Getting Partition Table for TP-Link device

Regarding the partition table for TP-link routers of different models in the following file:

From where do we get this information about the offset and the size and the number of partitions? And would it be possible to reduce the size of one of the partitions to add more space to another or this would break the device?

Hi,

to get the partitions accesible from userspace, execute this command in a SSH console. Fortunately, some TP-Link firmwares offer a SSH login:

cat /proc/mtd

This will result in an output similar to this (sample of my CPE210v2):

dev:    size   erasesize  name
mtd0: 00020000 00010000 "u-boot"
mtd1: 00010000 00010000 "pation-table"
mtd2: 00010000 00010000 "product-info"
mtd3: 00180000 00010000 "kernel"
mtd4: 00600000 00010000 "rootfs"
mtd5: 00030000 00010000 "config"
mtd6: 00010000 00010000 "ART"

To get the entire partition table, read data from the "partition-table" partition, which in my case is mtd1. The corresponding block device file is /dev/mtd1. After some binary headers there is a human-readable text:

partition fs-uboot base 0x00000 size 0x20000
partition partition-table base 0x20000 size 0x02000
partition default-mac base 0x30000 size 0x00020
partition product-info base 0x31100 size 0x00100
partition device-info base 0x31400 size 0x00400
partition signature base 0x32000 size 0x00400
partition device-id base 0x33000 size 0x00100
partition os-image base 0x40000 size 0x170000
partition soft-version base 0x1b0000 size 0x00100
partition support-list base 0x1b1000 size 0x01000
partition file-system base 0x1c0000 size 0x600000
partition user-config base 0x7c0000 size 0x10000
partition default-config base 0x7d0000 size 0x10000
partition log base 0x7e0000 size 0x10000
partition radio base 0x7f0000 size 0x10000

This might be what you are looking for. Remember that the partition is actually larger than the partition table and is filled with 0xFF where empty. So don't just cat /dev/mtd1, because you will see a lot of 0xFF bytes. Either use cat /proc/mtd1 | head -n 20 or use some kind of text or hex editor.

1 Like

Thanks a lot for your detailed answer. I managed to see the partition table of my device. However, I am adding some features to my LEDE firmware but because of the limited size of the os-image partition, the compiler fails. So my question is it OK to increase the size of os-image partition size and decrease the size of the following partition which is the file-system in my case. Or I should comply 100% with these values otherwise I might break my device?

Here is a compressed version of my partition table:

partition radio base 0x1b0000 size 0x40000
partition os-image base 0x1f0000 size 0x200000
partition file-system base 0x3f0000 size 0x1b00000

In my case, the size of the os-image is 2 Mbytes and my firmware is around 2.09 Mbytes.

I am not very experienced with that, but I think it will not be that easy, because the bootloader expects partitions to start at a certain base address. If you increase the size of one partition, you would have to relocate the partitions, which would result in the need for a custom bootloader and a custom firmware.

Please correct me if I am wrong.

2 Likes

I think it makes sense what you mentioned regarding a custom boot loader. I think the only solution I have is to find away to remove unnecessary features in the Kernel to make the size of os-image partition less than 2 Mbytes.

Which TP-LINK device do you have with only 2MB flash?

It is TP-LINK AD7200