Broadcom CFE backup
From DD-WRT Wiki
Revision as of 18:11, 25 November 2023 (edit) Tmittelstaedt (Talk | contribs) (→How to backup your CFE) ← Previous diff |
Revision as of 18:12, 25 November 2023 (edit) (undo) Tmittelstaedt (Talk | contribs) (→How to backup your CFE) Next diff → |
||
Line 4: | Line 4: | ||
In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the [http://www.linux-mips.org/wiki/Common_Firmware_Environment CFE] bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the [https://web.archive.org/web/20180131072638/https://www.wlan-skynet.de/download/index.shtml (archive of http://www.wlan-skynet.de/download/index.shtml) Skynet repairkit] to make a new one. CFEs for these and other various models may also be found at [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=151032 CFE collection project] and [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=25971 the "old" one]. | In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the [http://www.linux-mips.org/wiki/Common_Firmware_Environment CFE] bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the [https://web.archive.org/web/20180131072638/https://www.wlan-skynet.de/download/index.shtml (archive of http://www.wlan-skynet.de/download/index.shtml) Skynet repairkit] to make a new one. CFEs for these and other various models may also be found at [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=151032 CFE collection project] and [https://www.dd-wrt.com/phpBB2/viewtopic.php?t=25971 the "old" one]. | ||
- | Note that as of 11/25/2023 the URLs in | + | Note that as of 11/25/2023 the URLs in the dd-wrt forums threads are all dead. A mirror of the barryware archive was collected and is located on [ftp://gakinaction.ddns.net "ftp://gakinaction.ddns.net"] however it is not browsable via web browser, and a copy of this was collected by me on 11/25/2023 and placed on [http://www.mittelstaedt.us/cfe/gakinaction.ddns.net/cfe_collection_project/ "http://www.mittelstaedt.us/cfe/gakinaction.ddns.net/cfe_collection_project/"] and that is browsable. I have added some additional CFE's to [http://www.mittelstaedt.us/cfe/additional-cfes/ "http://www.mittelstaedt.us/cfe/additional-cfes/"] |
There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents): | There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents): |
Revision as of 18:12, 25 November 2023
English • Deutsch • Español • Français • Italiano • 日本語 • Polski • Português • Русский • Svenska • 中文(中国大陆) • 中文(台灣) • |
Contents |
How to backup your CFE
In case of a bricked router due to bootloader (mtd 0) overwrite, or to make modifications, this guide shows how to backup and write the CFE bootloader used in Broadcom devices. For a broken Linksys WRT54G/GL/GS CFE, try the (archive of http://www.wlan-skynet.de/download/index.shtml) Skynet repairkit to make a new one. CFEs for these and other various models may also be found at CFE collection project and the "old" one.
Note that as of 11/25/2023 the URLs in the dd-wrt forums threads are all dead. A mirror of the barryware archive was collected and is located on "ftp://gakinaction.ddns.net" however it is not browsable via web browser, and a copy of this was collected by me on 11/25/2023 and placed on "http://www.mittelstaedt.us/cfe/gakinaction.ddns.net/cfe_collection_project/" and that is browsable. I have added some additional CFE's to "http://www.mittelstaedt.us/cfe/additional-cfes/"
There are several methods to backup the CFE (always open the CFE with a HEX editor to verify the contents):
by web interface (preferred method)
CFE backup is easy via web browser (this works since svn8428, post-RC5):
http://{router IP address}/backup/cfe.bin
E.g. for the DD-WRT default IP address (192.168.1.1):
http://192.168.1.1/backup/cfe.bin
by telnet/SSH
For non-micro builds, connect to the router via telnet or ssh (SSH must be enabled!) and enter the following:
dd if=/dev/mtd/0 of=/tmp/cfe.bin
- Or paste into Commands at the Administration->Commands tab (Diagnostics.asp) and click Run Commands.
Then get the cfe.bin file from the /tmp directory with FTP, SFTP or SCP (using, for example, WinSCP).
by cfe.jpg trick
This method is required for micro builds, but also works for all builds and is very simple:
cat /dev/mtd/0 > /tmp/www/cfe.jpg
Then point your browser to http://routerip/user/cfe.jpg and do a File->"Save Page/As" to cfe.bin to the local disk drive. The resulting file should be 256K in size for a cfe.bin file, but varies by router and model.
- Note: "/user/cfe.jpg" points to "/tmp/www/cfe.jpg"
The same can be done for mtd/1 linux (firmware including kernel), mtd/2, mtd/3, and others.
- Run `cat /proc/mtd` to see the mtd partitions.
by JTAG
Connect a JTAG-Adapter cable to the router and use the following command:
wrt54g -backup:cfe
The same can be done with the nvram, kernel, etc.
Restoring the CFE
WARNING: Do not flash the CFE (mtd 0) by telnet/SSH unless the risk is understood, as this could render the router unbootable. Only JTAG or soldering a new flash chip could fix it from that point.
by telnet/SSH
First copy the CFE file to the router's /tmp directory (e.g. using something like WinSCP or wget), then:
mtd unlock cfe mtd write -f /tmp/cfe_new.bin cfe
by JTAG
Use JTAG to restore the unit's CFE. For example:
tjtag -flash:cfe