BusyBox Shell路由器U-Boot固件解析

逆向工程 固件 硬件 固件分析
2021-07-01 02:41:24

我正在尝试访问 BusyBox Shell,并在可能的情况下获取固件转储。

“U-Boot”的可能性有限,但好的是“sf - SPI flash 子系统”。

谁能帮我访问shell?或者没有 SOIC8 剪辑的整个固件的转储。

我在硬件上使用 UART 接口:

Starting kernel ...

Linux version 2.6.30.9 (root@grant-virtual-machine) (gcc version 4.4.6 (Realtek RSDK-1.5.6p2) ) #141 Mon Jun 17 11:13:56 CST 2019 [luna SDK 1.0.51]
RTL9602C PLL
CPU revision is: 0000dc02
Determined physical RAM map:
 memory: 02eff000 @ 00000000 (usable)
 memory: 00eff000 @ 03000000 (usable)
II: Kernel command line modified: mtdparts=rtk_spi_nor_mtd ->   mtdparts=physmap-flash
Zone PFN ranges:
  Normal   0x00000000 -> 0x00003eff
Movable zone start PFN for each node
early_node_map[2] active PFN ranges
    0: 0x00000000 -> 0x00002eff
    0: 0x00003000 -> 0x00003eff
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 15744
Kernel command line: console=ttyS0,115200   mtdparts=physmap-flash:256K(boot),8K(env),8K(env2),1776K(config),4M(k0),10M(r0) root=31:5
root_dev_setup line 180 root: 31:5
icache: 64kB/32B, dcache: 32kB/32B, scache: 0kB/0B
NR_IRQS:128
PID hash table entries: 256 (order: 8, 1024 bytes)
console [ttyS0] enabled
U-Boot 2011.12.M (Sep 29 2017 - 16:08:09)

SPI-F: EF4018/MMIO16-1 1x16 MB (plr_flash_info @ 83c23714)
Loading 8192B env. variables from offset 0x40000
Loading 8192B env. variables from offset 0x42000
*** Warning - bad CRC, using default environment

Loaded 8192B env. variables from offset 0x40000
mtdparts0=mtdparts=rtk_spi_nor_mtd:256K(boot),8K(env),8K(env2),1776K(config),4M(k0),10M(r0) root=31:5
Net:   LUNA GMAC
Warning: eth device name has a space!

Hit any key to stop autoboot:  0
## Booting kernel from Legacy Image at 94200000 ...
   Image Name:   Linux Kernel Image
   Created:      2019-06-17   3:16:33 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2528816 Bytes = 2.4 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
#printenv
baudrate=115200
bootargs_base=console=ttyS0,115200
bootcmd=setenv bootargs ${bootargs_base} ${mtdparts0};bootm ${img0_kernel}
bootdelay=5
erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}
erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}
ethact=LUNA GMAC

