roleoroleo / yi-hack-MStar

Custom firmware for Yi 1080p camera based on MStar platform
GNU General Public License v3.0
844 stars 112 forks source link

BFUS black 1080p Dome Security Cam #18

Closed skylarhays closed 4 years ago

skylarhays commented 4 years ago

I will get started on this tonight. do you advise to use the python program or try with putty first? I will post the bootlog and the shell if available as soon asap.

skylarhays commented 4 years ago

bootlog

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2019.10.30 18:54:15 =~=~=~=~=~=~=~=~=~=~=~=  àü à ü à IPL gd156225 D-01.

HW Reset 64MB

BIST0_0001-OK

[SDMMC] NO SD! [NOR] offset:00010000

size:7fc8 chks:5551a134 ok

IPL_CUST gbf16da4

MXP found at 0x00020000

[SDMMC] NO SD! decomp_size=0x000414d4

-----------------------U-Boot 2015.01 (Feb 26 2019 - 10:53:16)-----------------------

Version: I3g138a6f9 DEVINFO: 313E [WDT] Enalbe WATCHDOG 60s Watchdog enabled I2C: ready DRAM: 64 MiB WARNING: Caches not enabled MMC: MStar SD/MMC: 0 nor_flash_mxp allocated success!! Flash is detected (0x0B05, 0xC8, 0x40, 0x18) SF: Detected nor0 with total size 16 MiB MXP found at mxp_offset[1]=0x00020000, size=0x1000 env_offset=0x4F000 env_size=0x1000 Flash is detected (0x0B05, 0xC8, 0x40, 0x18) SF: Detected nor0 with total size 16 MiB In: serial Out: serial Err: serial Net: No ethernet found.

+++++++++++++++++++ check one.bin +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 one.bin _[sdmmc_0] Card Detect Fail! Bad device mmc 0 one.bin Not exist(fatsize err)

+++++++++++++++++++ check one_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 oneh201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 one_h201c Not exist(fatsize err)

+++++++++++++++++++ check uboot_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 ubooth201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 uboot_h201c Not exist(fatsize err)

+++++++++++++++++++ check kernel_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 kernelh201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 kernel_h201c Not exist(fatsize err)

+++++++++++++++++++ check sys_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 sysh201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 sys_h201c Not exist(fatsize err)

+++++++++++++++++++ check home_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 homeh201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 home_h201c Not exist(fatsize err) [NetUpgrade] ts_1st=0x161 No ethernet found. [NetUpgrade] ==== NetLoop(NETUPGRADE) return fail ====! net_upgrade - do net update from the specified file that is in tftpserver

Usage: net_upgrade -

Flash is detected (0x0B05, 0xC8, 0x40, 0x18) SF: Detected nor0 with total size 16 MiB SF: 2162688 bytes @ 0x50000 Read: OK

Booting kernel from Legacy Image at 21000000 ...

Image Name: MVX2##I3gd96050eKL_LX318####[BR: Image Type: ARM Linux Kernel Image (lzma compressed) Data Size: 1445168 Bytes = 1.4 MiB Load Address: 20008000 Entry Point: 20008000 Verifying Checksum ... OK Uncompressing Kernel Image ... [XZ] !!!reserved 0x21000000 length=0x 1000000 for xz!! XZ: uncompressed size=0x3c5f60, ret=7 OK ERR: Can't find KIMG header and initrd address, 0x00000000 atags:0x20000000

Starting kernel ...

