Hey, i'm coming back to you guys with some infromation i've gathered.
I'll start with some photos.
Console access is given through the I/O panel using default baud rate.
Source: https://www.cisco.com/c/en/us/td/docs/routers/access/2900/hardware/installation/guide/Hardware_Installation_Guide/Internal_Modules.html#wp1115243
That's where the ROMMON is located.
I was expecting some kind of UART, but these 4 pins are for 3,3V jumpers only, in order to set fixed bau rate to 9600, and load a RO ROMMON.
The device uses a bootloader called ROMMON. It's possible to execute some commands in order to boot possible custom images, using the "boot" command. Cisco executables work using the ELF binary format, but in addition to that, a custom e_machine value is necessary in the ELF header.
Every Cisco device has a custom e_machine value, in order to prevent loading an image for another model.
In order to boot into the ROMMON you have to press CTRL + Pause.
RO ROMMON (00000000)
Initializing DRAM
Clearing DRAM 1st 16MB..... done
Performing the Memory POST Test
Testing memory - L2 data cache ECC
Testing memory - L2 instruction cache ECC
Testing memory - ECC DDR memory
Memory POST Test Success
Memory tests are from 0x80403000 to 0x80503000
Testing memory - all 0xffffffff
Testing memory - data equals address
Testing memory - checkerboard
Testing memory - inverse checkerboard
Testing memory - all 0x00000000
Memory test complete -- PASS
Relocating the code to DRAM
Continue initializing the platform
Clearing the rest of 1st 256MB (240MB).....
Clearing next 256MB of On-board DRAM
Memory tests are from 0x80000000 to 0x80403000
Testing memory - all 0xffffffff
Testing memory - data equals address
Testing memory - checkerboard
Testing memory - inverse checkerboard
Testing memory - all 0x00000000
Memory test complete -- PASS
Memory tests are from 0x80803000 to 0x80B03000
Testing memory - all 0xffffffff
Testing memory - data equals address
Testing memory - checkerboard
Testing memory - inverse checkerboard
Testing memory - all 0x00000000
Memory test complete -- PASS
Memory tests are from 0x80B23F38 to 0x81000000
Testing memory - all 0xffffffff
Testing memory - data equals address
Testing memory - checkerboard
Testing memory - inverse checkerboard
Testing memory - all 0x00000000
Memory test complete -- PASS
Retrieve board id 4
Reset type is POR
No Frequency Margin
Performing the CPU BIST Test
Testing memory - CPU internal memory
CPU BIST Success
Performing the IOCTRL BIST Test
IOCTRL BIST Success
Before CFI command
Passed CFI querry string
Value for write(TYP)=6
Value for write(Max)=3
Value for write buffer(TYP)=6
Value for write buffer(Max)=5
Value for erase(TYP)=9
Value for erase(MAX)=3
cfi_write_time = 400
cfi_wr_buf_time = 1000
cfi_erase_time = 7d0000
After CFI commandInit Rommon Upgrade NVRAM Vars
Compact Flash Initialization
Compact Flash 0 is present
Power recycle of CF 0 successful
CF 1 not present
System Bootstrap, Version 15.0(1r)M15, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2011 by cisco Systems, Inc.
Total memory size = 512 MB - On-board = 512 MB, DIMM0 = 0 MB
Clear Auto Boot
Set up ROMMON TLB
Disable the 3rd level watchdog during mem test
Enable the 3rd level watchdog after mem test
Initialize PCIE Interface and Goofy
Enable EHWIC reference clock
Enable second reference clock source
Read second_ref_clock CLK2 : rc = 1 data [0x6]
Write second_ref_clock CLK2 : rc = 1 data [0x16]
Init Exception
Init Platform Cookie
Other core(s) process
Sizing NVRAM
Set Up Environmental Data
Validate EEPROM Checksum.
Turn off the 2rd level watchdog
Turn off the 3rd level watchdog
Exiting Init
CISCO2911/K9 platform with 524288 Kbytes of main memory
Main memory is configured to 72/-1(On-board/DIMM0) bit mode with ECC enabled
Readonly ROMMON initialized
rommon 1 >
Some commands i can execute. There is a "hidden" command "dump", which allows you to hexdump memory blocks. Maybe it can be useful.
rommon 1 >
rommon 1 >
rommon 1 > ?
alias set and display aliases command
boot boot up an external process
break set/show/clear the breakpoint
confreg configuration register utility
cont continue executing a downloaded image
context display the context of a loaded image
cookie display contents of motherboard cookie PROM in hex
dev list the device table
dir list files in file system
frame print out a selected stack frame
help monitor builtin command help
history monitor command history
iomemset set IO memory percent
meminfo main memory information
repeat repeat a monitor command
reset system reset
rommon-pref Select ROMMON
set display the monitor variables
showmon display currently selected ROM monitor
stack produce a stack trace
sync write monitor environment to NVRAM
sysret print out info from last system return
tftpdnld tftp image download
unalias unset an alias
unset unset a monitor variable
hwpart Read HW resources partition
rommon 2 > iomems aaaaaaaaaameminfo
------------------------------------------
Current Memory configuration is:
On-board: Size = 512 MB: Start Phy Addr = 0x00000000_00000000
-------------------------------------------------
Main memory size: 512 MB in 72/-1(On-board/DIMM0) bit mode.
