Sources available here. The firmware version for this device is 5.5.2, though the other (V5.5.4) may also be of interest.
CPU: BCM3380GKFSBG
Ethernet: BCM53114KFBG
Flash: FL064PIF
The bootloader has been locked down, so it's impossible to use it to print out the partition table. Linux boot logs are also unavailable (because I later found out it doesn't run linux at all, only eCos. Many routers will run eCos and linux simultaneously, not this one.)
From reading the flash with an SPI prorgammer and inspecting the reults in a hex editor, I have come up with the following layout.
| Offset | Size | Description |
|---|---|---|
| 0x000000 | 0x010000 | Bootloader |
| 0x010000 | 0x010000 | perm |
| 0x020000 | 0x3E0000 | Image 1 |
| 0x400000 | 0x3E0000 | Image 2 |
| 0x7E0000 | 0x010000 | ? |
| 0x7F0000 | 0x010000 | dynnv |
The permnv and dynnv partitions are described in detail here and can be read with bcm2cfg.
Interestingly, many settings are missing from the perm config. As suggested by this article, it may simply be used to rebuild the config during a factory reset.
perm
cg3101d_flash_perm.bin
type : dyn
profile : (unknown)
checksum: bc17c165 (ok)
size : 14320 (ok)
failed to parse group bfc
failed to parse group userif
failed to parse group bcmwifi
failed to parse group cmlog
failed to parse group rstl
failed to parse group dhcp
failed to parse group firewall
failed to parse group guestwifi
{
bfc = {
}
userif = {
}
halif = {
}
bcmwifi = {
}
grp_802s = {
}
grp_fact = {
}
grp_prnt = {
}
bpi = {
code_access_start = 00:8C:30:81:89:02:81:81:00:D2:B6:12
cvc_access_start = 82:4B:A7:E5:6B:8B:6B:7E:B4:95:C5:B4
}
grp_bpih = {
}
grp_d0c20100 = {
}
grp_d0c20300 = {
}
cmlog = {
}
grp_snmp = {
}
grp_dnst = {
}
grp_dns1 = {
}
grp_upst = {
}
grp_ups1 = {
}
grp_ups2 = {
}
grp_ups3 = {
}
grp_ppan = {
}
rstl = {
}
grp_ntgr = {
}
grp_psv = {
}
grp_cap = {
}
dhcp = {
}
grp_csp = {
}
rg = {
router_mode = yes
}
grp_cmp = {
}
grp_chev = {
}
grp_cqp2 = {
}
firewall = {
}
grp_vpng = {
}
grp_ppps = {
}
guestwifi = {
}
}
dyn
failed to parse group firewall
cg3101d_flash_dyn.bin
type : dyn
profile : (unknown)
checksum: 0678f5fc (bad)
size : 55374 (ok)
Won't post all contents here, but all groups aside from firewall are filled.
OEM
P
BCM338031 TP0
1
Sync:1
346890
MemSize: 64 M
BootLoader Version: 2.3.0beta7 Pre-release Gnu pcminit spiboot reduced DDR drive
Build Date: Jul 2 2010
Build Time: 14:01:07
SPI flash ID 0x010216, size 8MB, block size 64KB, write buffer 256, busy bit 1
Signature/PID: a0e7
Reset BCM53115 - Low GPIO-16 5ms
Image 1 Program Header:
Signature: a0e7
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2014/9/22 08:40:42 Z
File Length: 3322126 bytes
Load Address: 80004000
Filename: CG3101D-2VGUKS_V2.39.02u.bin
HCS: 71d0
CRC: 0fcc3057
Found image 1 at offset 20000
.
Performing CRC on Image 1...
CRC time = 52507655
Detected LZMA compressed image... decompressing...
Target Address: 0x80004000
decompressSpace is 0x4000000
Elapsed time 991624930
Decompressed length: 16049828
Executing Image 1...
eCos - hal_diag_init
Init device '/dev/BrcmTelnetIoDriver'
Init device '/dev/ttydiag'
Init tty channel: 80f52138
Init device '/dev/tty0'
Init tty channel: 80f52158
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: 0.2
Set output buffer - buf: 0x81112770 len: 4096
Set input buffer - buf: 0x81113770 len: 4096
BCM 33XX SERIAL config
LsSpiInit 3380
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver...
detecting flash3...
[00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0x10216
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Permanent NonVol would fit in the boot block of this flash device, but I found existing NonVol in the following block; using this location instead...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver...
ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully.
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
Detecting the next image number that we will store to by default...
Bootloader indicates we are running image 1
By default, we will dload to image number 2!
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully.
[Virgin] Init US V1 Table 0
[Virgin] Init US V1 Table 1
[Virgin] Init US V1 Table 2
[Virgin] Init US V1 Table 3
BcmCapNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
Reading Permanent settings from non-vol...
[Thermal Debug] GPIO 33 = 2
[CG3101D] Power Down Enable On Port 1 to Port 4.
Checksum for permanent settings: 0x8ee49e38
Settings were read and verified.
Reading Dynamic settings from non-vol...
Checksum for dynamic settings: 0x36470c3f
we found one in the table already!!!!
Settings were read and verified.
OEM (second device)
BCM338031 TP0
1
Sync:1
346890
MemSize: 64 M
BootLoader Version: 2.3.0beta7 Pre-release Gnu pcminit spiboot reduced DDR drive
Build Date: Jul 2 2010
Build Time: 14:01:07
SPI flash ID 0x010216, size 8MB, block size 64KB, write buffer 256, busy bit 1
Signature/PID: a0e7
Reset BCM53115 - Low GPIO-16 5ms
Image 1 Program Header:
Signature: a0e7
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2014/9/22 08:40:42 Z
File Length: 3322126 bytes
Load Address: 80004000
Filename: CG3101D-2VGUKS_V2.39.02u.bin
HCS: 71d0
CRC: 0fcc3057
Found image 1 at offset 20000
Image 2 Program Header:
Signature: a0e7
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2014/9/22 08:40:42 Z
File Length: 3322126 bytes
Load Address: 80004000
Filename: CG3101D-2VGUKS_V2.39.02u.bin
HCS: 71d0
CRC: 0fcc3057
Found image 2 at offset 400000
.
Performing CRC on Image 2...
CRC time = 52507740
Detected LZMA compressed image... decompressing...
Target Address: 0x80004000
decompressSpace is 0x4000000
Elapsed time 992936926
Decompressed length: 16049828
Executing Image 2...
eCos - hal_diag_init
Init device '/dev/BrcmTelnetIoDriver'
Init device '/dev/ttydiag'
Init tty channel: 80f52138
Init device '/dev/tty0'
Init tty channel: 80f52158
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: 0.2
Set output buffer - buf: 0x81112770 len: 4096
Set input buffer - buf: 0x81113770 len: 4096
BCM 33XX SERIAL config
LsSpiInit 3380
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver...
detecting flash3...
[00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0x10216
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Permanent NonVol would fit in the boot block of this flash device, but I found existing NonVol in the following block; using this location instead...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver...
ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully.
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
Detecting the next image number that we will store to by default...
Bootloader indicates we are running image 2
By default, we will dload to image number 1!
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully.
[Virgin] Init US V1 Table 0
[Virgin] Init US V1 Table 1
[Virgin] Init US V1 Table 2
[Virgin] Init US V1 Table 3
BcmCapNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
Reading Permanent settings from non-vol...
[Thermal Debug] GPIO 33 = 2
[CG3101D] Power Down Enable On Port 1 to Port 4.
Checksum for permanent settings: 0xbc17c165
[00:00:00 01/01/1970] [tStartup] BcmeRouterNonVolSettings::IsDefault: (eRouter NonVol Settings) Permanent settings are default!
*
*
* One or more of the settings groups was missing, possibly as a result of a code upgrade.
*
*
*
*
* One or more of the settings groups was upgraded.
*
*
Settings were read and verified.
Reading Dynamic settings from non-vol...
Checksum for dynamic settings: 0xe221d035
we found one in the table already!!!!
Settings were read and verified.
By connecting a pulse switch between flash HOLD and GND, then toggling it at various intervals in the boot sequence, you may be able to reach a prompt. Similar trick works with the EPC3208. Sadly, I was not able to access a prompt.
Attempt 1
P
BCM338031 TP0
1
Sync:1
346890
MemSize: 64 M
BootLoader Version: 2.3.0beta7 Pre-release Gnu pcminit spiboot reduced DDR drive
Build Date: Jul 2 2010
Build Time: 14:01:07
SPI flash ID 0x010216, size 8MB, block size 64KB, write buffer 256, busy bit 1
Signature/PID: a0e7
Reset BCM53115 - Low GPIO-16 5ms
Image 1 Program Header:
Signature: a0e7
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2014/9/22 08:40:42 Z
File Length: 3322126 bytes
Load Address: 80004000
Filename: CG3101D-2VGUKS_V2.39.02u.bin
HCS: 71d0
CRC: 0fcc3057
Found image 1 at offset 20000
.
Performing CRC on Image 1...
CRC time = 52507671
Detected LZMA compressed image... decompressing...
Target Address: 0x80004000
decompressSpace is 0x4000000
Elapsed time 991623955
Decompressed length: 16049828
Executing Image 1...
eCos - hal_diag_init
Init device '/dev/BrcmTelnetIoDriver'
Init device '/dev/ttydiag'
Init tty channel: 80f52138
Init device '/dev/tty0'
Init tty channel: 80f52158
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: 0.2
Set output buffer - buf: 0x81112770 len: 4096
Set input buffer - buf: 0x81113770 len: 4096
BCM 33XX SERIAL config
LsSpiInit 3380
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver...
detecting flash3...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::FlashDriverInit: (Flash Driver C API) WARNING - Fai
******************** CRASH ********************
Exception code/type: 2 / TLB (load/fetch) TP0
r0/zero=00000000 r1/at =fffffffe r2/v0 =00000000 r3/v1 =00000000
r4/a0 =00000004 r5/a1 =811153c8 r6/a2 =00000000 r7/a3 =811a4560
r8/t0 =810d1078 r9/t1 =00000000 r10/t2 =00000000 r11/t3 =c8000000
r12/t4 =00000407 r13/t5 =00000000 r14/t6 =06000000 r15/t7 =00000000
r16/s0 =803a0000 r17/s1 =11110011 r18/s2 =83fab180 r19/s3 =11110013
r20/s4 =11110014 r21/s5 =11110015 r22/s6 =11110016 r23/s7 =11110017
r24/t8 =00000000 r25/t9 =00000003 r26/k0 =83fab180 r27/k1 =11110013
r28/gp =80f5a3b0 r29/sp =810d1170 r30/fp =810d12b0 r31/ra =800a10d8
PC : 0x800a11c8 error addr: 0x00000004
cause: 0x00000008 status: 0x1000ff03
BCM interrupt enable: 00000007, status: 00000000
Instruction at PC: 0x8c440004
iCache Instruction at PC: 0x3402ffff
entry 800a0ea0 called from 8009ea10
entry 8009e9b8 called from 80616688
entry 80616670 called from 80946d88
entry 80946d50 called from 80946d48
entry 80946d50 Return address (00000000) invalid or not found. Trace stops.
Current thread = 810da2e8
Current time is 01/01/1970 00:00:00
Current free space on the heap is 48066736
led to detect flash device 0 using SPI!
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::FlashDriverInit: (Flash Driver C API) ERROR - Failed to retrieve the memory window associated with flash device 0/CS0!
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) ERROR - Failed to initialize the Flash driver!
[00:00:00 01/01/1970] [tStartup] BcmEpsCmDocsisSystem::Initialize: (BFC System) ERROR - Failed to init low level storage drivers!
[00:00:00 01/01/1970] [tStartup] BcmEpsCmDocsisSystem::Start: (BFC System) ERROR - Failed to initialize the system.
+-----------------------------------------------------------------------+
| Portions of this product contain open source software and are subject |
| to terms of the applicable license as specified in the release notes. |
+-----------------------------------------------------------------------+
*
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* *
* * * *
* * * * * * ***
* * * * * * * * *******************
* * * * * *
* *
Broadcom Corporation Reference Design
+----------------------------------------------------------------------------+
| Build Date: Sep 22 2014 |
| Build Time: 16:40:34 (+0800) |
| Built By: cynthia |
+----------------------------------------------------------------------------+
BcmBfcAppNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
Here is another attempt. From what I could tell, the device continued to boot normally after I stopped, although without any more serial logs.
Pulse attempt 2
P
BCM338031 TP0
1
Sync:1
346890
MemSize: 64 M
BootLoader Version: 2.3.0beta7 Pre-release Gnu pcminit spiboot reduced DDR drive
Build Date: Jul 2 2010
Build Time: 14:01:07
SPI flash ID 0x010216, size 8MB, block size 64KB, write buffer 256, busy bit 1
Signature/PID: a0e7
Reset BCM53115 - Low GPIO-16 5ms
Image 1 Program Header:
Signature: a0e7
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2014/9/22 08:40:42 Z
File Length: 3322126 bytes
Load Address: 80004000
Filename: CG3101D-2VGUKS_V2.39.02u.bin
HCS: 71d0
CRC: 0fcc3057
Found image 1 at offset 20000
.
Performing CRC on Image 1...
Image 1 CRC failed!
Unable to load selected image.
.
Performing CRC on Image 1...
CRC time = 52494132
Detected LZMA compressed image... decompressing...
Target Address: 0x80004000
decompressSpace is 0x4000000
Elapsed time 991625048
Decompressed length: 16049828
Executing Image 1...
eCos - hal_diag_init
Init device '/dev/BrcmTelnetIoDriver'
Init device '/dev/ttydiag'
Init tty channel: 80f52138
Init device '/dev/tty0'
Init tty channel: 80f52158
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: 0.2
Set output buffer - buf: 0x81112770 len: 4096
Set input buffer - buf: 0x81113770 len: 4096
BCM 33XX SERIAL config
LsSpiInit 3380
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver...
detecting flash3...
[00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0x10216
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Permanent NonVol would fit in the boot block of this flash device, but I found existing NonVol in the following block; using this location instead...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver...
ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully.
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
Detecting the next image number that we will store to by default...
Bootloader indicates we are running image 1
By default, we will dload to image number 2!
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully.
[Virgin] Init US V1 Table 0
[Virgin] Init US V1 Table 1
[Virgin] Init US V1 Table 2
[Virgin] Init US V1 Table 3
BcmCapNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
Reading Permanent settings from non-vol...
[Thermal Debug] GPIO 33 = 2
[CG3101D] Power Down Enable On Port 1 to Port 4.
NonVolDeviceDriver::ReadTrueSegmentSizeBytes: WARNING - Segment Size in segment control word not valid; returning 0!
NonVolDeviceDriver::NonVolDriverRead: ERROR - Failed to query the segment size (returned 0 bytes)! There is no valid data to read.
[00:00:00 01/01/1970] [tStartup] BcmNonVolDeviceDriverBridge::ReadImpl: (NonVol Device) ERROR - Failed to read the length from the settings data!
[00:00:00 01/01/1970] [tStartup] BcmNonVolDeviceDriverBridge::Read: (NonVol Device) ERROR - Failed to read the buffer from the device! Resetting the entire section to defaults.
[00:00:00 01/01/1970] [tStartup] BcmHalIfNonVolSettings::ResetDefaults: (HalIf NonVol Settings) WARNING - Resetting Permanent Settings to defaults! MAC addresses and other settings are now invalid!
[00:00:00 01/01/1970] [tStartup] BcmCmBpiNonVolSettings::ResetDefaults: (CM BPI NonVol Settings) WARNING - Permanent settings (BPI Keys and other unique values) are being reset to their default values!
[00:00:00 01/01/1970] [tStartup] BcmCmHybridBpiNonVolSettings::ResetDefaults: (CM HYBRID BPI NonVol Settings) WARNING - Permanent settings (BPI Keys and other unique values) are being reset to their default values!
[00:00:00 01/01/1970] [tStartup] CmSnmpNonVolSettings::ResetDefaults: (CM SNMP NonVol Settings) WARNING - Resetting all Permanent Settings! The serial number and other Sys Info items are probably invalid!
[00:00:00 01/01/1970] [tStartup] BcmCmpNonVolSettings::ResetDefaults: (Cmp NonVol Settings) WARNING - Resetting all Permanent Settings! The serial number and other Sys Info items are probably invalid!
*
*
* Failed to read non-vol settings from the device!
*
*
Reading Dynamic settings from non-vol...
Checksum for dynamic settings: 0x36470c3f
we found one in the table already!!!!
Settings were read and verified.
[00:00:00 01/01/1970] [tStartup] BcmEpsCmDocsisSystem::Initialize: (BFC System) ERROR - Disable console port now!
This appears to have killed my first device. Subsequent boot attempts have no serial output. Also, LEDs flash for ~1s then only LED402 and LED404 (red) remain lit.
Pulse attempt 3
P
BCM338031 000�000�080��2082 8���0C��F�2� 0 1 0
0
00 0 0000000800810C 1CB FBCF0C���0� ~0? �Hx�0�0
00 0�����8C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C08F000 F10
00 0
00 00�000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 00000&�00018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 ���F?CB0F0C00F000 F10
00 0
00 00000f�0001�C0 1BC4�CA0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 00000800018C0 1BCF CB0F0C�F000 �10���00�0�
0�~�̘00080001��0 1BC� ���F0C00F�00 F10
00 0
00 0000008000�80 1�CF CB0F�C00F000 F10
�00 �H�00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1����FC00~00��1&�
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F��0 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C 1~�F�C�F0C�F0�0 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C01C0 00B0F8C002080 FB0 FC0 0
000F0 0 0000000800810C2 8 BFBCF0C0000F02F0 0 1��0
00 0옘�00008010C1 C��FBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C1 C BFBCF0C0000F00F 0 0 1
0
00 0 0000000800810C2 8 BFBCF0C0000F00F 0 1 0
0
00 0 0000000800810C 1CB FBCF0C0000F00 F01
0 0
00 0 0000000800810C 1CB FBCF0C0000F00 F01
0 0
00 0 0000000800810C 1CB FBCF0C0000F00 F01
0 0
00 0 0000000800810C 1CB FBCF0C0000F00 F01
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 000000800018C0 1BCF CB0F0C00F000 F10
00 0
00 00000080001n�0 1BCF CB0F0C00F000 F10
The bootloader is a modified CFE. At first I presumed the bootloader to be CFE, but after looking into it, it seems quite similar to Broadcom's aeolus bootloader (used to boot the zephyr).. It may have been the closed source forerunner to aeolus, I am not sure. Also, the same bootloader appears to be used on other netgear CG3xxx devices. *
While it is possible to select an image to boot, there is no prompt to do so, and the other usual option p does not work. (Note to self: try s, hell even try randomly pressing every key possible). In addition to this, I have been unable to access a CM> prompt, even after modifying and fashing the dyn settings. Note that the dyn settings were read correctly and the device continued to boot (seemingly) normally.
* Others have had success simply switching the bootloader to one from another device. See this. Maybe I could try this approach. If possible, I would be able to do more debugging with options such as reading memory (and taking a RAM dump). Might help decompilation, rather than working only off ROM.