Booting Linux on physical CPU 0x0 Linux version 3.18.30 (zhengqianbin@XY-201) (gcc version 4.8.3 20140401 (prerelease) (crosstool-NG linaro-1.13.1-4.8-2014.04 - Linaro GCC 4.8-2014.04) ) #2 PREEMPT Tue Feb 26 14:28:47 CST 2019 CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache early_atags_to_fdt() success Machine model: INFINITY3 MSC000A-S03A-64M Reserved memory: created CMA memory pool at 0x22a00000, size 22 MiB Reserved memory: initialized node cma0, compatible id shared-dma-pool Memory policy: Data cache writeback Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS0,115200n8r androidboot.console=ttyS0 root=/dev/mtdblock2 rw rootfstype=jffs2 noinitrd init=/init PID hash table entries: 256 (order: -2, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 38212K/65536K available (2625K kernel code, 223K rwdata, 896K rodata, 116K init, 114K bss, 27324K reserved) Virtual kernel memory layout: vector : 0xffff0000 - 0xffff1000 ( 4 kB) fixmap : 0xffc00000 - 0xffe00000 (2048 kB) vmalloc : 0xc4800000 - 0xff000000 ( 936 MB) lowmem : 0xc0000000 - 0xc4000000 ( 64 MB) modules : 0xbf000000 - 0xc0000000 ( 16 MB) .text : 0xc0008000 - 0xc0378880 (3523 kB) .init : 0xc0379000 - 0xc0396000 ( 116 kB) .data : 0xc0396000 - 0xc03cdf60 ( 224 kB) .bss : 0xc03cdf60 - 0xc03ea9f0 ( 115 kB) SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 Preemptible hierarchical RCU implementation. Dump stacks of tasks blocking RCU-preempt GP. NR_IRQS:16 nr_irqs:16 16 Find CLK_cpupll_clk, hook ms_cpuclk_ops [ms_cpuclk_init] get dvfs gpio vid_1 Architected cp15 timer(s) running at 6.00MHz (virt). sched_clock: 56 bits at 6MHz, resolution 166ns, wraps every 2863311527936ns Switching to timer-based delay loop, resolution 166ns console [ttyS0] enabled Calibrating delay loop (skipped), value calculated using timer frequency.. 12.00 BogoMIPS (lpj=60000) pid_max: default: 4096 minimum: 301 Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) CPU: Testing write buffer coherency: ok Setting up static identity map for 0x2027d1a0 - 0x2027d1d4 VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5 NET: Registered protocol family 16 DMA: preallocated 256 KiB pool for atomic coherent allocations

Version : MVX2##I3gd96050eKL_LX318####[BR:h201c_prj]#XVM

GPIO: probe end MSYS: INIT DONE. TICK=0x0163AE91 Advanced Linux Sound Architecture Driver Initialized. Switched to clocksource arch_sys_counter NET: Registered protocol family 2 TCP established hash table entries: 1024 (order: 0, 4096 bytes) TCP bind hash table entries: 1024 (order: 2, 20480 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP: reno registered UDP hash table entries: 128 (order: 0, 6144 bytes) UDP-Lite hash table entries: 128 (order: 0, 6144 bytes) NET: Registered protocol family 1 futex hash table entries: 16 (order: -4, 448 bytes) jffs2: version 2.2. © 2001-2006 Red Hat, Inc. msgmni has been set to 118 io scheduler noop registered io scheduler deadline registered (default) i2c /dev entries driver [ms_uart_probe] uart port 0 use MUX_PM_UART 1f221000.uart0: ttyS0 at MMIO 0x0 (irq = 98, base_baud = 10750000) is a unknown [ms_uart_probe] uart port 1 use MUX_UART1 1f221200.uart1: ttyS1 at MMIO 0x0 (irq = 99, base_baud = 10750000) is a unknown URDMA rx_buf=0xC2A42000(phy:0x22A42000) tx_buf=0xC2A43000(phy:0x22A43000) size=0x1000 [ms_uart_probe] uart port 2 use MUX_UART0 1f220400.uart2: ttyS2 at MMIO 0x0 (irq = 112, base_baud = 10750000) is a unknown infinity-audio soc:sound: ASoC: CODEC DAI infinity-codec-dai-main not registered platform soc:sound: Driver infinity-audio requests probe deferral infinity-audio infinity-codec: ASoC: CODEC DAI infinity-codec-dai-main not registered platform infinity-codec: Driver infinity-audio requests probe deferral [HVSP]u32Dropmode on/n

