-
Notifications
You must be signed in to change notification settings - Fork 59
U‐Boot Cheatsheet
setenv baseaddr 0x82000000;
mmc dev 0;
mmc erase 0x10 0x4000;
setenv flashsize 0x800000;
mw.b ${baseaddr} ff ${flashsize};
sf probe 0; sf read ${baseaddr} 0x0 ${flashsize};
mmc write ${baseaddr} 0x10 0x4000
Read the saved data on a desktop PC by running
sudo dd bs=512 skip=16 count=16384 if=/dev/sdb of=./fulldump.bin,
where /dev/sdb is the SD card device.
setenv baseaddr 0x82000000;
mmc dev 0;
mmc erase 0x10 0x8000;
setenv flashsize 0x1000000;
mw.b ${baseaddr} ff ${flashsize};
sf probe 0; sf read ${baseaddr} 0x0 ${flashsize};
mmc write ${baseaddr} 0x10 0x8000
Read the saved data on a desktop PC by running
sudo dd bs=512 skip=16 count=32768 if=/dev/sdb of=./fulldump.bin,
where /dev/sdb is the SD card device.
setenv ipaddr 192.168.1.10;
setenv netmask 255.255.255.0;
setenv gatewayip 192.168.1.1;
setenv serverip 192.168.1.254;
setenv baseaddr 0x82000000;
setenv flashsize 0x800000;
mw.b ${baseaddr} 0xff ${flashsize};
sf probe 0; sf read ${baseaddr} 0x0 ${flashsize};
tftpput ${baseaddr} ${flashsize} backup-${soc}-nor8m.bin
if there is no tftpput but tftp then run this instead
tftp ${baseaddr} backup-${soc}-nor8m.bin ${flashsize}
setenv ipaddr 192.168.1.10;
setenv netmask 255.255.255.0;
setenv gatewayip 192.168.1.1;
setenv serverip 192.168.1.254;
setenv baseaddr 0x82000000;
setenv flashsize 0x1000000;
mw.b ${baseaddr} 0xff ${flashsize};
sf probe 0; sf read ${baseaddr} 0x0 ${flashsize};
tftpput ${baseaddr} ${flashsize} backup-${soc}-nor16m.bin
if there is no tftpput but tftp then run this instead
tftp ${baseaddr} backup-${soc}-nor16m.bin ${flashsize}
In the terminal program you use to connect to the UART port, enable saving the session log files.
$ screen -L -Logfile fulldump.log /dev/ttyUSB0 115200
Set flash memory size. Use this command for an 8MB flash chip
setenv flashsize 0x800000
or this one for a 16MB flash chip
setenv flashsize 0x1000000
then dump the memory contents to the console
setenv baseaddr 0x82000000;
mw.b ${baseaddr} 0xff ${flashsize};
sf probe 0; sf read ${baseaddr} 0x0 ${flashsize};
md.b ${baseaddr} ${flashsize}
Since the reading process will take a considerable amount of time (literally hours), you may want to disconnect from the terminal session to prevent accidental keystrokes from contaminating the output.
Press Ctrl-a then d to disconnect the session from the active terminal.
Run screen -r when you need to reconnect it later, after the size of the log
file has stopped growing.
Reading of an 8 MB flash memory should result in about 40 MB log file, and for a 16 MB chip the file should be twice that size.
Convert the hex dump into a binary firmware file.
cat fulldump.log | sed -E "s/^[0-9a-f]{8}\b: //i" | sed -E "s/ {4}.{16}\r?$//" > fulldump.hex
xxd -revert -plain fulldump.hex fulldump.bin
Use it for further investigation or to restore the camera to its original state.
Use binwalk to unpack the binary file.
setenv baseaddr 0x82000000;
setenv flashsize 0x800000;
mw.b ${baseaddr} 0xff ${flashsize};
fatload mmc 0:1 ${baseaddr} autoupdate-full.bin;
sf probe 0; sf erase 0x0 ${flashsize};
sf write ${baseaddr} 0x0 ${filesize}
setenv ipaddr 192.168.1.10;
setenv netmask 255.255.255.0;
setenv gatewayip 192.168.1.1;
setenv serverip 192.168.1.254;
setenv baseaddr 0x82000000;
setenv flashsize 0x800000;
mw.b ${baseaddr} 0xff ${flashsize};
tftp ${baseaddr} autoupdate-full.bin;
sf probe 0; sf erase 0x0 ${flashsize};
sf write ${baseaddr} 0x0 ${filesize}
To upload a file over a serial connection by name only, the file should be located in the user's home directory, or use the full path to the file instead.
setenv baseaddr 0x82000000;
setenv flashsize 0x800000;
mw.b ${baseaddr} 0xff ${flashsize}
loady
Press Ctrl-a followed by :, then type exec !! sz --ymodem autoupdate-full.bin
When the upload is complete, continue:
sf probe 0; sf erase 0x0 ${flashsize};
sf write ${baseaddr} 0x0 ${filesize}
setenv baseaddr 0x82000000;
setenv flashsize 0x1000000;
mw.b ${baseaddr} 0xff ${flashsize};
fatload mmc 0:1 ${baseaddr} autoupdate-full.bin;
sf probe 0; sf erase 0x0 ${flashsize};
sf write ${baseaddr} 0x0 ${filesize}
setenv ipaddr 192.168.1.10;
setenv netmask 255.255.255.0;
setenv gatewayip 192.168.1.1;
setenv serverip 192.168.1.254;
setenv baseaddr 0x82000000;
setenv flashsize 0x1000000;
mw.b ${baseaddr} 0xff ${flashsize};
tftp ${baseaddr} autoupdate-full.bin;
sf probe 0; sf erase 0x0 ${flashsize};
sf write ${baseaddr} 0x0 ${filesize}
To upload a file over a serial connection by name only, the file should be located in the user's home directory, or use the full path to the file instead.
setenv baseaddr 0x82000000;
setenv flashsize 0x1000000;
mw.b ${baseaddr} 0xff ${flashsize}
loady
Press Ctrl-a followed by :, then type exec !! sz --ymodem autoupdate-full.bin
When the upload is complete, continue:
sf probe 0; sf erase 0x0 ${flashsize};
sf write ${baseaddr} 0x0 ${filesize}
setenv baseaddr 0x82000000;
setenv bootsize 0x50000;
mw.b ${baseaddr} 0xff ${bootsize};
fatload mmc 0:1 ${baseaddr} autoupdate-uboot.bin;
sf probe 0; sf erase 0x0 ${bootsize};
sf write ${baseaddr} 0x0 ${filesize}
setenv ipaddr 192.168.1.10;
setenv netmask 255.255.255.0;
setenv gatewayip 192.168.1.1;
setenv serverip 192.168.1.254;
setenv baseaddr 0x82000000;
setenv bootsize 0x50000;
mw.b ${baseaddr} 0xff ${bootsize};
tftp ${baseaddr} autoupdate-uboot.bin;
sf probe 0; sf erase 0x0 ${bootsize};
sf write ${baseaddr} 0x0 ${filesize}
setenv baseaddr 0x82000000;
setenv bootsize 0x50000;
mw.b ${baseaddr} 0xff ${bootsize}
loady
Press Ctrl-a followed by :, then type exec !! sz --ymodem autoupdate-uboot.bin
When the upload is complete, continue:
sf probe 0; sf erase 0x0 ${bootsize};
sf write ${baseaddr} 0x0 ${filesize}
sf probe; sf erase 0x0 0x40000
sf probe; sf erase 0x40000 0x1000