the unit's CFE. For example:
<pre>tjtag -flash:cfe</pre> <pre>tjtag -flash:cfe</pre>
 +
 +
 +[[Category:Bootloaders]][[Category:jtag]][[Category:Low-level settings]][[Category:Advanced tutorials]]

Current revision


Contents

[edit] How to backup your CFE

In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the CFE bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the (archive of http://www.wlan-skynet.de/download/index.shtml) Skynet repairkit to make a new one. CFEs for these and other various models may also be found at CFE collection project and the "old" one.

Note that as of 11/25/2023 the URLs in the dd-wrt forums threads are all dead. A mirror of the barryware archive was collected and is located on ftp://gakinaction.ddns.net however it is not browsable via web browser, and a copy of this was collected by me on 11/25/2023 and placed on http://www.mittelstaedt.us/cfe/gakinaction.ddns.net/cfe_collection_project/ and that is browsable. I have added some additional CFE's to http://www.mittelstaedt.us/cfe/additional-cfes/ Another archive of the Barryware CFE project is located here https://www.linksysinfo.org/index.php?threads/bootloader-collection-project.75258/#post-322731

There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents):

[edit] by web interface (preferred method)

CFE backup is easy via web browser (this works since svn8428, post-RC5):

http://{router IP address}/backup/cfe.bin

E.g. for the DD-WRT default IP address (192.168.1.1):

http://192.168.1.1/backup/cfe.bin

[edit] by telnet/SSH

For non-micro builds, connect to the router via telnet or ssh (SSH must be enabled!) and enter the following:

dd if=/dev/mtd/0 of=/tmp/cfe.bin
  • Or paste into Commands at the Administration->Commands tab (Diagnostics.asp) and click Run Commands.

Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, WinSCP).

[edit] by cfe.jpg trick

This method is required for micro builds, but also works for all builds and is very simple:

cat /dev/mtd/0 > /tmp/www/cfe.jpg

Then point your browser to http://routerip/user/cfe.jpg and do a File->"Save Page/As" to cfe.bin to the local disk drive. The resulting file should be 256K in size for a cfe.bin file, but varies by router and model.

  • Note: "/user/cfe.jpg" points to "/tmp/www/cfe.jpg"

The same can be done for mtd/1 linux (firmware including kernel), mtd/2, mtd/3, and others.

  • Run `cat /proc/mtd` to see the mtd partitions.

[edit] by JTAG

Connect a JTAG-Adapter cable to the router and use the following command:

wrt54g -backup:cfe

The same can be done with the nvram, kernel, etc.

[edit] Restoring the CFE

WARNING: Do not flash the CFE (mtd 0) by telnet/SSH unless the risk is understood, as this could render the router unbootable. Only JTAG or soldering a new flash chip could fix it from that point.

[edit] by telnet/SSH

First copy the CFE file to the router's /tmp directory (e.g. using something like WinSCP or wget), then:

mtd unlock cfe
mtd write -f /tmp/cfe_new.bin cfe

[edit] by JTAG

Use JTAG to restore the unit's CFE. For example:

tjtag -flash:cfe