[SCL] SCL init success mload_size = 35040 mload_virt_addr = c2a50000 mload_dma_addr = 0x22a50000 MSYS: DMEM request: [ISP_base]:0x0001B120 ShareData_Meminfo phyaddr:0x227bb400, viraddr:0xc27bb400, len:0x38 AE Base: virt=0xC2A60000 size=0xB400 AWB Base: virt=0xC2A6B400 size=0x8700 AF Base: virt=0xC2A73B00 size=0xF0 HISTO Base: virt=0xC2A73BF0 size=0x2F0 MOT Base: virt=0xC2A73EE0 size=0x6E40 RGBIR Base: virt=0xC2A7AD20 size=0x400 [ISP] register driver success [CSI] register driver successms_rtc 1f002400.rtc: rtc core: registered 1f002400.rtc as rtc0 [ms_rtc_probe]: rtc setup, frequency=12000000 [SAR] infinity_sar_probe MSYS: DMEM request: [BDMA_FSP_WBUFF]:0x00000100 [Ser flash] phys=0x22a48000, virt=0xc2a48000, bus=0x02a48000 [FSP] Flash is detected (0x0B05, 0xC8, 0x40, 0x18) ver1.1 [FSP] 1-2-2 2xIO_READ MODE mtd .name = NOR_FLASH, .size = 0x01000000 (16MiB) .erasesize = 0x00010000 .numeraseregions = 0 MXP_PARTS!! MXP found at mxp_offset[1]=0x00020000, size=0x1000 Creating 6 MTD partitions on "NOR_FLASH": 0x000000000000-0x000000050000 : "BOOT" 0x000000050000-0x0000001d0000 : "KERNEL" 0x0000001d0000-0x0000003b0000 : "ROOTFS" 0x0000003b0000-0x000000fe0000 : "HOME" 0x000000fe0000-0x000000ff0000 : "vd1" 0x000000ff0000-0x000001000000 : "conf" [ms_cpufreq_init] cpu current clk=796917760 ms_pwm->pad_ctrl[0]=69 ms_pwm->pad_ctrl[1]=17 ms_pwm->pad_ctrl[2]=255 ms_pwm->pad_ctrl[3]=255 ms_pwm->pad_ctrl[4]=53 ms_pwm->pad_ctrl[5]=255 ms_pwm->pad_ctrl[6]=255 ms_pwm->pad_ctrl[7]=56 mstar-i3pwm 1f003400.pwm: probe successful TCP: cubic registered NET: Registered protocol family 17 MSYS: DMEM request: [pcmC0D0p]:0x00018000 MSYS: DMEM request: [pcmC0D0c]:0x00014000 infinity-audio soc:sound: infinity-codec-dai-main <-> infinity-cpu-dai mapping ok ms_rtc 1f002400.rtc: setting system clock to 1970-01-01 00:00:00 UTC (0) ALSA device list:

0: infinity_snd_machine

VFS: Mounted root (jffs2 filesystem) on device 31:2. Freeing unused kernel memory: 116K (c0379000 - c0396000) init: SERVICE: ueventd init: SERVICE: rcs [FB]Set 68 [DRVHVSP]Drv_HVSP_SetFbManageConfig(645):8000 DNRR OFF [FB]Set 57 [DRVHVSP]Drv_HVSP_SetFbManageConfig(645):100 UNLOCK [JPE, JpeProbe] set base=0xfd264000 irq=93, nClockRate=288000000