fl_boot_sz=40000
fl_cfgfs=44000
fl_cfgfs_sz=1bc000
fl_env=40000
fl_env2=42000
fl_env_sz=2000
fl_kernel1=200000
fl_kernel1_sz=400000
fl_rootfs1=600000
fl_rootfs1_sz=a00000
fx1000_init=mw bb000084 00000048
img0_kernel=94200000
ipaddr=192.168.1.3
mtdparts0=mtdparts=rtk_spi_nor_mtd:256K(boot),8K(env),8K(env2),1776K(config),4M(k0),10M(r0) root=31:5
netmask=255.255.255.0
serverip=192.168.1.7
sgmii_init=mw bb000084 00000044
stderr=serial
stdin=serial
stdout=serial
upb=tftp 80000000 plr.img; crc32 ${fileaddr} ${filesize}; sf erase 0 +${fl_boot_sz}; sf write ${fileaddr} 0 ${filesize}
upk=tftp 80000000 uImage; crc32 ${fileaddr} ${filesize}; sf erase ${fl_kernel1} +${fl_kernel1_sz}; sf write ${fileaddr} ${fl_kernel1} ${filesize}
upr=tftp 80000000 rootfs; crc32 ${fileaddr} ${filesize}; sf erase ${fl_rootfs1} +${fl_rootfs1_sz}; sf write ${fileaddr} ${fl_rootfs1} ${filesize}
upv=tftp 80000000 vm.img;upvmimg ${fileaddr}
yu=loady 80000000; cp.b 80000000 81000000 ${filesize}; cmp.b 80000000 81000000 ${filesize}; sf erase 0 ${filesize}; sf write 80000000 0 ${filesize}
Environment size: 1442/8187 bytes`
#md 94200000
94200000: 27051956 2d28951a 5d070611 00269630    '..V-(..]....&.0
94200010: 80000000 80000000 2f808b2c 05050203    ......../..,....
94200020: 4c696e75 78204b65 726e656c 20496d61    Linux Kernel Ima
94200030: 67650000 00000000 00000000 00000000    ge..............
94200040: 5d000000 013c76b6 00000000 00000600    ]....<v.........
94200050: 0395c7e8 666e5ec6 cddf5cd3 7f860981    ....fn^...\.....
94200060: 66e4e47d 16454378 ba7286d7 10ac0e5f    f..}.ECx.r....._
94200070: f4548875 7fd45d23 8321e1d6 6fac3711    .T.u..]#.!..o.7.
94200080: a7076c68 3c27aa4a b8951c97 f585008d    ..lh<'.J........
94200090: ec4f63f7 f8f232aa 1ce8ee62 fc24a98f    .Oc...2....b.$..
942000a0: 333ae099 be5ca694 d30dce2b a68c092e    3:...\.....+....
942000b0: 12e311f5 86510704 357b1219 64c20547    .....Q..5{..d..G
942000c0: eaed521e e00f8734 f0708316 d5433715    ..R....4.p...C7.
942000d0: 285ceb11 2f3b455b 69650bef d9a0f557    (\../;E[ie.....W
942000e0: 1ae81e50 d473f125 bdfe34b3 e3cdab52    ...P.s.%..4....R
942000f0: 3db532b3 8ccfc480 559a1511 a90508ff    =.2.....U.......
#help
?               - alias for 'help'
base            - print or set address offset
bdinfo          - print Board Info structure
boot            - boot default, i.e., run 'bootcmd'
bootd           - boot default, i.e., run 'bootcmd'
bootm           - boot application image from memory
bootp           - boot image via network using BOOTP/TFTP protocol
btg             - bus traffic generator sub-system
cmp             - memory compare
coninfo         - print console devices and information
cp              - memory copy
crc32           - checksum calculation
echo            - echo args to console
editenv         - edit environment variable
env             - environment handling commands
go              - start application at address 'addr'
help            - print command description/usage
iminfo          - print header information for application image
imxtract        - extract a part of a multi-image
itest           - return true/false on integer compare
loadb           - load binary file over serial line (kermit mode)
loads           - load S-Record file over serial line
loady           - load binary file over serial line (ymodem mode)
loop            - infinite loop on address range
md              - memory display
mdram_test      - mdram_test   - do DRAM test.
mm              - memory modify (auto-incrementing address)
mtest           - simple RAM read/write test
mw              - memory write (fill)
nm              - memory modify (constant address)
printenv        - print environment variables
reset           - Perform RESET of the CPU
reset_all       - Perform whole chip RESET of the CPU
reset_sw        - Perform software RESET
run             - run commands in an environment variable
saveenv         - save environment variables to persistent storage
setenv          - set environment variables
sf              - SPI flash sub-system
sleep           - delay execution for some time
source          - run script from memory
tftpboot        - boot image via network using TFTP protocol
upvmimg         - update kernel and rootfs by vmimg format on luna platform
version         - print monitor, compiler and linker version
1个回答

添加single到 bootargs 应该会让你进入一个 root shell,例如尝试:

setenv bootargs ${bootargs_base} single ${mtdparts0}
bootm ${img0_kernel}