Need help dump flash from serial (BCM3348)

[joejoefta]

Is it possible to dump flash with serial com? Got 'p' and the following output:


BCM3348A1
1346890
MemSize: ......................... 8M
Flash detected @0xbe000000

Signature: b004


Broadcom BootLoader Version: 2.1.5a Gnu
Build Date: May 28 2003
Build Time: 13:34:58

Image 1 Program Header:
Signature: b004
Control: 0005
Major Rev: 0002
Minor Rev: 0000
Build Time: 2003/10/17 05:37:40 Z
File Length: 741579 bytes
Load Address: 80010000
Filename: befcmu10v3-v11202.bin
HCS: e0ff
CRC: 739352b2


HCS failed on Image 2 Program Header


Enter '1', '2', or 'p' within 2 seconds or take default...
.


Board IP Address [0.0.0.0]: 192.168.100.1

Board IP Mask [255.255.255.0]:

Board IP Gateway [0.0.0.0]:

Board MAC Address [00:10:18:ff:ff:ff]:

Internal/External phy? (i/e)[i]


Init EMAC, DMA, and MII PHY...
Autonegotiation started, waiting for completion...ERROR: Autonegotiation timeout
...
MAC setup for HalfDuplex


Main Menu:
==========
d) Download and save to flash
g) Download and run from RAM
c) Store icePROM bootloader to flash
b) Boot from flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
r) Read memory
w) Write memory

[drewmerc]

get an old pre 1.1 version of haxorware (like the attached)
follow the flash with diag cable but instead of pressing d to download you want to press g so it runs from ram
and then use haxorware to backup the flash

[joejoefta]

when I press 'g' is asking for board TFTP server ip address. don't know with it is.

[drewmerc]

have you read the diag instructions?

Flash with diag cable (requires noisy bootloader)
Set the computers ip to 192.168.100.10
Set up a TFTP server with HAXORWARE.BIN in its root
Connect to modem with hyperterminal or putty (with changed CR/LF to LF)
While modem is turning on press p (you should get a prompt)
Set the Modem IP to 192.168.100.1
Everything else just press enter
When you get at the menu press d
Enter 192.168.100.10 as TFTP IP
Enter HAXORWARE.BIN as filename
It should download
When asked what image to save to, answer 1
Answer n to the save parameters prompt
press b once its done to boot the modem

[joejoefta]

loaded haxorware to ram but during bootup it's hangs. Here is the output:


Board TFTP Server IP Address [0.0.0.0]: 192.168.100.10

Enter TFTP filename []: haxorware.binng octet mode

................................................................................

................................................................................

................................................................................

................................................................................

................................................................................

................................................................................

.......................

Tftp complete

Received 1031537 bytes

Image 0 Program Header:

Signature: 3349

Control: 0005

Major Rev: 0001

Minor Rev: 0000

Build Time: 2008/10/25 03:35:15 Z

File Length: 1031445 bytes

Load Address: 80010000

Filename: ecram_sto.bin

HCS: ff70

CRC: 837a3b73



WARNING: Signatures do not match! Don't use this image!



Store parameters to flash ? [n] mage 3...

Detected LZMA compressed image... decompressing...

Target Address: 0x80010000

....................

Decompressed length: 5243618



Executing Image 3...





eCos - hal_diag_init

Init device '/dev/ttydiag'

Init tty channel: 80401b10

Init device '/dev/tty0'

Init tty channel: 80401b30

Init device '/dev/haldiag'

HAL/diag SERIAL init

Init device '/dev/ser0'

BCM 33XX SERIAL init - dev: fffe0300.2

Set output buffer - buf: 804364d0 len: 2048

Set input buffer - buf: 80436cd0 len: 2048

BCM 33XX SERIAL config

0x00000014 [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target)

Configuring/Loading Flash driver...

0x00000014 [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target)

Loading ProgramStore driver...

0x0000001e [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target)

Loading BootloaderStore driver...

0x00000028 [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target)

Loading NonVol driver...

0x00000028 [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target)

Storage drivers initialized successfully.

0x00000032 [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Tar

get) Creating singletons for ProgramStor\FD



HAPPY NEW YEAR EVERYONE

[drewmerc]

you could try an even earlier version (but i'm sure i used rc6 when i tested this) i do know it needs to be a 1.0 version tho
and you can also try softjtag (but this program has it's own set of problems)

[joejoefta]

does anyone have an earlier version of haxorware and where can I find a noisy bootloader

[drewmerc]

you already have the noisy bootloader

[Radiotubes]

Haxorware won't work on a BCM3348 based modem, will it?

[drewmerc]

ok now i feel like a dick i never even noticed that