[sdmmc] ms_sdmmc Driver Initializing... [sdmmc] ms_sdmmc_probe [sdmmc_0] Int CDZ use Ext GPIO IRQ: (151) [sdmmc_0] Probe Platform Devices...(Ret:0) [sdmmc_0] Get CD => (0) cryptodev: driver aesdmadev loaded. MSYS: DMEM request: [AESDMA_ENG]:0x00001000 MSYS: DMEM request: [AESDMA_ENG1]:0x00001000 infinity_aes soc:aesdma: MSTAR AES engine enabled. usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb ehci_hcd: unknown parameter 'force_host' ignored ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Mstar_ehc_init version:20150512 Mstar-ehci-2 H.W init Titania3_series_start_ehc start enable USB function [USB] config miu select [1] [ef] [ef] ][ef] [USB] enable miu lower bound address subtraction [USB] worring.... no platform_data hcd->rsrc_start:0xfd286400 BC disable [USB] soc:Mstar-ehci-2 irq --> 119 soc:Mstar-ehci-2 soc:Mstar-ehci-2: EHCI Host Controller soc:Mstar-ehci-2 soc:Mstar-ehci-2: new USB bus registered, assigned bus number 1 soc:Mstar-ehci-2 soc:Mstar-ehci-2: irq 119, io mem 0xfd286400 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected Mstar-ehci-1 H.W init CHIP_FUNCTION SET. ID=4, param=1 Can't get power-enable-pad from DTS, set default GPIO(1) [mstar_usb_vbus_control] Enable USB VBUS GPIO(81) Titania3_series_start_ehc start enable USB function [USB] config miu select [1] [ef] [ef] ][ef] [USB] enable miu lower bound address subtraction [USB] worring.... no platform_data hcd->rsrc_start:0xfd284800 BC disable [USB] soc:Mstar-ehci-1 irq --> 95 soc:Mstar-ehci-1 soc:Mstar-ehci-1: EHCI Host Controller soc:Mstar-ehci-1 soc:Mstar-ehci-1: new USB bus registered, assigned bus number 2 soc:Mstar-ehci-1 soc:Mstar-ehci-1: irq 95, io mem 0xfd284800 hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected hue, spi0_dev = 0xc2307200 init.sh (46): drop_caches: 3 ==20150512==> hub_port_init 1 #0 Plug in USB Port1 usb 2-1: new high-speed USB device number 2 using soc:Mstar-ehci-1 cfg80211: Calling CRDA to update world regulatory domain usbcore: registered new interface driver rtl8188fu hue, get pwm(1) [PWN] mstar_pwm_config duty_ns=0, period_ns=100000 reg=0x1F003490 clk=12000000, period=0x78 reg=0x1F003488 clk=12000000, u32Duty=0x0 [PWM] mstar_pwm_enable [PWM] mstar_pwm_disable [Mstar GPIO] gpio(83) to irq(166) hue, gpio_isr [CPLD_PERIPH] timer init ok. timer resolution:10 MHZ [CPLD_PERIPH] CPLD_PERIPH module inited [PWN] mstar_pwm_config duty_ns=0, period_ns=100000 reg=0x1F003490 clk=12000000, period=0x78 reg=0x1F003488 clk=12000000, u32Duty=0x0 ssp---hi_ssp_init [gpio] Disable SPI0 function ssp---hi_ssp_init ok! MSYS: DMEM request: [ISP_MLOAD]:0x000088E0 [HVSP1] Size must be align 16, Vsize=1080, Pitch=1920 [HVSP1] Buffer is single, Vsize=1080, Pitch=1920 MSYS: DMEM request: [SCL_MCNR_YC]:0x003FC000 MSYS: DMEM request: [SCL_MCNR_M]:0x000FF000 [HVSP1]: MCNR YC: Phy:22ae0000 Vir:c2ae0000 [HVSP1]: MCNR CIIR: Phy:0 Vir:0 [HVSP1]: MCNR M: Phy:22ee0000 Vir:c2ee0000 MSYS: DMEM [FGPALDCDMAP]@0x00000000 not found, skipping release... MSYS: DMEM request: [FGPALDCDMAP]:0x00020000 MSYS: DMEM request: [DLC_MEM]:0x00000400 [DRVSCLDMA] Double Buffer Status :0 [HVSP1] Size must be align 16, Vsize=1080, Pitch=1920 [HVSP1] Buffer is single, Vsize=1080, Pitch=1920 MSYS: DMEM request: [VSPL-I0P0B0]:0x0005A000 MSYS: DMEM request: [VSPL-I0P0B1]:0x0005A000 MSYS: DMEM request: [VSPL-I0P0B2]:0x0005A000 MSYS: DMEM request: [VSPL-I0P2B0]:0x0005A000 MSYS: DMEM request: [VSPL-I0P2B1]:0x0005A000 MSYS: DMEM request: [VSPL-I0P2B2]:0x0005A000 MSB2@v1.1-01:r&d analysis. MSYS: DMEM request: [MS-00]:0x00357000 MSYS: DMEM request: [MS-01]:0x00357000 MSYS: DMEM request: [MS-02]:0x00357000 MSYS: DMEM request: [VENC-32]:0x000FF000 mrqc_set_rqcf - skip set RQCT_CFG_SEQ mrqc_set_rqcf - skip set RQCT_CFG_SEQ MSYS: DMEM request: [S0:VENCDMOUT]:0x00006400 MSB2@v1.1-01:r&d analysis. MSYS: DMEM request: [VSPL-I0P1B0]:0x0005A000 MSYS: DMEM request: [VSPL-I0P1B1]:0x0005A000 MSYS: DMEM request: [VSPL-I0P1B2]:0x0005A000 MSYS: DMEM request: [VENC-48]:0x00025800 mrqc_set_rqcf - skip set RQCT_CFG_SEQ mrqc_set_rqcf - skip set RQCT_CFG_SEQ MSYS: DMEM request: [S1:VENCDMOUT]:0x00005600 MSYS: DMEM request: [S1:VENCDMP0]:0x00056400 MSYS: DMEM request: [S1:VENCDMP1]:0x00056400