Available main memory starts at 0x81000000, size 507904KB
Smart Init is enabled.
NVRAM size: 256KB
Manufacturer's JEDEC ID code:
On-board:
rommon 3 > dump
Enter in hex the start address [0x0]:
Enter in hex the test size or length in bytes [0x0]: a0x1000
Enter the operation size 'l'ong, 'w'ord, or 'b'yte [b]: b
000000
*** TLB (Load/Fetch) Exception ***
Access address = 0x0
PC = 0x80416810, SP = 0x80b0fd70, RA = 0x804167a8
Cause Reg = 0x00000008, Status Reg = 0x504080e3
monitor: command "dump" aborted due to exception
rommon 4 > dev
Devices in device table:
id name
flash0: compact flash 0
flash: compact flash 0
flash1: compact flash 1
bootflash: boot flash
usbflash0: usbflash0
usbflash1: usbflash1
eprom: eprom
rommon 5 > boot
program load complete, entry point: 0x80803000, size: 0x1b340
boot: cannot determine first executable file name ondevice "flash0:"
rommon 6 > e[Ae[Bbooot t ?
monitor: command "e[Ae[Bboot" not found
rommon 7 > boot
program load complete, entry point: 0x80803000, size: 0x1b340
boot: cannot determine first executable file name ondevice "flash0:"
rommon 8 > boot eprom:
getdevnum warning: device "eprom" has size of zero
getdevnum warning: device "eprom" has size of zero
Invalid devbase
device does not contain a valid FS
boot: cannot open "eprom:"
boot: cannot determine first executable file name ondevice "eprom:"
rommon 9 > boot usbflash0:
open(): Open Error = -1
usbflash0: not present
rommon 10 >
Now following the stock bootlog, when having the stock bootloader + stock Cisco IOS image installed.
Starting with *** ROMMON phase, followed by the "OS" phase.
***System Bootstrap, Version 15.0(1r)M9, RELEASE SOFTWARE (fc1)***
***Technical Support: http://www.cisco.com/techsupport***
***Copyright (c) 2010 by cisco Systems, Inc.***
***Total memory size = 1536 MB - On-board = 512 MB, DIMM0 = 1024 MB***
***CISCO2911/K9 platform with 1572864 Kbytes of main memory***
***Main memory is configured to 72/72(On-board/DIMM0) bit mode with ECC enabled***
***Readonly ROMMON initialized***
***program load complete, entry point: 0x80803000, size: 0x1b340***
***program load complete, entry point: 0x80803000, size: 0x1b340***
IOS Image Load Test
___________________
Digitally Signed Release Software
program load complete, entry point: 0x81000000, size: 0x695fb18
Self decompressing the image : ################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################## [OK]
Smart Init is enabled
smart init is sizing iomem
TYPE MEMORY_REQ
SM Slot 1 0x00600000
Onboard devices &
buffer pools 0x0228F000
-----------------------------------------------
TOTAL: 0x0288F000
Rounded IOMEM up to: 44MB.
Using 2 percent iomem. [44MB/1536MB]
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.7(3)M8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2021 by Cisco Systems, Inc.
Compiled Tue 02-Mar-21 07:51 by prod_rel_team
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
export@cisco.com.
Cisco CISCO2911/K9 (revision 1.0) with 1527808K/45056K bytes of memory.
Processor board ID FTX1439A1ZF
4 Gigabit Ethernet interfaces
2 terminal lines
1 Services Module (SM) with Services Ready Engine (SRE)
DRAM configuration is 64 bits wide with parity enabled.
255K bytes of non-volatile configuration memory.
250880K bytes of ATA System CompactFlash 0 (Read/Write)
--- System Configuration Dialog ---
Would you like to enter the initial configuration dialog? [yes/no]:
There are 4 slots in order to add additional cards, providing multiple ethernet interfaces, etc.
These are equipped with PCI IDs, and these devics and clocks seem to follow the PCI 2.0 standard + Hotplug capability.
The CPU architecture is still unknown to me, i am suspecting some kind of MIPS architecture.
I was able to extract a lot of content out of the image, and i've found also VxWorks headers, but also a linux kernel uImage.
Is it maybe possible to enforce the GPL part of the license, and ask for disclosure of the GPL part of their software?
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
5541956 0x549044 Linux kernel version 2.6.32
5556368 0x54C890 gzip compressed data, maximum compression, from Unix, last modified: 2016-08-05 10:05:09
5664992 0x5670E0 DES SP2, big endian
5665504 0x5672E0 DES SP1, big endian
5687868 0x56CA3C CRC32 polynomial table, little endian
5707524 0x571704 Copyright string: "Copyright (c) 1999-2006 Intel Corporation."
