[Solved]How to restore a full backup firmware .bin file by command inside router?

Every time before flash a new firmware, I always do a full backup for my current running firmware.

[details=Summary] root@Lede:~# cat backup_full_bin.sh
#!/bin/sh
cat /dev/mtd0 > /tmp/full_flash.bin
cat /dev/mtd1 >> /tmp/full_flash.bin
cat /dev/mtd2 >> /tmp/full_flash.bin
cat /dev/mtd3 >> /tmp/full_flash.bin
echo "Full flash backup store at /tmp/full_flash.bin."
sysupgrade -b /tmp/full_config.tar.gz
echo "Full config backup store at /tmp/full_config.tar.gz."[/details]
If I need restore this backup and my router is bricks, I will using CH341A USB programmer flash the 'full_flash.bin' back to the 16MB SPI NOR flash IC.
But if my router is alive, and I can still ssh access. Is there anyway to flash the full_flash.bin to the router's 16MB SPI flash by linux command insead of the IC flash programmer?
It seems that sysupgrade using 'mtd write' can only write a partition not the whole IC.
I do not like using sysupgrade to restore the whole firmware because it did not restore all the things back, eg. installed package on overlayfs.

1 Like

Finally, I find the solution myself: file split.
And I make a quick and dirty script to restore my router to snapshot state from the full backup image.
I think this is the fast way let my device go back to work by using the full backup file.
cat restore_full_bin.sh

#!/bin/sh
if [ ! -f /tmp/full_flash.bin ]; then
    echo "Backup file not found!"
    echo "Please upload backup file you need to restore as /tmp/full_flash.bin and try again."
    exit
fi
dd if=/tmp/full_flash.bin of=/tmp/factory.bin bs=1K skip=256 count=64
dd if=/tmp/full_flash.bin of=/tmp/firmware.bin bs=1K skip=320
rm -f /tmp/full_flash.bin
mtd write /tmp/factory.bin factory
mtd -r write /tmp/firmware.bin firmware
3 Likes

HI,

How i make for save backup in external drive, like HD or pendrive ?

Thx for help

mount external disk to a mount point.
copy backup files from /tmp to external disk path.
umount external disk.

I have newifi D2 with 32MB flash(bios). I would like to make full_flash.bin that use ch341 to flash.
this is mtd in this pictue below.
please tell how to make it
https://drive.google.com/uc?id=1Z-lXoS8I-6GqFPqv0DcEWQs91w4C9ncx&export=download

You need run 3 commands line:

  1. dmesg
  2. df
  3. cat /proc/partitions

and post the output text, in order to find out your partition layout, for generate full_flash.bin.
if you feel demsg output too long, you can cut only message like this.

[    3.371920] 4 fixed-partitions partitions found on MTD device spi0.0
[    3.384582] Creating 4 MTD partitions on "spi0.0":
[    3.394142] 0x000000000000-0x000000030000 : "u-boot"
[    3.405031] 0x000000030000-0x000000040000 : "u-boot-env"
[    3.416510] 0x000000040000-0x000000050000 : "factory"
[    3.427464] 0x000000050000-0x000002000000 : "firmware"
[    3.438769] 2 uimage-fw partitions found on MTD device firmware
[    3.450570] Creating 2 MTD partitions on "firmware":
[    3.460472] 0x000000000000-0x0000001d944a : "kernel"
[    3.471503] 0x0000001d944a-0x000001fb0000 : "rootfs"
[    3.482407] mtd: device 5 (rootfs) set to be root filesystem
[    3.493827] 1 squashfs-split partitions found on MTD device rootfs
[    3.506166] 0x000000fc0000-0x000001fb0000 : "rootfs_data"

Pandora box as Linux

BusyBox v1.24.1 (2017-12-14 13:33:05 CST) built-in shell (ash)