[PID_LIST] pid_list_init ok, [ ver=Feb 26 2019, 14:28:36 ] MSYS: DMEM request: [VSPL-I0P3B0]:0x00016800 MSYS: DMEM request: [VSPL-I0P3B1]:0x00016800 MSYS: DMEM request: [VSPL-I0P3B2]:0x00016800

skylarhays commented 4 years ago

shell with printenv

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2019.10.30 18:55:49 =~=~=~=~=~=~=~=~=~=~=~=  àü à ü à IPL gd156225 D-01.

HW Reset 64MB

BIST0_0001-OK

[SDMMC] NO SD! [NOR] offset:00010000

size:7fc8 chks:5551a134 ok

IPL_CUST gbf16da4

MXP found at 0x00020000

[SDMMC] NO SD! decomp_size=0x000414d4

-----------------------U-Boot 2015.01 (Feb 26 2019 - 10:53:16)-----------------------

Version: I3g138a6f9 DEVINFO: 313E [WDT] Enalbe WATCHDOG 60s Watchdog enabled I2C: ready DRAM: 64 MiB WARNING: Caches not enabled MMC: MStar SD/MMC: 0 nor_flash_mxp allocated success!! Flash is detected (0x0B05, 0xC8, 0x40, 0x18) SF: Detected nor0 with total size 16 MiB MXP found at mxp_offset[1]=0x00020000, size=0x1000 env_offset=0x4F000 env_size=0x1000 Flash is detected (0x0B05, 0xC8, 0x40, 0x18) SF: Detected nor0 with total size 16 MiB In: serial Out: serial Err: serial Net: No ethernet found.

+++++++++++++++++++ check one.bin +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 one.bin _[sdmmc_0] Card Detect Fail! Bad device mmc 0 one.bin Not exist(fatsize err)

+++++++++++++++++++ check one_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 oneh201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 one_h201c Not exist(fatsize err)

+++++++++++++++++++ check uboot_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 ubooth201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 uboot_h201c Not exist(fatsize err)

+++++++++++++++++++ check kernel_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 kernelh201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 kernel_h201c Not exist(fatsize err)

+++++++++++++++++++ check sys_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 sysh201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 sys_h201c Not exist(fatsize err)

+++++++++++++++++++ check home_h201c +++++++++++++++++++ ------>setenv filesize 0 ------>fatsize mmc 0 homeh201c [sdmmc_0] Card Detect Fail! Bad device mmc 0 home_h201c Not exist(fatsize err) MStar # MStar # MStar # MStar # MStar # MStar # printenv baudrate=115200 bootcmd=sf probe 0;sf read 0x21000000 0x50000 0x00210000;bootm 0x21000000 bootdelay=0 cpu_part_start=143b0000 filesize=0 home_h201c_crc32=0xa64f6eb9 home_h307_crc32=0xaae53d57 kernel_h307_crc32=0x3ab2362d one.bin_crc32=0x119a2697 sf_kernel_size=180000 sf_kernel_start=50000 sf_part_size=c30000 sf_part_start=3b0000 stderr=serial stdin=serial stdout=serial sys_h307_crc32=0x8c04e1c9 uboot_h307_crc32=0x80065c93