6118192 0x5D5B30 Unix path: /dev/vc/0
6172053 0x5E2D95 Copyright string: "copyright (C) 1996 okir@monad.swb.de)."
6374827 0x6145AB Copyright string: "Copyright (c) 1999-2008 Intel Corporation."
6379640 0x615878 Copyright string: "Copyright(c) 1999-2006 Intel Corporation"
6421278 0x61FB1E Copyright string: "Copyright(c) Pierre Ossman"
6455856 0x628230 Neighborly text, "NeighborSolicits/ipv6/xfrm6_mode_transport.c"
6455876 0x628244 Neighborly text, "NeighborAdvertisementsnsport.c"
6457455 0x62886F Neighborly text, "neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)"
6877184 0x68F000 ASCII cpio archive (SVR4 with no CRC), file name: "/dev", file name length: "0x00000005", file size: "0x00000000"
6877300 0x68F074 ASCII cpio archive (SVR4 with no CRC), file name: "/dev/console", file name length: "0x0000000D", file size: "0x00000000"
6877424 0x68F0F0 ASCII cpio archive (SVR4 with no CRC), file name: "/root", file name length: "0x00000006", file size: "0x00000000"
6877540 0x68F164 ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
6934024 0x69CE08 gzip compressed data, maximum compression, has original file name: "/ws/colbywen-sjc/patriot_2/modlnx/patriots/tmp/work/freescale-p1021mds-mv-linux/linux-2.6.32-1104131701/linux-2.6.32/fs/proc/sta", last modified: 2011-09-23 18:13:40
7204864 0x6DF000 ELF, 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV)
Images can be obtained through the internet, let's say when you search for " c2900-universalk9-mz.SPA.152-1.GC.bin
I think it's not allowed to link them here.
Some interesting things i've found in the Cisco IOS image as well.
Maybe referring to the CPU in use?
The following lines are not ordered correctly, and are only a little extract of the complete binwalk.
163848060 0x9C41F7C Broadcom 96345 firmware header, header size: 256, board id: " hash... What? %d?", ~CRC32 header checksum: 0x52534100, ~CRC32 data checksum: 0x20202020
126079396 0x783D1A4 U-Boot version string, "U-Boot 1.1.1 (Development build) (Build time: Nov 1 2010 - 15:49:00)"
126376732 0x7885B1C Broadcom firmware header dcom 5400. Model: rdes State %s --> %s (%s). Firmware version: (%s).
126376748 0x7885B2C Broadcom firmware header dcom 5401. Model: > %s (%s). Firmware version: N.
165166580 0x9D83DF4 ELF, 32-bit MSB MIPS32 rel2 executable, MIPS, version 1 (SYSV)
166741188 0x9F044C4 uuencoded data, file name: "", file permissions: "644"
166748812 0x9F0628C Unix path: /usr/local/Cavium_Networks/toolchain/src/newlib/libc/sys/octeon/octeon-coremask.c
167181808 0x9F6FDF0 SHA256 hash constants, big endian
167182476 0x9F7008C AES S-Box
167183276 0x9F703AC AES Inverse S-Box
167191184 0x9F72290 CRC32 polynomial table, little endian
167198608 0x9F73F90 SQLite 3.x database,, user version 67240450
167323520 0x9F92780 Zip archive data, at least v2.0 to extract, compressed size: 246131, uncompressed size: 801462, name: san2/CPY-v157_3_m_throttle.V157_3_M8/vob/ios/sys/nms/canis/canis_sm_fpga.bin
167569879 0x9FCE9D7 End of Zip archive, footer length: 22
167569904 0x9FCE9F0 Zip archive data, at least v2.0 to extract, compressed size: 116791, uncompressed size: 402936, name: san2/CPY-v157_3_m_throttle.V157_3_M8/vob/ios/sys/nms/pse/pse_sm_fpga.bin
167686915 0x9FEB303 End of Zip archive, footer length: 22
167690368 0x9FEC080 uImage header, header size: 64 bytes, header CRC: 0xA10BCD39, created: 2016-08-05 10:46:09, image size: 9325999 bytes, Data Address: 0x0, Entry Point: 0x0, data CRC: 0x7630D6E8, OS: Linux, CPU: PowerPC, image type: Multi-File Image, compression type: gzip, image name: "Kernel + Pivot Root Helper initr"
I have formatted one of my legacy USB 250M drives, and i have put the linux.bin onto it.
I've tried to boot it, it didn't work. But at least it shows the possibility to boot something.
rommon 3 > boot usbflash0:
program load complete, entry point: 0x80903000, size: 0x4c4a0
program load complete, entry point: 0x80903000, size: 0x4c4a0
loadprog: bad file magic number: 0x0
boot: cannot load "usbflash0:"
lsusb says: