Random Noise

cat /dev/random >> /dev/dsp

Extracting firmware brcmfmac4366c-pcie.bin

leave a comment »

1. Extract the dhd.k0 from the trx firmware
2. Find the array object in the dhd.ko that holds the firmware.

For example we know the wireless chip is a 4366c0. Then find all symbols in the .ko using readelf

~$ readelf -s dhd.ko | grep dlarray_4366c0
   525: 00004448 0x10ab59 OBJECT  GLOBAL DEFAULT   35 dlarray_4366c0

Note down the size for the array object. Here it is 0x10ab59 hex or 1092441 bytes in decimal

Now we need to find the beginning offset of the array object in the .ko file. For that we inspect and already available firmware for 4366b. You see the firmware starts with 00 F2 3E B8 04 F2

screenshot-from-2017-02-12-15-39-13

So, look for this in dhd.ko and make a note of the offset to 00 F2 3E B8 04 F2. In my case it was 256840

2018-04-02 13_32_00-dhd.ko offset

Hence, run this command:

~$ dd if=dhd.ko skip=256840 ibs=1 count=1092441 of=brcmfmac4366c-pcie.bin

Verify that the result file ends with firmware Id  plus 4 bytes

screenshot-from-2017-02-12-15-41-39

Advertisements

Written by Vivek Unune

February 12, 2017 at 8:47 pm

Posted in linux, openwrt

Tagged with , ,

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

%d bloggers like this: