OpenWrt Forum Archive

Topic: Help! To understand, extract and create Pirelli firmware images

The content of this topic has been archived on 9 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I have a Pirelli DRG A125G DSL router where I would like to install OpenWrt. However we are having some problem compiling/installing the OWF. (Please see the thread Pirelli 125G or the main OpenWrt page  A125G if you are interested.)

However to understand how this "thing" works, I'd like to understand how to extract the (Jungo) OpenRG firmware as supplied by default with the router. The original image were supplied as an .img file, but I also happen to have it as an .rmt file. Using hexedit under Cygwin I can see very little difference in these two files. However, I have not been able to extract or mount them so far. I have controlled all sorts of magic numbers, but nothing that tell me how to do the extraction. Any help would be very appreciated!

To be more specific, I'd like to know the following:

(1) How do I mount/extract the contents of the image (.rmt or .img) file(s)?
(2) I have tried to use a dd command to extract images, but how do I find the correct offset values (i.e. "skip=NNNN")?
(3) What is producing the initial "DRG A125G>" prompt?
(4) The commands I can use at the prompt, where are they located?
(5) Can I use some kind of debugger on these?
(6) I have a VirtualBox image on my PC, where I have installed OpenWrt. How can I use this to compile OpenWrt for my Router?
(7) Which OpenWrt version should I use for this device?

I have also produced some output (below) that I believe may be relevant in solving this mystery.

Finally I'm sorry if these questions have obvious answers for some experts, but I have been reading several HowTo's and followed many other OpenWrt web pages, but they are never particularly clear...


This is how it looks after I login and check some settings.

DRG A125G> help
...
Availble help Categories
help pvc - show help about PVC scan related commands
help conf - show help about Read and write DRG A125G configuration data
help upnp - show help about UPnP commands
help cwmp - show help about CWMP related commands
help bridge - show help about API for managing ethernet bridge
help firewall - show help about Control and display Firewall and NAT data
help connection - show help about API for managing connections
help inet_connection - show help about API for managing internet connections
help 802.1x - show help about 802.1x Port based authntication commands
help misc - show help about API for DRG A125G miscellaneous tasks
help firmware_update - show help about Firmware update commands
help log - show help about Contorols DRG A125G logging behaviour
help dev - show help about Device related commands
help kernel - show help about Kernel related commands
help system - show help about Commands to control DRG A125G execution
help flash - show help about Flash and loader related commands
help net - show help about Network related commands
help cmd - show help about Commands related to the Command module

DRG A125G> system ver

Version: 4.5.3.TEO_4.2.5.0008
Platform: DRG A125G
Compilation Time: 04-Jun-08 13:12:21
Tag: TSviluppo_Pirelli_TEO
Compilation Flags: LIC=../jpkg_bcm9634x.lic CONFIG_CUSTOMER=TEO DIST=DWR_96348

DRG A125G> system shell

Temporary setting log_level off
BusyBox v1.01 (2005.09.07-07:38+0000) Built-in shell (lash)
Enter 'help' for a list of built-in commands.
/ #

Here is the file content (of the first few hundred bytes) in the two original firmware images that I'm trying to extract/understand.  I have also included the latest update.

openrg-4.5.3.TEO_4.2.5.0008-DWR_96348.img
Size: 3825840

00000000   38 00 00 00  50 69 72 65  6C 6C 69 42  53 00 00 00  00 00 00 00  00 00 00 00  8...PirelliBS...........
00000018   49 4D 41 47  45 00 00 00  00 00 00 00  00 00 36 33  34 38 00 00  50 69 72 65  IMAGE.........6348..Pire
00000030   6C 6C 69 47  61 74 65 57  32 2B 00 00  31 00 33 38  32 35 35 38  34 00 00 00  lliGateW2+..1.3825584...
00000048   30 00 00 00  00 00 00 00  00 00 00 00  30 00 00 00  00 00 00 00  00 00 33 32  0...........0.........32
00000060   31 37 30 39  36 39 36 30  00 00 30 00  00 00 00 00  00 00 00 00  33 32 31 37  17096960..0.........3217
00000078   30 39 36 39  36 30 00 00  33 38 32 35  35 38 34 00  00 00 00 00  00 00 44 57  096960..3825584.......DW
00000090   52 5F 39 36  33 34 38 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  R_96348.................
000000A8   00 00 54 45  4F 5F 34 2E  32 2E 35 2E  30 30 30 38  00 00 00 00  00 00 00 00  ..TEO_4.2.5.0008........
000000C0   00 00 00 00  00 00 32 30  30 38 2F 30  36 2F 30 34  2D 31 35 3A  31 35 00 00  ......2008/06/04-15:15..
000000D8   57 7C 44 D7  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  94 F6 A9 11  W|D.....................
000000F0   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  80 01 00 00  80 01 00 00  ........................
00000108   00 00 00 1C  5D 00 00 40  00 00 1E 01  14 2C B0 A1  E8 73 9C D3  F3 E1 0F E0  ....]..@.....,...s......
00000120   BB 08 4B AE  9C 29 6C 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ..K..)l.................


openrg-4.5.3.TEO_4.2.5.0008-DWR_96348.rmt
Size: 3825986

00000000   00 3A 60 B0  96 CC EA 0A  4F 0A 8F 05  08 A8 6C 12  A3 82 CE A0  58 E1 8A 8E  .:`.....O.....l.....X...
00000018   10 F1 B3 6A  5A 36 5A 46  BA 87 C5 2B  73 74 61 72  74 20 73 65  63 74 69 6F  ...jZ6ZF...+start sectio
00000030   6E 0A 72 67  5F 68 77 3A  20 44 57 56  5F 42 43 4D  39 36 33 34  38 0A 64 69  n.rg_hw: DWV_BCM96348.di
00000048   73 74 3A 20  44 57 52 5F  39 36 33 34  38 0A 70 72  6F 64 5F 76  65 72 73 69  st: DWR_96348.prod_versi
00000060   6F 6E 3A 20  34 2E 35 2E  33 0A 76 65  72 73 69 6F  6E 3A 20 34  30 35 30 33  on: 4.5.3.version: 40503
00000078   0A 65 78 74  5F 76 65 72  3A 20 54 45  4F 5F 34 2E  32 2E 35 2E  30 30 30 38  .ext_ver: TEO_4.2.5.0008
00000090   0A 00 38 00  00 00 50 69  72 65 6C 6C  69 42 53 00  00 00 00 00  00 00 00 00  ..8...PirelliBS.........
000000A8   00 00 49 4D  41 47 45 00  00 00 00 00  00 00 00 00  36 33 34 38  00 00 50 69  ..IMAGE.........6348..Pi
000000C0   72 65 6C 6C  69 47 61 74  65 57 32 2B  00 00 31 00  33 38 32 35  35 38 34 00  relliGateW2+..1.3825584.
000000D8   00 00 30 00  00 00 00 00  00 00 00 00  00 00 30 00  00 00 00 00  00 00 00 00  ..0...........0.........
000000F0   33 32 31 37  30 39 36 39  36 30 00 00  30 00 00 00  00 00 00 00  00 00 33 32  3217096960..0.........32
00000108   31 37 30 39  36 39 36 30  00 00 33 38  32 35 35 38  34 00 00 00  00 00 00 00  17096960..3825584.......
00000120   44 57 52 5F  39 36 33 34  38 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  DWR_96348...............
00000138   00 00 00 00  54 45 4F 5F  34 2E 32 2E  35 2E 30 30  30 38 00 00  00 00 00 00  ....TEO_4.2.5.0008......
00000150   00 00 00 00  00 00 00 00  32 30 30 38  2F 30 36 2F  30 34 2D 31  35 3A 31 35  ........2008/06/04-15:15
00000168   00 00 57 7C  44 D7 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 94 F6  ..W|D...................
00000180   A9 11 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 80 01  00 00 80 01  ........................
00000198   00 00 00 00  00 1C 5D 00  00 40 00 00  1E 01 14 2C  B0 A1 E8 73  9C D3 F3 E1  ......]..@.....,...s....
000001B0   0F E0 BB 08  4B AE 9C 29  6C 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ....K..)l...............


openrg-4.5.3.TEO_4.2.5.0015-DWR_96348.rmt
Size: 3554354

00000000   00 36 3B A0  12 A8 B1 D8  D6 52 CE 99  22 3D E6 A6  A7 2C 5C AE  DA E3 E0 67  .6;......R.."=...,\....g
00000018   29 11 5F 82  27 DD F8 12  3A 9F 82 6A  73 74 61 72  74 20 73 65  63 74 69 6F  )._.'...:..jstart sectio
00000030   6E 0A 72 67  5F 68 77 3A  20 44 57 56  5F 42 43 4D  39 36 33 34  38 0A 64 69  n.rg_hw: DWV_BCM96348.di
00000048   73 74 3A 20  44 57 52 5F  39 36 33 34  38 0A 70 72  6F 64 5F 76  65 72 73 69  st: DWR_96348.prod_versi
00000060   6F 6E 3A 20  34 2E 35 2E  33 0A 76 65  72 73 69 6F  6E 3A 20 34  30 35 30 33  on: 4.5.3.version: 40503
00000078   0A 65 78 74  5F 76 65 72  3A 20 54 45  4F 5F 34 2E  32 2E 35 2E  30 30 31 35  .ext_ver: TEO_4.2.5.0015
00000090   0A 00 38 00  00 00 50 69  72 65 6C 6C  69 42 53 00  00 00 00 00  00 00 00 00  ..8...PirelliBS.........
000000A8   00 00 49 4D  41 47 45 00  00 00 00 00  00 00 00 00  36 33 34 38  00 00 50 69  ..IMAGE.........6348..Pi
000000C0   72 65 6C 6C  69 47 61 74  65 57 32 2B  00 00 31 00  33 35 35 33  39 35 32 00  relliGateW2+..1.3553952.
000000D8   00 00 30 00  00 00 00 00  00 00 00 00  00 00 30 00  00 00 00 00  00 00 00 00  ..0...........0.........
000000F0   33 32 31 37  30 39 36 39  36 30 00 00  30 00 00 00  00 00 00 00  00 00 33 32  3217096960..0.........32
00000108   31 37 30 39  36 39 36 30  00 00 33 35  35 33 39 35  32 00 00 00  00 00 00 00  17096960..3553952.......
00000120   44 57 52 5F  39 36 33 34  38 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  DWR_96348...............
00000138   00 00 00 00  54 45 4F 5F  34 2E 32 2E  35 2E 30 30  31 35 00 00  00 00 00 00  ....TEO_4.2.5.0015......
00000150   00 00 00 00  00 00 00 00  32 30 31 30  2F 30 39 2F  31 37 2D 31  36 3A 33 37  ........2010/09/17-16:37
00000168   00 00 92 91  EB D5 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 E9 EF  ........................
00000180   09 3B 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 00 80 01  00 00 80 01  .;......................
00000198   00 00 00 00  00 1C 5D 00  00 40 00 00  1E 01 14 2C  B0 A1 E8 73  9C D3 F3 E1  ......]..@.....,...s....
000001B0   0F E0 BB 08  4B AE 9C 29  6C 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  ....K..)l...............

And this is the output of the Flash layout.

DRG A125G> flash layout

Section 00 Type BOOT       Range 0x00000000-0x00010000 MaxSize 0x00010000
        No more information.

Section 01 Type IMAGE      Range 0x00010000-0x003D0000 MaxSize 0x003BFF6C
        Size 0x003A60B0 Name 'IMAGE'
        Checksum 0x1CD6BF45 Counter 0x00000002 Start Offset 0x00000000

Section 02 Type CONF       Range 0x003D0000-0x003E0000 MaxSize 0x0000FF6C
        Size 0x00004B68 Name 'rg_conf'
        Checksum 0x002603D2 Counter 0x000044A3 Start Offset 0x00000000

Section 03 Type CONF       Range 0x003E0000-0x003F0000 MaxSize 0x0000FF6C
        Size 0x00004C3A Name 'rg_conf'
        Checksum 0x0026782E Counter 0x000044A1 Start Offset 0x00000000

Section 04 Type FACTORY    Range 0x003F0000-0x00400000 MaxSize 0x0000FF6C
        Size 0x0000052A Name 'rg_factory'
        Checksum 0x00012222 Counter 0x00000012 Start Offset 0x00000000

Total 5 sections found.

Finally I decided to post the result of system config file that was used to compile this version (openrg-4.5.3.TEO_4.2.5.0008-DWR_96348.img):

DRG A125G> system print_configuration

CONFIG_RG_DEV_IF_BCM43XX=y
CONFIG_RG_DEV_IF_USB_RNDIS=y
CONFIG_RG_DEV_IF_BRIDGE=y
CONFIG_RG_DEV_IF_BCM963XX_ADSL=y
CONFIG_RG_DEV_IF_BCM5325E_HW_SWITCH=y
RG_PROD_STR=DRG A125G
CONFIG_RG_OS=LINUX_26
CONFIG_RG_HW=DWV_BCM96348
RMT_UPG_SITE=update.pirelli-discus.com
RMT_UPG_URL=https://update.pirelli-discus.com/
CONFIG_RG_HW_DESC_STR=DRG A125G
CONFIG_RG_DIST=DWR_96348
CONFIG_RG_WIRELESS_COUNTRY_CODE=IT
CONFIG_RG_HTTP_AUTH=y
CONFIG_RG_JPKG_SRC_LIST=build web-mng libwbm web-mng-images main samples gdb tcpdump libpcap
CONFIG_MMU=y
CONFIG_INIT_ENV_ARG_LIMIT=32
CONFIG_PRINTK=y
CONFIG_BUG=y
CONFIG_TINY_SHMEM=y
CONFIG_OBSOLETE_MODPARM=y
CONFIG_KMOD=y
CONFIG_GENERIC_CALIBRATE_DELAY=y
CONFIG_IOSCHED_NOOP=y
CONFIG_IOSCHED_AS=y
CONFIG_IOSCHED_DEADLINE=y
CONFIG_IOSCHED_CFQ=y
CONFIG_DEFAULT_IOSCHED="anticipatory"
CONFIG_NET_IPGRE=y
CONFIG_INET_TUNNEL=y
CONFIG_XFRM=y
CONFIG_NET_SCH_CLK_JIFFIES=y
CONFIG_LEGACY_PTYS=y
CONFIG_LEGACY_PTY_COUNT=256
CONFIG_LOG_BUF_SHIFT=14
CONFIG_CRC32=y
CONFIG_GENERIC_HARDIRQS=y
CONFIG_MODULE_UNLOAD=y
CONFIG_INITRAMFS_SOURCE=$(RAMDISK_MOUNT_POINT)
CONFIG_INITRAMFS_ROOT_UID=$(shell id -u)
CONFIG_INITRAMFS_ROOT_GID=$(shell id -g)
CONFIG_IP_FIB_HASH=y
CONFIG_CC_OPTIMIZE_FOR_SIZE=y
CONFIG_OBSOLETE_INTERMODULE=y
CONFIG_TRAD_SIGNALS=y
CONFIG_BUILD_ELF32=y
CONFIG_RG_JPKG_DIST=JPKG_BCM9634X
ARCH=mips
LIBC_ARCH=mips
CONFIG_RG_FOOTPRINT_REDUCTION=y
CONFIG_NETFILTER=y
CONFIG_EXPORT_BINARIES=y
CONFIG_RG_RGLOADER_CLI_CMD=y
CONFIG_RG_UIEVENTS=y
CONFIG_ATM=y
CONFIG_ATM_BR2684=y
CONFIG_ATM_SKB=y
CONFIG_ATM_PVC_SCAN=y
CONFIG_RG_ATM_QOS=y
CONFIG_AUTO_LEARN_DNS=y
CONFIG_BINFMT_ELF=y
CONFIG_BLK_DEV_LOOP=y
CONFIG_CMDLINE=console=ttyS0,115200
CONFIG_CRAMFS_DYN_BLOCKSIZE=y
CONFIG_CRAMFS_BLKSZ=65536
CONFIG_CPU_BIG_ENDIAN=y
CONFIG_CPU_MIPS32=y
CONFIG_CPU_MIPS32_R1=y
CONFIG_CRAMFS=y
CONFIG_CRAMFS_FS=y
CONFIG_CRAMFS_FS_COMMON=y
CONFIG_RG_CRAMFS_IN_FLASH=y
CONFIG_CROSSCOMPILE=y
CONFIG_DEBUG_USER=y
CONFIG_DEF_KEYS=y
LIC=../jpkg_bcm9634x.lic
LICSTR=2fcf99a451f3dc6f1a517388542ea388caa0253e5d2a86ec4ea64b6101aaf00217079c211b954e5139b6f54a1ab426a143f4fc0479d6ad1f4ce6395f43e74f445b8bfb6e952af719d12b2f0e2c888d4ce3771fbf59267e.PIRELLI
LIC_AUTOCONF=y
CONFIG_EXPERIMENTAL=y
CONFIG_MAGIC_SYSRQ=y
CONFIG_FREEPAGES_HIGH=384
CONFIG_FREEPAGES_LOW=256
CONFIG_FREEPAGES_MIN=32
CONFIG_FREEPAGES_THRESHOLD=y
CONFIG_FREESWAN=y
CONFIG_RG_NETBIOS_RT=m
CONFIG_GEN_RG_DEFAULT=y
CONFIG_GMP=y
CONFIG_HAS_MMU=y
CONFIG_DEF_BRIDGE_LANS=y
CONFIG_INET=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_MULTICAST=y
CONFIG_IPSEC=y
CONFIG_IPSEC_AH=y
CONFIG_IPSEC_AUTH_HMAC_MD5=y
CONFIG_IPSEC_ALG_MD5=m
CONFIG_IPSEC_AUTH_HMAC_SHA1=y
CONFIG_IPSEC_ALG_SHA1=m
CONFIG_IPSEC_DEBUG=y
CONFIG_IPSEC_ENC_3DES=y
CONFIG_IPSEC_ALG_3DES=m
CONFIG_IPSEC_ENC_1DES=y
CONFIG_IPSEC_ALG_1DES=m
CONFIG_IPSEC_ENC_NULL=y
CONFIG_IPSEC_ALG_NULL=m
CONFIG_IPSEC_ENC_AES=y
CONFIG_IPSEC_ALG_AES=m
CONFIG_IPSEC_ESP=y
CONFIG_IPSEC_IPCOMP=y
CONFIG_IPSEC_IPIP=y
CONFIG_RG_IPSEC_NO_SECRET_FILE=y
CONFIG_IPSEC_DRIVER=y
CONFIG_RG_IPSEC_ESP_ALG=y
CONFIG_RG_IPSEC_IKE_ALG=y
CONFIG_IPSEC_ALG=y
CONFIG_IPSEC_NAT_TRAVERSAL=y
CONFIG_KCORE_ELF=y
CONFIG_RG_FLASH_START_ADDR=0xbfc00000
CONFIG_LOG_FILES_MAX_SIZE=16384
CONFIG_LOG_FILES_MIN_SIZE=12288
CONFIG_MIPS=y
CONFIG_MIPS32=y
CONFIG_MIPS_BRCM=y
CONFIG_BCM96348=y
CONFIG_BCM963XX=y
CONFIG_BCM963XX_COMMON=y
CONFIG_BCM963XX_BOARD_ID=PirelliGateW2+
CONFIG_BCM963XX_CHIP=6348
CONFIG_BCM963XX_SDRAM_SIZE=16
CONFIG_BCM963XX_MTD=y
CONFIG_BCM963XX_SERIAL=y
CONFIG_BCM963XX_ETH=m
CONFIG_BCM963XX_ATM=m
CONFIG_BCM963XX_ADSL=m
CONFIG_BCM963XX_USB=m
CONFIG_BCM4318=y
CONFIG_BCM43XX_MODE=AP
CONFIG_BCM43XX_WLCTL_TOOL=y
CONFIG_BCM_SERIAL_CONSOLE=y
CONFIG_BCM963XX_BOOTSTRAP=y
CONFIG_RAMFS=y
CONFIG_MODULES=y
CONFIG_SYSFS=y
CONFIG_MTD=y
CONFIG_MTD_BLOCK=y
CONFIG_MTD_CFI=y
CONFIG_MTD_GEN_PROBE=y
CONFIG_MTD_PARTITIONS=y
CONFIG_MTD_MAP_BANK_WIDTH_1=y
CONFIG_MTD_MAP_BANK_WIDTH_2=y
CONFIG_MTD_MAP_BANK_WIDTH_4=y
CONFIG_MTD_CFI_I1=y
CONFIG_MTD_CFI_I2=y
CONFIG_MTD_CFI_AMDSTD=y
CONFIG_MTD_CFI_UTIL=y
CONFIG_NET=y
CONFIG_NETDEVICES=y
CONFIG_NET_ETHERNET=y
CONFIG_NET_RADIO=y
CONFIG_NET_WIRELESS=y
CONFIG_NET_IPIP=y
CONFIG_OPENRG=y
CONFIG_RG_CONFIG_STRINGS=y
CONFIG_PACKET=y
CONFIG_PCI=y
CONFIG_PLUTO_DEBUG=y
CONFIG_RG_PPP=m
CONFIG_RG_PPP_BSDCOMP=y
CONFIG_RG_PPP_DEFLATE=y
CONFIG_RG_PPP_ON_DEMAND_DEFAULT_MAX_IDLE_TIME=1200
CONFIG_RG_PPP_DEFAULT_BSD_COMPRESSION=1
CONFIG_RG_PPP_DEFAULT_DEFLATE_COMPRESSION=1
CONFIG_RG_PPPOA=m
CONFIG_RG_PPPOE=y
CONFIG_RG_PPPOS=y
CONFIG_RG_SERIAL=y
CONFIG_PROC_FS=y
CONFIG_RG_ALG=y
CONFIG_RG_ALG_ICMP=y
CONFIG_RG_ALG_PORT_TRIGGER=y
CONFIG_RG_ALG_FTP=y
CONFIG_RG_ALG_RTSP=y
CONFIG_RG_ALG_H323=y
CONFIG_RG_ALG_SIP=y
CONFIG_RG_ALG_MGCP=y
CONFIG_RG_ALG_PPTP=y
CONFIG_RG_ALG_MSNMS=y
CONFIG_RG_ALG_IPSEC=y
CONFIG_RG_ALG_L2TP=y
CONFIG_RG_ALG_AIM=y
CONFIG_RG_ALG_DNS=y
CONFIG_RG_ALG_DHCP=y
CONFIG_RG_ALG_USERSPACE=y
CONFIG_RG_BRIDGE=m
CONFIG_RG_8021Q_IF=y
CONFIG_RG_CHRDEV=y
CONFIG_RG_PPPOE_RELAY=m
CONFIG_RG_DSLHOME=y
CONFIG_RG_TR_098=y
CONFIG_RG_FIREWALL=y
CONFIG_RG_ADV_SERVICES_LEVEL=2
CONFIG_RG_IGD=y
CONFIG_RG_MGT_IGD=y
CONFIG_RG_IGMP_PROXY=m
CONFIG_RG_JFW=m
CONFIG_RG_MSS=m
CONFIG_RG_LAN_UPGRADE=y
CONFIG_RG_OS_LINUX=y
CONFIG_RG_NAT=y
CONFIG_RG_NETTOOLS_ARP=y
CONFIG_RG_OPENSSL=y
CONFIG_RG_CRYPTO=y
CONFIG_RG_SSL=y
CONFIG_RG_PERM_STORAGE=y
CONFIG_RG_ONE_MODULE=m
CONFIG_RG_KOS=m
CONFIG_RG_KOS_KNET=y
CONFIG_RG_IPV4=m
CONFIG_RG_RIP=y
CONFIG_RG_RMT_UPDATE=y
CONFIG_RG_RNAT=y
CONFIG_RG_SYSINIT=y
CONFIG_RG_SYSLOG_REMOTE=y
CONFIG_RG_UCD_SNMP=y
CONFIG_RG_UCD_SNMP_STATISTICS=y
CONFIG_RG_UCD_SNMP_V3=y
CONFIG_RG_UPNP=y
CONFIG_RG_WAN_UPGRADE=y
CONFIG_RG_WLAN_AUTO_CHANNEL_SELECT=y
CONFIG_RG_DNS=y
CONFIG_RG_DNS_CONCURRENT=y
CONFIG_RG_DNS_ROUTE=y
CONFIG_RG_DNS_DOMAIN_ROUTING=y
CONFIG_RG_DDNS=y
CONFIG_RG_ENTFY=y
CONFIG_RG_GENERIC_PROXY=y
CONFIG_RG_8021X=y
CONFIG_RG_8021X_MD5=y
CONFIG_RG_8021X_TTLS=y
CONFIG_RG_8021X_PKTFIL=m
CONFIG_RG_8021X_TLS=y
CONFIG_RG_8021X_RADIUS=y
CONFIG_RG_8021X_WBM=y
CONFIG_RG_RADIUS_CLIENT=y
CONFIG_RG_VENDOR_WLAN_SEC=y
CONFIG_RG_AUTH=y
CONFIG_RG_SSID_NAME=openrg
CONFIG_RG_RADIUS_WBM_IN_CONN=y
CONFIG_RG_RADIUS_COMMON=y
CONFIG_RG_WEP=y
CONFIG_RG_WPA=y
CONFIG_RG_WPA_BCM=y
CONFIG_RG_WPA_WBM=y
CONFIG_RG_DHCPS=y
CONFIG_RG_DHCPC=y
CONFIG_RG_DHCPR=y
CONFIG_RG_DHCP_PKTFIL=m
CONFIG_RG_SSI=y
CONFIG_RG_WBM=y
CONFIG_FREESWAN_COMMON=y
CONFIG_RG_DHCP_COMMON=y
CONFIG_RG_LZMA=y
CONFIG_RG_MGT=y
CONFIG_RG_OPENSSL_COMMON=y
CONFIG_RG_OPENSSL_MD5=y
CONFIG_RG_OPENSSL_SHA=y
CONFIG_RG_OPENSSL_DES=y
CONFIG_RG_OPENSSL_MD4=y
CONFIG_RG_RGLOADER_COMMON=y
CONFIG_RG_SYSLOG_COMMON=y
CONFIG_RG_TEST_TOOLS=y
CONFIG_RG_TZ=y
CONFIG_PBS_GUI_PIRELLI=y
CONFIG_RG_LIBIMAGE=y
CONFIG_RG_LIBIMAGE_DIM=y
CONFIG_RG_NETOBJ=y
CONFIG_RG_AUTO_DST=y
CONFIG_RG_TZ_COMMON=y
CONFIG_RG_TZ_YEARS=5
CONFIG_RG_HTTPS=y
CONFIG_HTTP_CGI_PROCESS=y
CONFIG_RG_TELNETS=y
CONFIG_RG_SYSLOG=y
CONFIG_RG_LOG_DEV=m
CONFIG_RG_KERN_LOG=y
CONFIG_RG_LOG_DEV_BUF_SIZE=16384
CONFIG_RG_SYSLOG_FW_DEF_SIZE=16384
CONFIG_RG_CLI=y
CONFIG_RG_CLI_SERIAL=y
CONFIG_RG_TTYP=y
CONFIG_RG_LOGIN=y
CONFIG_RG_STATIC_ROUTE=y
CONFIG_RG_BUSYBOX=y
CONFIG_RG_ERESOLV=y
CONFIG_RG_WGET=y
CONFIG_RG_FREESWAN=y
CONFIG_RG_X509=y
CONFIG_RG_CERT=y
CONFIG_RGLOADER_CLI=y
CONFIG_RWSEM_GENERIC_SPINLOCK=y
CONFIG_SDRAM_SIZE=16
CONFIG_SERIAL_CORE=y
CONFIG_SERIAL_CORE_CONSOLE=y
CONFIG_SYN_COOKIES=y
CONFIG_SYSCTL=y
CONFIG_SYSLOG_UNIXSOCK_SUPPORT=y
CONFIG_SYSVIPC=y
CONFIG_RG_PING=y
CONFIG_RG_TRACEROUTE=y
CONFIG_RG_TCP_DETECT=y
CONFIG_RG_ARP_PING=y
CONFIG_RG_TODC=y
CONFIG_ULIBC=y
CONFIG_ULIBC_DO_C99_MATH=y
CONFIG_UNIX=y
CONFIG_USB_RNDIS=y
CONFIG_VPN=y
TARGET_ENDIANESS=BIG
BOARD=DWR_BCM96348
FIRM=Pirelli
CONFIG_RG_FACTORY_SETTINGS=y
CONFIG_RG_HW_BUTTONS=m
CONFIG_RG_CONSOLE_DEVICE=ttyS0
OPENRG_CHRDEV_MAJOR=240
OPENRG_CHRDEV_NAME=rg_chrdev
CONFIG_GCC_CAN_INLINE=y
CONFIG_RG_LARGE_FILE_SUPPORT=y
CONFIG_RG_CODEPAGE=""
CONFIG_VLAN_8021Q=y
CONFIG_RG_VLAN_8021Q=y
CONFIG_RG_OS_LINUX_26=y
CONFIG_RG_LANGUAGES=DEF
CONFIG_RG_DIST_LANG=eng
CONFIG_PBS_PERM=y
CONFIG_PBS_PERM_USERS=DEF usr loc_adm rem_adm
CONFIG_BOOT_ELF32=y
CONFIG_MIPS_L1_CACHE_SHIFT=5
CONFIG_CPU_HAS_PREFETCH=y
CONFIG_CPU_HAS_LLSC=y
CONFIG_CPU_HAS_SYNC=y
CONFIG_DMA_NONCOHERENT=y
CONFIG_32BIT=y
CONFIG_PAGE_SIZE_4KB=y
CONFIG_FLATMEM=y
CONFIG_FLAT_NODE_MEM_MAP=y
CONFIG_LINUX_SKB_REUSE=y
CONFIG_ZLIB_INFLATE=y
CONFIG_ZLIB_DEFLATE=y
CONFIG_RG_OAM_PING=y
CONFIG_RG_FRAG_CACHE=m
CONFIG_RG_XML=y
CONFIG_RG_FLASH_LAYOUT_SIZE=4
CONFIG_RG_PROD_IMG=y
CONFIG_ZC_IP_AUTO_DETECTION=y
CONFIG_RG_LANG=y
CONFIG_RG_ZLIB=y
CONFIG_RG_KERNEL=y
CONFIG_RG_MAIN=y
CONFIG_RG_VENDOR=y
CONFIG_RG_KERNEL_NEEDED_SYMBOLS=y
CONFIG_RG_EVENT_LOGGING=y
CONFIG_TOS_DSCP_RFC2474=y
CONFIG_RG_IPROUTE2=y
CONFIG_RG_QOS=y
CONFIG_RG_QOS_INGRESS=m
CONFIG_RG_VLAN_DSCP=y
CONFIG_NET_SCHED=y
CONFIG_NET_SCH_INGRESS=y
CONFIG_NET_SCH_HTB=y
CONFIG_NET_SCH_WRR=y
CONFIG_NET_SCH_ATM=y
CONFIG_NET_SCH_PRIO=y
CONFIG_NET_SCH_RED=y
CONFIG_NET_SCH_SFQ=y
CONFIG_NET_SCH_DSMARK=y
CONFIG_NET_QOS=y
CONFIG_NET_ESTIMATOR=y
CONFIG_NET_CLS=y
CONFIG_NET_CLS_POLICE=y
CONFIG_NET_CLS_TCINDEX=y
CONFIG_NET_CLS_FW=y
CONFIG_NET_CLS_U32=y
CONFIG_NET_CLS_RSVP=y
CONFIG_NET_CLS_RSVP6=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IP_ROUTE_VERBOSE=y
CONFIG_IP_ROUTE_FWMARK=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_TOS=y
CONFIG_RG_TUNNELS=y
CONFIG_RG_FOUNDATION_CORE=y
CONFIG_RG_TARGET_LINUX=y
CONFIG_RG_HOST_LINUX=y
MODULE_RG_FOUNDATION=y
MODULE_RG_ADVANCED_MANAGEMENT=y
MODULE_RG_SNMP=y
MODULE_RG_DSL=y
MODULE_RG_PPP=y
MODULE_RG_VLAN=y
MODULE_RG_UPNP=y
MODULE_RG_ADVANCED_ROUTING=y
MODULE_RG_FIREWALL_AND_SECURITY=y
MODULE_RG_IPSEC=y
MODULE_RG_WLAN_AND_ADVANCED_WLAN=y
MODULE_RG_QOS=y
MODULE_RG_DSLHOME=y
CONFIG_HW_ETH_WAN=y
CONFIG_HW_DSL_WAN=y
CONFIG_HW_SWITCH_LAN=y
CONFIG_HW_80211G_BCM43XX=y
CONFIG_HW_USB_RNDIS=y
CONFIG_HW_LEDS=y
CONFIG_HW_BUTTONS=m
CONFIG_HW_SWITCH_BCM53XX=m
CONFIG_RG_MAC_CLONING=y
CONFIG_RG_UNCONFIGURED_WAN_INTERCEPTION=y
CONFIG_RG_CHECK_BAD_REBOOTS=y
CONFIG_RG_INITFS_RAMFS=y
CONFIG_RG_MAINFS=y
CONFIG_RG_MAINFS_CRAMFS=y
CONFIG_RG_CRAMFS_COMP_METHOD=lzma
CONFIG_RG_KERNEL_COMP_METHOD=lzma
CONFIG_RG_LZMA_COMPRESSED_KERNEL=y
CONFIG_RG_LICENSE=y
LANG_COMPILER_OPT=--select "DEF"
LANG_COMPILER=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/util/lang_compiler
PERM_COMPILER_OPT=--perm --select "DEF usr loc_adm rem_adm"
PERM_COMPILER=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/util/lang_compiler
ENDIAN_LDFLAGS=-EB
ENDIAN_CFLAGS=-meb
OS_PATH=$(1)
TOOLCHAIN_ROOT=/usr/local/openrg
I386_TARGET_MACHINE=i386-jungo-linux-gnu
I386_TOOLS_PREFIX=/usr/local/openrg/i386-jungo-linux-gnu
TARGET_MACHINE=mipseb-broadcom-linux-uclibc
TARGET_PREFIX=mipseb-broadcom-linux-uclibc
TOOLS_PREFIX=/usr/local/openrg/mipseb-broadcom-linux-uclibc
CROSS_COMPILE=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-
LIBC_IN_TOOLCHAIN=n
CC=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/build/rg_gcc
CXX=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-g++
TARGET_CXX=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-g++
TARGET_CC=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-gcc
TARGET_CPP=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-gcc -E
REAL_GCC=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-gcc
CC_FOR_BUILD=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-gcc -DCC_FOR_BUILD -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/include -DCONFIG_HAS_MMU
CXX_FOR_BUILD=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-g++ -DCC_FOR_BUILD -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/include -DCONFIG_HAS_MMU
GCC_HAS_SIZE_OPTIMIZE=y
GCC_VERSION=3.4.2
AR=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-ar
LD=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-ld
AS=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-as
NM=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-nm
RANLIB=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-ranlib
STRIP=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-strip
SIZE=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-size
OBJCOPY=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-objcopy
OBJDUMP=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/mipseb-broadcom-linux-uclibc-objdump
HOST_AR=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-ar
HOST_LD=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-ld
HOST_AS=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-as
HOST_NM=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-nm
HOST_RANLIB=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-ranlib
HOST_STRIP=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-strip
HOST_SIZE=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-size
HOST_OBJCOPY=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-objcopy
HOST_OBJDUMP=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-objdump
YACC=bison
LEX=/usr/bin/flex
YFLAGS=-y
SPCC=echo
RG_INCLUDE_DIR=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/include
RG_BIN=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/build/bin/
RG_LIB=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/build/lib/
RG_BUILD=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/build/
NET_TOOLS_MAKE_FILE=/home/marcodl/Sviluppo_Pirelli_TEO/rg/pkg/include/net-tools-config.make
LOCAL_ADD_RG_KERNEL_FOR_TARGET=-idirafter /home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux/include
PATH=.:/usr/bin:/bin:/usr/local/bin:/usr/X11R6/bin/:/usr/games:/usr/lib/qt3//bin:/home/marcodl/bin:/usr/lib/qt3//bin:/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin
DYNAMIC_LINKER=/lib/ld-linux.so.1
PERM_STORAGE_FILES_DIR=/home/marcodl/Sviluppo_Pirelli_TEO/rg/pkg/flash/
LZMAMK=/home/marcodl/Sviluppo_Pirelli_TEO/rg/pkg/lzma/SRC/lzma.mak
BINFRMT_FILE=target_binfmt_elf.mak
COMPRESSED_RAMDISK=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux/arch/mips/ramdisk/ramdisk.gz
MODFS_DISK=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux/usr/modfs.img
AUTOCONF_H=include/linux/autoconf.h
PROD_LINUX_TARGET=bzImage.initrd
OS_TARGET=bzImage.initrd
HOSTCC=gcc -DCONFIG_HAS_MMU
HOSTCPP=gcc -DCONFIG_HAS_MMU -E
CPP=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/build/rg_gcc -E
CPP_FOR_BUILD=/usr/local/openrg/i386-jungo-linux-gnu/bin/i386-jungo-linux-gnu-gcc -DCC_FOR_BUILD -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/include -DCONFIG_HAS_MMU -E
RG_CFLAGS=-D_LIBC_REENTRANT -Wall -g -Os
STATIC_MOD_DIR=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/kernel/modules_static/
RG_LIBPTHREAD_VERSION=0.8
NEEDED_SYMBOLS=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux/needed_symbols.lst
COMPRESSED_DISK=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux/usr/mainfs.img
BOOTLDR_COMPRESSED_DISK=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux/arch/mips/boot/bootldr_ramdisk.gz

GENROMFS=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/genromfs/genromfs
PROD_KERNEL_IMAGE=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux/vmlinux
OPENRG_IMG=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/openrg.img
OPENRG_RMT_UPDATE_IMG=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/openrg.rmt
OPENRG_PROD=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/openrg.prod
FLASH_IMG=BUILDDIR/flash.img
BOOTLDR_IMG=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/bootldr/arch/boot.img
HAVE_GC_SECTIONS=y
HAVE_ATTRIBUTE_NONNULL=y
LINUX_ARCH_PATH=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux/arch/mips
ARCH_CFLAGS=-meb -march=mips32 -mabi=32 -Wa,-32 -Wa,-march=mips32
FLASH_IMG_OFFSET=0x0
FLASH_IMG_REAL_OFFSET=0x0
RG_LINUX_CFLAGS=-Wall -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -pipe -fomit-frame-pointer -O2 -mno-split-addresses -G 0 -mno-abicalls -fno-pic -mlong-calls -meb -march=mips32 -mabi=32 -Wa,-32 -Wa,-march=mips32   -Wa,--trap -D__KERNEL__ -D__TARGET__  -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/include -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/include2 -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/os/linux-2.6/include2 -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/os/linux-2.6/include -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/arch/mips -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/arch/mips/include -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/os/linux-2.6/arch/mips -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/include/asm/mach-bcm963xx -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/include2/asm/mach-generic
RG_LINUX_26_CFLAGS=-I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/include -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/include2 -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/os/linux-2.6/include2 -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/os/linux-2.6/include -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/arch/mips -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/arch/mips/include -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/os/linux-2.6/arch/mips -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/include/asm/mach-bcm963xx -I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux-2.6/include2/asm/mach-generic
LINUX_CFLAGS=-meb
ARCH_LINUX_FLAGS=-meb -march=mips32 -mabi=32 -Wa,-32 -Wa,-march=mips32   -Wa,--trap
LDFLAGS_ENVIR=-meb -Wl,--gc-sections -static -L/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/lib
LOCAL_LDFLAGS=-L/home/marcodl/Sviluppo_Pirelli_TEO/rg/pkg/lib -Wl,--dynamic-linker,/usr/local/openrg/i386-jungo-linux-gnu/i386-jungo-linux-gnu/lib/ld-2.3.2.so -Wl,-rpath,/usr/local/openrg/i386-jungo-linux-gnu/i386-jungo-linux-gnu/lib --static
LOCAL_CFLAGS=-I/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/include -D__HOST__ -O0 -Wall -Wstrict-prototypes --no-strict-aliasing -g
LIB_GCC_DIR_PREFIX=/usr/local/openrg/mipseb-broadcom-linux-uclibc/bin/../lib/gcc/mipseb-broadcom-linux-uclibc/3.4.2
CFLAGS_ENVIR=-ffunction-sections -fdata-sections -Wstrict-prototypes --no-strict-aliasing -D_LIBC_REENTRANT -Wall -g -Os  -meb -march=mips32 -mabi=32 -Wa,-32 -Wa,-march=mips32  -D__TARGET__
OPENRG_LIB=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/util/libopenrg.a
OPENRG_GPL_LIB=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/util/libopenrg_gpl.a
OPENRG_GPL_LDLIBS=-lopenrg_gpl
OPENRG_LDLIBS=-lopenrg -ljutil -lssl -lcrypto -lopenrg -ljutil -lrg_config
OPENRG_LOCAL_LDLIBS=-llocal_openrg -llocal_jutil -llocal_rg_config -llocal_ssl -llocal_crypto
MGT_LDLIBS=-lmgt
MGT_LOCAL_LDLIBS=-llocal_mgt
UNITTEST_SPAWNER=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/pkg/util/jspawn -s 20
CONFIG_RG_SESSION_MEMORY=y
CONFIG_SPLIT_PTLOCK_CPUS=4
CONFIG_SLAB=y
CONFIG_HW_DWR_96348=y
CONFIG_USE_FACTORY_MAC=y
CONFIG_PBS_VERSION_COMPARE=y
CONFIG_PBS_WEB_PARAMETERS_SET=y
CONFIG_AGW2DEC=y
CONFIG_PBS_DHCPS=y
CONFIG_PBS_DHCPS_ARP_SCAN=y
CONFIG_CUSTOMER=TEO
CONFIG_PBS_CUSTOMER_TEO=y
CONFIG_PBS_CONF_FILE_UPGRADE=y
CONFIG_PBS_DEFAULT_CONF_FROM_FILE=y
BCM43XX_OLD_DRIVER=y
CONFIG_PBS_SWITCH_ESD_PROTECTION=y
CONFIG_PBS_SWITCH_CHECK_CRITICAL_REG=y
CONFIG_PBS_DYNAMIC_ETH_WAN=y
CONFIG_PBS_MT_WIFI=y
CONFIG_PBS_CWMP_SEQ_INDEXES=y

(Last edited by PopOpen on 30 Mar 2011, 22:54)

Orca wrote:

Care to document your approach in   http://wiki.openwrt.org/doc/devel/add.new.device

generic stuff in section general approach, special stuff sub examples

I'm happy to document everything once I have something of use. But since I don't get any response, I have nothing else to document at the moment.

The only progress so far is this:

The original Lithuanian TEO released Pirelli firware is an .IMG file. However, later firmware are all released as a .RMT file. Apparently the only difference for a .RMT file, there is an added header from: 0x00:0x91 (0-145) on top of the .IMG file. This mean that the start of the first block of code is displaced accordingly from:

   IMG: 0x3FFD : 16381
   RMT: 0x408F : 16527

   Comparing the non-trivial part of the headers:

RMT08: 00 3A 60 B0  96 CC EA 0A  4F 0A 8F 05  08 A8 6C 12  A3 82 CE A0  58 E1 8A 8E  10 F1 B3 6A  5A 36 5A 46  BA 87 C5 2B  .:`.....O.....l.....X......jZ6ZF...+
RMT13: 00 36 2C D0  E5 86 1E AA  30 27 64 F3  69 11 10 E6  2A DF 05 65  48 D6 A6 10  3F 33 3E 3E  F6 C7 87 84  A4 AE 45 5A  .6,.....0'd.i...*..eH...?3>>......EZ
RMT15: 00 36 3B A0  12 A8 B1 D8  D6 52 CE 99  22 3D E6 A6  A7 2C 5C AE  DA E3 E0 67  29 11 5F 82  27 DD F8 12  3A 9F 82 6A  .6;......R.."=...,\....g)._.'...:..j

Comparing the headers we see that the only binary-important difference is from 0x00:0x21 (0-33). There is also some suspicion that the first 2-4 bytes are some magic number and that the remaining 32 bytes (256 bits) could be an SHA1-like hash function of the rest of the code that starts at 0x408F (16527) in all cases. However, inspecting what modules and what programs are present on the default system, we can have a choice of SHA1, DES1/3, AES, and MD5.

If this is right, we should be able to produce the same hash by first extracting the code and then applying one of the hash functions to that.
After inserting the hash in the beginning of the (.bin below) file, we should be able to save it as a proper .rmt that the router web-interface
should accept as a valid firmware file.

"Outline" of procedure:

# dd if=teo8.img of=teo8img.bin bs=1c skip=16527
# sha1sum teo8img.bin >teo8img.sha
# cat teo8.img >>teo8img.sha
# mv teo8img.sha teo8.rmt

Finally I believe the guys over here: http://www.wifi-shark.co.cc/forum/ may already sit on a solution...

UPDATE!

After having read carefully about general Pirelli firmware in this thread of the excellent Wifi-Shark forum, I have finally been able to extract the CramFS layer of the Pirelli firmware images.


Summary:

Like many people have already noticed at a first inspection, the Pirelli firmware seem like LZMA compressed (due to strings containing "LZMA") in some aspects and CramFS in other. The truth, is that it is both, as is common with many FWs, or at least the Broadcom based ones. (See link below.) However, this is also the reason behind the problems when using standard linux filesystem tools. Jungo's OpenRG version of CramFS is a non-standard and modified version of an old LZMA compressor. In general, if you wonder how your FW filesystem was compiled, there are always some hints to be found in the compilation CONFIG file. For example:

CONFIG_RG_CRAMFS_COMP_METHOD=lzma
CONFIG_RG_KERNEL_COMP_METHOD=lzma
CONFIG_RG_LZMA=y
CONFIG_RG_LZMA_COMPRESSED_KERNEL=y
CONFIG_RG_MAINFS_CRAMFS=y
LZMAMK=/home/marcodl/Sviluppo_Pirelli_TEO/rg/pkg/lzma/SRC/lzma.mak
MODFS_DISK=/home/marcodl/Sviluppo_Pirelli_TEO/rg/build.DWR_96348/os/linux/usr/modfs.img

Fortunately there are some really talented hardware hackers out there. One of them have extracted and patched together the relevant parts of the Jungo OpenRG implementation and released the source code on his website. Thus you need to download and compile the code from:  http://va.ler.io/dl/lzma-uncramfs.tar.gz

(This was all done on Cygwin.)

tar -zxvf lzma-uncramfs.tar.gz
cd lzma-uncramfs
make
chmod 755 lzma-uncramfs
cp lzma-uncramfs.exe $HOME/bin
lzma-uncramfs.exe -v
---
lzma-uncramfs v0.7rg by Andrew Stitcher, lzma for openrg  by V. Di Giampietro (v@ler.io)
Usage: 'lzma-uncramfs [-d devfilename] [-m modefilename] dirname infile'
  where <dirname> is the root for the
  uncompressed (output) filesystem.
---

The firmware header:

Now the real fun begins. Like I mentioned before, apparently the only difference from a .img and .rmt image in the A125G case, is that the latter has 146 byte header. The non-trivial part of this is only 36 bytes, where the rest of the header consists of mostly text strings. Thus if you simply remove the entire header, you have a .img file. (Although I have not tested this, apart from visual inspection.) The exact function of this header remains a mystery, but most likely a hashed check-sum for the entire file content. Which may explain the different header lengths between router models, probably due to different hash algorithms.

However, for the Lithuanian TEO FW releases I have available I have noticed the following:

0x00:      Is always 0
0x01:      Is varying sometimes between release versions (A125G: 3A/36 ...)
0x02-0x03: Is a "magic" number varying with firmware release, indicating the start of the first code block. This is so at least for the A125G TEO distributed firmware, but not so in other models. 
0x04-0x23: Is probably the 32 byte hash sum. Length depend on router model.(A125G/A226G) 
0x24-0xYY: Beginning of text string "start section.rg_hw:", indicating code release etc. Here the length is not important.(A125G: YY=91, A226G: YY=95)

The CramFS layer Extraction:

To extract the FS, you need to find the magic number of the Jungo modified CramFS. Fortunately this number was found to be: 45 3D CD 28, and is preceding (by 12 bytes) the string "Compressed ROMFS". So fire up your hexedit and CTRL-S to search for that. Note this address.

NOTE: This magic is not valid (AFAIK) for all FW releases or for all models, but most...

An example for: "teo8.rmt" = openrg-4.5.3.TEO_4.2.5.0008-DWR_96348.rmt

# hex2dec 0xB6142    # (or just write: "printf '%d\n' 0xB6142" )
745794
# dd if=teo8.rmt of=teo8rmt.fs bs=1c skip=745794
# lzma-uncramfs.exe ./teo8 teo8rmt.fs
# cd teo8

And Voilá! Now you are free to explore some of your router code with you favorite tools.


So to address my own original questions:
(1) Done.
(2) Done.
(3) The /bin/openrg ELF binary
(4) see (3)
(5) Yes, any standard debugger supporting MIPS32-R1 code.
(6) Sure
(7) still unknown

Conclusion:
A) SUCCESS: Extraction of the CramFS FW layer is now possible.
B) FAIL: I still don't know how to extract the other layers.
C) FAIL: Still no understanding of the .rmt header code.


Appendix A: Some standard filetype identifiers ("magic numbers")

Compressed:

tar:         .tar    75 73 74 61 72   ustar
bzip:        .bz     42 5a            BZ
gzip:        .gz     1f 8b            ..
compress:    .Z      1f 9d            ..
pkzip:       .zip    50 4b 03 04      PK..

Pirelli-A            45 3D CD 28      E=.(

Executables:

MS Win/Dos:     4d 5a         MZ
Unix Elf        7f 45 4c 46   .ELF

PS. Please post other firmware relevant ones, should you know/find of any.


Appendix B: Some useful links
The very nice thread about Broadcom Hardware & Firmware:
https://forum.openwrt.org/viewtopic.php?id=11304

Firmware for several Pirelli models can be found here:
http://repofulm.dyndns.org/index.php?di … /official/

(Last edited by PopOpen on 14 Apr 2011, 23:37)

The firmware structure (.img Broadcom format) is the following:

Broadcom Header
Small LZMA compressed file containing info for the decompressor
LZMA decompressor
LZMA compressed block -
                                    |- Kernel, raw binary format
                                    |- Gzip ramdisk, containing a cpio archive with symlinks to populate the ramfs root filesystem at boot time
                                    |- Cramfs + LZMA main filesystem, containing almost everything (executables, libraries, config files)
                                    |- Cramfs + LZMA module filesystem, containing all kernel modules (they strangely have .o extension)

Yeah, it's really all that complicated! Jungo developers did their best to make our work difficult sad

Here you can find all the utils needed to extract all parts: http://repofulm.dyndns.org/index.php?di … ols.tar.gz

Bye! smile

Jack you are a GOD !

JackTheVendicator wrote:

The firmware structure (.img Broadcom format) is ...

Excellent! smile  But my problem is with the .rmt images. Those are probably the (only?) ones distributed today, for Pirelli router FW. ASFAIK. There the header structure is more complex as I described above. When I say "header" here I mean the first ~0x200 bytes.

The read is interesting, but I do not quite understand why you go through all of this. Why bother with already compiled files and with already generated image-files?

GPL bootloader are a huge plus here, since everything must be available as source. BSD is a PITA, since they do not need to give you the sources of their changes. Obviously there are a couple of scenarios where ""more free" BSD is pure shit for the end user!

