Cool.
I guess the next step is to see if the router will load the image.
On my side, I have been tinkering, learning how to use rommon, relearning ios ios and made some progress with my inventory of Cisco devices ( c1811, c1921, c1941 ) to get them accessible for testing, dumping boot logs, sh platform collecting the machine id's etc
I tried to boot with the image, but it failed, and it seems that in my build I ended up with too many program headers.
It's possible I broke the Makefile in my local tinkering as I was working on ways to remove so many manual edits and duplications for different architectures.
For reference, here is the boot attempt and error.
The sequence below is the process I used for booting over tftp, which may be useful to others.
Note the -r on tftpdnld -r which I didn't notice previously, allows for the loading direct to ram for execution rather than to a flash device.
Readonly ROMMON initialized
rommon 1 > IP_ADDRESS=192.168.1.26
rommon 2 > IP_SUBNET_MASK=255.255.255.0
rommon 3 > DEFAULT_GATEWAY=192.168.1.1
rommon 4 > TFTP_SERVER=192.168.1.21
rommon 5 > TFTP_VERBOSE=2
rommon 6 > TFTP_FILE=ciscoload-c1811.bin
rommon 7 > tftpdnld -r
IP_ADDRESS: 192.168.1.26
IP_SUBNET_MASK: 255.255.255.0
DEFAULT_GATEWAY: 192.168.1.1
TFTP_SERVER: 192.168.1.21
TFTP_FILE: ciscoload-c1811.bin
TFTP_MACADDR: 00:21:a0:f7:be:ba
TFTP_VERBOSE: Verbose
TFTP_RETRY_COUNT: 18
TFTP_TIMEOUT: 7200
TFTP_CHECKSUM: Yes
FE_PORT: 0
FE_SPEED_MODE: Auto Detect
Performing tftpdnld over Fast Enet.
Initializing interface.
Interface link state up (100MB/FD).
ARPing for 192.168.1.21
ARP reply for 192.168.1.21 received. MAC address 00:e0:1b:7c:70:2b
Receiving ciscoload-c1811.bin from 192.168.1.21 !!!!
File reception completed.
TFTP flash copy: Invalid file header, copy terminated.
Reason: Wrong target platform OR corrupt file.
Err Code 0x5
Using readelf -a I can see that the number of Program Headers is 5 as below
(base) edmaher@edmaher-wfh:~/dev-cilo/cilo/out$ readelf -a ciscoload-c1811.bin
ELF Header:
Magic: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, big endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: <unknown>: 0x93
Version: 0x1
Entry point address: 0x8000c3b8
Start of program headers: 52 (bytes into file)
Start of section headers: 21800 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 5
Size of section headers: 40 (bytes)
Number of section headers: 9
Section header string table index: 8
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .text PROGBITS 80008000 000100 004790 00 WAX 0 0 16
[ 2] .note.gnu.build-i NOTE 100000d4 0000d4 000024 00 A 0 0 4
[ 3] .rodata PROGBITS 8000c790 004890 000566 00 A 0 0 4
[ 4] .eh_frame_hdr PROGBITS 8000ccf8 004df8 000184 00 A 0 0 4
[ 5] .eh_frame PROGBITS 8000ce7c 004f7c 000514 00 A 0 0 4
[ 6] .comment PROGBITS 00000000 005490 00002b 01 MS 0 0 1
[ 7] .gnu.attributes GNU_ATTRIBUTES 00000000 0054bb 000010 00 0 0 1
[ 8] .shstrtab STRTAB 00000000 0054cb 00005d 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x0000d4 0x100000d4 0x100000d4 0x00024 0x00024 R 0x4
LOAD 0x000100 0x80008000 0x80008000 0x05390 0x05390 RWE 0x10
NOTE 0x0000d4 0x100000d4 0x100000d4 0x00024 0x00024 R 0x4
GNU_EH_FRAME 0x004df8 0x8000ccf8 0x8000ccf8 0x00184 0x00184 R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RWE 0x10
Section to Segment mapping:
Segment Sections...
00 .note.gnu.build-id
01 .text .rodata .eh_frame_hdr .eh_frame
02 .note.gnu.build-id
03 .eh_frame_hdr
04
There is no dynamic section in this file.
There are no relocations in this file.
The decoding of unwind sections for machine type <unknown>: 0x93 is not currently supported.
No version information found in this file.
Displaying notes found in: .note.gnu.build-id
Owner Data size Description
GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring)
Build ID: cef73b4050f5424eb5b9bbefde83f1a2c4ee839e
Attribute Section: gnu
File Attributes
Unknown GNU attribute:
(base) edmaher@edmaher-wfh:~/dev-cilo/cilo/out$ binwalk ciscoload-c1811.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 ELF, 32-bit MSB executable, version 1 (SYSV)
How it should be
root@ds-iot1:/tftpboot# readelf -a c181x-advipservicesk9-mz.151-4.M1.bin
ELF Header:
Magic: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, big endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: <unknown>: 0x93
Version: 0x1
Entry point address: 0x80012000
Start of program headers: 52 (bytes into file)
Start of section headers: 84 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 1
Size of section headers: 40 (bytes)
Number of section headers: 8
Section header string table index: 0
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] <no-strings> NULL 00000000 000000 000000 00 0 0 0
[ 1] <no-strings> PROGBITS 80012000 000194 005058 00 WAX 0 0 4
[ 2] <no-strings> PROGBITS 80017058 0051ec 001ce0 00 A 0 0 4
[ 3] <no-strings> PROGBITS 80018d38 006ecc 000904 00 WA 0 0 4
[ 4] <no-strings> PROGBITS 8001963c 0077d0 000014 00 WA 0 0 1
[ 5] <no-strings> PROGBITS 80019650 0077e4 0009b0 00 WA 0 0 4
[ 6] <no-strings> NOTE 81c2b8b8 1c19a4c 000034 00 0 0 4
[ 7] <no-strings> PROGBITS 8001a000 008194 1c118b8 00 WA 0 0 4
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
D (mbind), p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x000194 0x80012000 0x80012000 0x1c198ee 0x1c43162 RWE 0x194
There is no dynamic section in this file.
There are no relocations in this file.
The decoding of unwind sections for machine type <unknown>: 0x93 is not currently supported.
No version information found in this file.
Displaying notes found in: <no-strings>
Owner Data size Description
CISCO SYSTEMS 0x00000018 Unknown note type: (0xfeedbac0)
description data: fa de fa d1 00 00 00 18 d0 2e b2 31 b6 70 73 a8 b6 1a 52 88 5f 5f 7f fb