  _______________________________________________________________
 |    ____                 _                 ____               |
 |   |  _ \ __ _ _ __   __| | ___  _ __ __ _| __ )  _____  __   |
 |   | |_) / _` | '_ \ / _` |/ _ \| '__/ _` |  _ \ / _ \ \/ /   |
 |   |  __/ (_| | | | | (_| | (_) | | | (_| | |_) | (_) >  <    |
 |   |_|   \__,_|_| |_|\__,_|\___/|_|  \__,_|____/ \___/_/\_\   |
 |                                                              |
 |                  PandoraBox SDK Platform                     |
 |                  The Core of SmartRouter                     |
 |       Copyright 2013-2016 D-Team Technology Co.,Ltd.SZ       |
 |                http://www.pandorabox.org.cn                  |
 |______________________________________________________________|
  Base on OpenWrt BARRIER BREAKER (3.2.1.7400, 2017-11-28-git-3e46f52)
[root@newifi_DD93:/root]#dmesg
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.14.79 (lea@server.pbr.link) (gcc version 4.8.3 (PandoraBox/Linaro GCC 4.8-2014.04 2017-08-31-git-bf1d97e) ) #11 SMP Sat Jan 6 12:18:53 CST 2018
[    0.000000] MT7621: MPLL enabled.
[    0.000000] PandoraBox CPUID Module for Ralink/MTK SoC v1.1.
[    0.000000] MediaTek MT7621 pkg:BGA rev:1 eco:3 CPU:880MHz Bus:220MHz Uart:50MHz
[    0.000000] CPU running in Little Endian
[    0.000000] Board VLAN:LLLLW
[    0.000000] Flash:SPI 3byte Size: 32MB
[    0.000000] DRAM: 512MB DDR3 16 bits
[    0.000000] Kernel Support [PCI] [USB]
[    0.000000] prom memory:512MB
[    0.000000] GCMP present
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 1c000000 @ 00000000 (usable)
[    0.000000]  memory: 04000000 @ 20000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x00000000-0x00ffffff]
[    0.000000]   Normal   [mem 0x01000000-0x1fffffff]
[    0.000000]   HighMem  [mem 0x20000000-0x23ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x1bffffff]
[    0.000000]   node   0: [mem 0x20000000-0x23ffffff]
[    0.000000] On node 0 totalpages: 131072
[    0.000000] free_area_init_node: node 0, pgdat 80386180, node_mem_map 81000000
[    0.000000]   DMA zone: 32 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 4096 pages, LIFO batch:0
[    0.000000]   Normal zone: 992 pages used for memmap
[    0.000000]   Normal zone: 110592 pages, LIFO batch:31
[    0.000000]   HighMem zone: 128 pages used for memmap
[    0.000000]   HighMem zone: 16384 pages, LIFO batch:3
[    0.000000] Detected 3 available secondary CPU(s)
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] PERCPU: Embedded 7 pages/cpu @81484000 s6112 r8192 d14368 u32768
[    0.000000] pcpu-alloc: s6112 r8192 d14368 u32768 alloc=8*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
...............
[    3.357000] io scheduler bfq registered (default)
[    3.362000] BFQ I/O-scheduler: v7r8
[    3.366000] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    3.373000] serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27, base_baud = 3125000) is a 16550A
[    3.381000] serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26, base_baud = 3125000) is a 16550A
[    3.390000] serial8250: ttyS2 at MMIO 0x1e000e00 (irq = 28, base_baud = 3125000) is a 16550A
[    3.399000] Ralink GDMA IP REV:3 IRQ:13
[    3.417000] brd: module loaded
[    3.422000] PandoraBox MT7621/28 SPI flash driver, SPI_ClK: 44MHz
[    3.428000] device id : ef 40 19 0 0 (40190000)
[    3.433000] SPI flash chip: W25Q256FV (ef 40190000) (32768 Kbytes)
[    3.441000] Creating 4 MTD partitions on "raspi":
[    3.445000] 0x000000030000-0x000000040000 : "u-boot-env"
[    3.453000] 0x000000040000-0x000000050000 : "Factory"
[    3.460000] 0x000000050000-0x000002000000 : "firmware"
[    3.519000] 3 uimage-fw partitions found on MTD device firmware
[    3.525000] 0x000000050000-0x000000196bd8 : "kernel"
[    3.530000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    3.544000] 0x000000196bd8-0x000001fe0000 : "rootfs"
[    3.549000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    3.563000] mtd: device 4 (rootfs) set to be root filesystem
[    3.569000] 1 squashfs-split partitions found on MTD device rootfs
[    3.575000] 0x0000011c0000-0x000001fe0000 : "rootfs_data"
[    3.582000] 0x000001fe0000-0x000002000000 : "panic_oops"
[    3.589000] mtdoops: ready 0, 1 (no erase)
[    3.589000] mtdoops: Attached to MTD device 6
[    3.594000] 0x000001ff0000-0x000002000000 : "nvram"
[    3.603000] IMQ driver loaded successfully. (numdevs = 2, numqueues = 1)
[    3.610000]  Hooking IMQ after NAT on PREROUTING.
[    3.615000]  Hooking IMQ before NAT on POSTROUTING.
[    3.620000] rdm_major = 250
[    3.623000] EEPROM:Read from [Factory] offset 0xe000,length 0x6.
[    3.636000] Ralink APSoC Ethernet Driver v3.2.4 (raeth)
[    3.642000] raeth: PDMA RX ring 512, PDMA TX ring 512. Max packet size 1536
[    3.649000] raeth: NAPI & GRO support, weight 64
[    3.653000] raeth: Byte Queue Limits (BQL) support
[    3.658000] raeth: GMAC reset
[    3.662000] mt762x-gsw switch driver registered
[    3.667000] mt762x-gsw default vlans:wllll
[    3.679000] TCP: cubic registered
[    3.682000] TCP: westwood registered
[    3.686000] TCP: hybla registered
[    3.689000] TCP: htcp registered
[    3.692000] NET: Registered protocol family 17
[    3.697000] Bridge firewalling registered
[    3.701000] Ebtables v2.0 registered
[    3.705000] 8021q: 802.1Q VLAN Support v1.8
[    3.709000] PandoraBox Mass Storage accelerater v1.2
[    3.715000] Generic NVRAM Driver for MediaTek Board. (c) 2013-2015 PandoraBox Team.
[    3.723000] NVRAM driver (major 248) installed
[    3.729000] registered taskstats version 1
[    3.738000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    3.746000] Freeing unused kernel memory: 216K (803aa000 - 803e0000)
[    4.688000] init: Console is alive
[    7.289000] usbcore: registered new interface driver usbfs
[    7.295000] usbcore: registered new interface driver hub
[    7.301000] usbcore: registered new device driver usb
[    7.310000] exFAT: Version 1.2.9

[root@newifi_DD93:/root]#df
Filesystem          Size  Used Avail Use% Mounted on
overlayfs:/overlay   15M  552K   14M   4% /
/dev/root            17M   17M     0 100% /rom
tmpfs               251M  1.2M  250M   1% /tmp
/dev/mtdblock5       15M  552K   14M   4% /overlay
tmpfs               512K     0  512K   0% /dev
[root@newifi_DD93:/root]#
[root@newifi_DD93:/root]#cat /proc/partitions
major minor  #blocks  name

  31        0         64 mtdblock0
  31        1         64 mtdblock1
  31        2      32448 mtdblock2
  31        3       1306 mtdblock3
  31        4      31013 mtdblock4
  31        5      14464 mtdblock5
  31        6        128 mtdblock6
  31        7         64 mtdblock7
[root@newifi_DD93:/root]#cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00010000 00010000 "u-boot-env"
mtd1: 00010000 00010000 "Factory"
mtd2: 01fb0000 00010000 "firmware"
mtd3: 00146bd8 00010000 "kernel"
mtd4: 01e49428 00010000 "rootfs"
mtd5: 00e20000 00010000 "rootfs_data"
mtd6: 00020000 00010000 "panic_oops"
mtd7: 00010000 00010000 "nvram"

u-boot-env.bin  64KB
Factory         64KB
firmware        32448KB 
kernel          1307KB 
rootfs          31014KB 
rootfs_data     14464KB
panic_oops      128KB 
nvram           64KB

Please help me make full firmware flash.

Your firmware have no bootloader partition, mtd device address 0x00000000, size 0x00030000.
I think there is no simple way to make full flash (for SPI programmer) backup.
If you know what bootloader your router using, you may using bootloder's backup feature to make full flash backup.

thank you for reply.
please tell me from x000000030000 to x00000040000 for this firmware.
from 0 to 30000 I has from another backup.
from 30000 to 40000 I do not know is?
from 40000 to 50000 maybe is factory or u-boot-env not sure?
from 50000 to end is firmware.
please tell me 30000 to 40000 and 40000 to 50000?
thank you.

dev:    size   erasesize  name
mtd0: 00010000 00010000 "u-boot-env"
mtd1: 00010000 00010000 "Factory"

major minor  #blocks  name
  31        0         64 mtdblock0
  31        1         64 mtdblock1


[    3.433000] SPI flash chip: W25Q256FV (ef 40190000) (32768 Kbytes)
[    3.441000] Creating 4 MTD partitions on "raspi":
[    3.445000] 0x000000030000-0x000000040000 : "u-boot-env"
[    3.453000] 0x000000040000-0x000000050000 : "Factory"

I think 0x30000 u-boot-env is uboot data partition, to save some uboot settings.
0x40000 is storing factory data partition which can reset your router to default factory settings.
If you already have a full flash backup, you can simply take out bootloader bin file from it. And you will get full_flash.bin.

dd if=/tmp/full_flash.bin of=/tmp/bootloader.bin bs=1K count=192
cat /tmp/bootloader.bin /dev/mtd0 /dev/mtd1 /dev/mtd2 > /tmp/full_flash_new.bin

bootloader 192KB
mtd0 u-boot-env 64KB
mtd1 Factory 64KB
mtd2 firmware 32448KB
Total: 32768KB = 32MB full flash size.

thank your help.
I have 2 full backup files with 32768KB and 1 file from my current router for x30000-x40000
file from current the same as factory file. but 2 other files do not like factory file.
these files following .




all of them split 3 files as 64KB
cheer

I am using raspberrypi2 as 32MB SPI programmer, every time after my router upgrade, I always make full flash backup and scp to raspberrypi2, make two backup into two IC.

root@ras RaspberryPi2 ~ #
cat burn_full_flash.sh
#!/bin/bash
echo "==== SPI flash IC 0 ===="
time flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=25000 -w /root/full_flash.bin
echo "==== SPI flash IC 1 ===="
time flashrom -p linux_spi:dev=/dev/spidev0.1,spispeed=25000 -w /root/full_flash_old.bin

and raspberrypi2 also as my router's serial port monitor, in order to catch some kernel crash of my router.
alias scap='screen /dev/ttyAMA0 57600'

Those three files in your screenshot look like:

  1. uboot settings (or some recovery tool settings)
  2. OEM firmware settings
  3. WiFi calibration data
1 Like

If you do not have full_flash.bin currently , you may:

  1. Backup your Pandora box mtd1 Factory and mtd2 firmware as to .bin files and save to PC first.
cat /dev/mtd1 > /tmp/Factory.bin
cat /dev/mtd2 > /tmp/firmware.bin
  1. Install Openwrt into your router, and take a full backup or only mtd0 bootloader.bin backup cat /dev/mtd0 > /tmp/bootloader.bin save to your PC.
  2. Install Pandora box and restore your firmware.bin by
mtd -r write /tmp/firmware.bin firmware

(and Factory.bin if not the same Pandora box version).

1 Like

I tell you know about this router:
At first Pandora boot on, i can only telnet to it, using Winscp not work.
at this time i use this command to save MTD.

  • cat /proc/mtd
    -cat /dev/mtd0 > /tmp/u-boot-env.bin
  • cat /dev/mtd1 > /tmp/factory.bin
  • cat /dev/mtd2 > /tmp/firware.bin
    -cat /dev/mtd7 > /tmp/nvram.bin
    using HxD edit I found that 2 files factory.bin and u-boo-env.bin the same content.
    The second i do with this router is
    go to Chome brower insert this line: http://192.168.99.1/newifi/ifiwen_hss.html
    and letter "succes" on screen after that:
  • I can telnet by putty and ssh by Wincp to this router, I use some command as upper, i found that u-boot-env.bin had nothing on this file(content).
    As you say x30000-x40000 is u-boot-env.bin, please tell me x30000-x40000 should I put nothing or the same Factory.bin.
    Thanks your help.

I suggest you do not modify or overwrite u-boot-env partition if you do not known what bootloader your router using.
Pandora box is a modified Openwrt maintained by Chinese community so I suppose you known Chinese.
Newfi D2 using pb-boot as factory bootloader, but many user flash breed bootloader before change to the 3rd part firmware like Pandora box or padavan.
If your router's bootloader is breed, there is a very simple way to get the full flash bin.

  1. Power off Newfi D2
  2. Hold reset button Power on Newfi D2 and keep holding reset button 5 sec.
  3. assign your PC an static IP address 192.168.1.11 and wire connect to Newfi D2. Visit http://192.168.1.1 the Breed Web UI. and download programmer firmware(编程器固件) that is full_flash.bin
1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.