Environment size: 463/4092 bytes MStar #

roleoroleo commented 4 years ago

The file name is h201c, the same as 6FUS. Probably the other hack works. If you want to be sure, dump the partitions with python.

Or you can dump only rootfs.

skylarhays commented 4 years ago

sorry been busy. I will dump rootfs tonight... likely will take until saturday though to complete.

roleoroleo commented 4 years ago

Dump only the rootfs partition. We will dump home partition later using dd.

sf read 0x21000000 0x1d0000 0x1e0000
py here.py --timeout 1 --step 64 com4 115200 0x21000000 0x211e0000
skylarhays commented 4 years ago

Ok. Got the dump.

https://drive.google.com/open?id=1zBBO3lA7hSyS7IUAvKHixLlY8A0Ge87R

roleoroleo commented 4 years ago

You dumped the wrong partition: home. I need the rootfs first. I think you executed:

sf read 0x21000000 0x3b0000 0xc30000
py here.py --timeout 1 --step 64 com4 115200 0x21000000 0x21c30000

and not

sf read 0x21000000 0x1d0000 0x1e0000
py here.py --timeout 1 --step 64 com4 115200 0x21000000 0x211e0000
skylarhays commented 4 years ago

oops. dumping now.

skylarhays commented 4 years ago

https://drive.google.com/open?id=1Vs-cKutmf5km6NI9EUmpBrDPWdiU9aeG

roleoroleo commented 4 years ago

The dump is perfectly identical to the 6FUS 4.6.0. You can use h201c files.

skylarhays commented 4 years ago

awesome! Thanks! what is the DD command to dump this again from Telnet? i would like to get a full backup since this is the same as the others.

roleoroleo commented 4 years ago

Copy all partitions to sd with the following commands:

dd if=/dev/mtd/mtd0 of=/tmp/sd/mtd0.bin
dd if=/dev/mtd/mtd1 of=/tmp/sd/mtd1.bin
dd if=/dev/mtd/mtd2 of=/tmp/sd/mtd2.bin
dd if=/dev/mtd/mtd3 of=/tmp/sd/mtd3.bin
dd if=/dev/mtd/mtd4 of=/tmp/sd/mtd4.bin
dd if=/dev/mtd/mtd5 of=/tmp/sd/mtd5.bin

If you apply hack, mtd2 and mtd3 will be overwritten. For a full backup use rootfs and home dumped with python before hack. If you want I can resend to you in binary form. mtd2 = rootfs mtd3 = home

Let me know if hack works without problems.

skylarhays commented 4 years ago

So I should dump with python over serial? will the dd backup not work?

roleoroleo commented 4 years ago

No, it's not necessary. It's a dog chasing its own tail...

You can dump partitions with dd with a telnet connection. But you can connect with telnet only after applying the update. And if you apply the update, mtd2 and mtd3 will be overwritten, so when you dump them with dd, you don't dump the original partition but the hacked partition.

You should dump:

dd if=/dev/mtd/mtd0 of=/tmp/sd/mtd0.bin
dd if=/dev/mtd/mtd1 of=/tmp/sd/mtd1.bin
dd if=/dev/mtd/mtd4 of=/tmp/sd/mtd4.bin
dd if=/dev/mtd/mtd5 of=/tmp/sd/mtd5.bin

and save the log you sent me previously instead of dd dump. The format is different but it does not matter.

skylarhays commented 4 years ago

Ok great. Thanks again! I will let you know the results when I update.

skylarhays commented 4 years ago

Just wanted to give an update. I finally had time to do this. Everything is working great on BFUS.

roleoroleo commented 4 years ago

Ok, thank you.