Since the bootloader is not part of OpenWrt you simple need to find out, what it expects. Some magic value maybe or whatever. So you can boot the Kernel. And from there on everything is OpenWrt, everything is available as source code with more or less additional documentation. So no more guessing any more.

To obtain an OpenWrt image, look here: http://wiki.openwrt.org/doc/howto/obtain.firmware  maybe you want to write an Italian translation?

Orca wrote:

The read is interesting, but I do not quite understand why you go through all of this. Why bother with already compiled files and with already generated image-files?

I understand this sound a bit out of topic, but it is not. The problem is that you can not update (at least not on the routers I have access to) from the Web-interface, as FW is doing some kind of hash check on those files. It would be great to be able upgrade to OpenWRT without having to solder serial cables. Even talented people have trouble correctly solder their serials (often along with missing SMD resistors) , as it is too easy to completely burn off your PCB's fine sub-mm lines etc. So being able to provide an installable OpenWRT image in .RMT format is my goal.

(Last edited by PopOpen on 12 Apr 2011, 11:52)

Ahhhh, thurprise thurprise, it is a broadcom... with a broadcom bootloader... The braindead people struck again!

Well, in that case you definitely need to waste time with no available documentation to find out what is needed to then enforce some "minor" modification to OpenWrt to accommodate this broadcom behavior. Once again...

I have not quite understood why there seem to be so much excitement about broadcom, since so far, I have only read about problems. This sound like some unnecessary PITA problem, made by braindead people to detain other braindead people from flashing the wrong firmware.

Hmm, that is a feature I do not need. Especially if there is no EEEAAASY way to turn it off.  Now ironically at this very same time I am writing some documentation about U-Boot:
http://wiki.openwrt.org/doc/techref/bootloader/uboot and
http://wiki.openwrt.org/doc/techref/boo … oot.config

That (the software not my docu) is something you could call sane and user friendly. This CFE shice obviously is not.

JackTheVendicator wrote:

Broadcom Header
(a)Small LZMA compressed file containing info for the decompressor
(b)LZMA decompressor
LZMA compressed block -
                                    |- Kernel, raw binary format
                                (c)|- Gzip ramdisk, containing a cpio archive with symlinks to populate the ramfs root filesystem at boot time
                                    |- Cramfs + LZMA main filesystem, containing almost everything (executables, libraries, config files)
                                    |- Cramfs + LZMA module filesystem, containing all kernel modules (they strangely have .o extension)

Sorry Jack, I'm new with all this, so I'm still not clear how to get/extract the other parts. (Sure you gave me a hammer, but how do I build the house?) I must be missing something here.
(1) Where is the CFE?
(2) And when you say "Kernel" you mean the "initrd" file?
(3) How do I distinguish/find part (a, b)?
(4) How do I distinguish the parts within the LZMA block? (Magic #'s?)
(5) I don't understand (c) ???

(6) The .rmt file contains a CRC'd header, does anyone know how how it is calculated?

PopOpen wrote:
JackTheVendicator wrote:

Broadcom Header
(a)Small LZMA compressed file containing info for the decompressor
(b)LZMA decompressor
LZMA compressed block -
                                    |- Kernel, raw binary format
                                (c)|- Gzip ramdisk, containing a cpio archive with symlinks to populate the ramfs root filesystem at boot time
                                    |- Cramfs + LZMA main filesystem, containing almost everything (executables, libraries, config files)
                                    |- Cramfs + LZMA module filesystem, containing all kernel modules (they strangely have .o extension)

Sorry Jack, I'm new with all this, so I'm still not clear how to get/extract the other parts. (Sure you gave me a hammer, but how do I build the house?) I must be missing something here.
(1) Where is the CFE?
(2) And when you say "Kernel" you mean the "initrd" file?
(3) How do I distinguish/find part (a, b)?
(4) How do I distinguish the parts within the LZMA block? (Magic #'s?)
(5) I don't understand (c) ???

(6) The .rmt file contains a CRC'd header, does anyone know how how it is calculated?

(1) There is no CFE in TEO images. Anyway, on the flash it's at 0xBFC00000 and ends at 0xBFC10000
(2) I really mean the kernel executable (non-ELF vmlinux). (c) is actually the initrd
(3) (a) always starts at 0x10C in the .img and its length is defined by the value of 0x108-0x10B (it's a 32 bit big endian integer, so if it's 00 00 00 1C the size is 0x1C=28 bytes) - for some reason i can't decompress this block on A125G firmwares (maybe different lzma versions)
     (b) I don't know the exact start point, but it surely ends at 0x55F0 (big lzma block start point) in TEO images
(4) Small lzma block - 5D 00 00 40
     Big lzma block - 5D 00 00 80
(5) See (2)
(6) I don't know, sorry sad

(Last edited by JackTheVendicator on 15 Apr 2011, 09:38)

Yes, i have already extracted  the 2 cramfs (rootfs and modules) and now the gzip archive.

5D 00 00 80 ---- > 0x55F0=22000
i have extracted this lzma then i have found the gzip magic "1F 8B 08 00".

This gzip contains the cpio archive.
ASCII cpio archive (SVR4 with no CRC). "30 37 30 37".


EDIT: at ofset 100 i have found a 8086 relocatable (Microsoft) signature...kernel/bootloader
80 01 00 00

EDIT2: i have also extract the "ar" archive libwl.a, it contains wl.o and wl_linux.o, ELF obj

pop you have mail

(Last edited by tiresi@ on 15 Apr 2011, 12:55)

tiresi@ wrote:

EDIT: at ofset 100 i have found a 8086 relocatable (Microsoft) signature...kernel/bootloader
80 01 00 00

This (and the following word) are memory addresses. See http://skaya.enix.org/wiki/CfeKernel

@Jack: Sorry, I believe I didn't say thank you. Thank you! That info really helped clearing up some things.

JackTheVendicator wrote:

(3) (a) always starts at 0x10C in the .img and its length is defined by the value of 0x108-0x10B (it's a 32 bit big endian integer, so if it's 00 00 00 1C the size is 0x1C=28 bytes) - for some reason i can't decompress this block on A125G firmwares (maybe different lzma versions)

I also noticed this difference? Did you get any farther with this? Would it help if I supplied 2-3 other firmware versions?


Orca wrote:

...Now ironically at this very same time I am writing some documentation about U-Boot:
http://wiki.openwrt.org/doc/techref/bootloader/uboot and
http://wiki.openwrt.org/doc/techref/boo … oot.config
That (the software not my docu) is something you could call sane and user friendly...

Have you heard of any success stories about using U-boot on a Broadcom 63xx board?
(For example on a: Thomson Speedtouch 536iv5, Freebox V4/5, Netgear DG834GT, Linksys WAG54GS, Pirelli)

or other routers based on 6348 or 6358 SOCs include:

- 3Com 3CRWDR200A-75
- Asus AM200g / AM604 / AM604G / WL600G
- Belkin F5D7633-4B / F5D9630-1/2/3/5
- Comtrend CT536/1+ / CT638/1
- D-Link DSL2640B / DSL2740B / DSL2741B
- Davolink DV201AMR
- Dynalink RTA1046VW
- Hitachi AH4021 / AH4222
- Huawei HG520 / HG550
- Linksys WAG54GS / WAG54GX2 / WAG300N / WAG325N
- Netgear DG834G / DG834GT / DG834N / DG834PN
- T-Com Speedport 500V / W500V
- Thomson ST585 / ST780
- USRobotics USR9107 / USR9108 / USR9113 / USR9114
- Zhone 6218 / 6228 / 6238

(Last edited by PopOpen on 27 Apr 2011, 21:09)

The discussion might have continued from here.