The compressed images can be found at offsets 0x020000 and 0x400000. A simple way to extract them would be to use flashrom and the attached layout file. Or, dump the entire contents of the rom and copy the relevant sections using some dd trickery. Both images can be decompressed using this tool by Broadcom.
On device #2 both images were identical. I have not yet even bothered making a dump of the dead device's flash.
Going back to what I said earlier, this device does not run linux. However, similar devices by netgear (CG3100*) may. The netgear sources list an alternative firmware version V5.5.4, which includes linux sources, hence why I said they may be of interest. In theory, the hardware is identical, so the sources could help porting linux to the CG3101D.
I tried compiling the firmware for the CG3100 (from netgear's website). Take note of the two files commented in the Makefile:
#ProgramStore2 -f vmlinux.bin -f2 rootfs.img -o $(FS_KERNEL_IMAGE_NAME) -v 002.17h -a 0x84010000 -n2 -p 65536 -c 4 -s 0x$(BRCM_CHIP);\
#ProgramStore2 -f vmlinux.bin -f2 rootfs.img -o $(FS_KERNEL_IMAGE_NAME).mr0 -v 002.17h -a 0x80010000 -n2 -p 65536 -c 4 -s 0x$(BRCM_CHIP)
Compiled successfully, however I ran into trouble with ProgramStore. I was using this version which did not support a n2 flag, so no idea what that's about. I tried without, seemed to work. Note in the next logs, I did not bother with signature or version, hence the weird numbers.
After having compressed the image using ProgramStore, I padded them correctly so I could rewrite the flash with flashrom. Note: I did not mess witht the bootloader or any other partitions, only image1. Boot attempt:
P
BCM338031 TP0
1
Sync:1
346890
MemSize: 64 M
BootLoader Version: 2.3.0beta7 Pre-release Gnu pcminit spiboot reduced DDR drive
Build Date: Jul 2 2010
Build Time: 14:01:07
SPI flash ID 0x010216, size 8MB, block size 64KB, write buffer 256, busy bit 1
Signature/PID: a0e7
Reset BCM53115 - Low GPIO-16 5ms
WARNING: Signatures do not match! This may be a bad image!
Image sig = 3350, chip sig = a0e7
Image 1 Program Header:
Signature: 3350
Control: 0105
Major Rev: 0000
Minor Rev: 0000
Build Time: 2021/8/11 16:45:19 Z
File Length: 1543888 bytes
Load Address: 84010000
Filename: programstoreout.bin
HCS: 59fa
CRC: 77e09e0a
WARNING: Signatures do not match! This may be a bad image!
Image sig = 3350, chip sig = a0e7
Found image 1 at offset 20000
Image 2 Program Header:
Signature: a0e7
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2014/9/22 08:40:42 Z
File Length: 3322126 bytes
Load Address: 80004000
Filename: CG3101D-2VGUKS_V2.39.02u.bin
HCS: 71d0
CRC: 0fcc3057
Found image 2 at offset 400000
.
Performing CRC on Image 1...
CRC time = 24409222
Detected dual image header. Decompressing first image...
Detected LZMA compressed image... decompressing...
Target Address: 0x84010000
decompressSpace is 0x4000000
Elapsed time 429545173
Decompression failed... 1
Unable to load selected image.
Performing CRC on Image 1...
Image 1 CRC failed!
Unable to load selected image.
Performing CRC on Image 1...
Image 1 CRC failed!
Unable to load selected image.
Performing CRC on Image 1...
Image 1 CRC failed!
Unable to load selected image.
Performing CRC on Image 1...
Image 1 CRC failed!
Unable to load selected image.
Performing CRC on Image 1...
Image 1 CRC failed!
Unable to load selected image.
Failed to load an image! Rebooting...
After some more fucking about trying to purposely crash the thing (otherwise it would just continue and boot the second still original image left in flash), I accidentally discovered this:
P
BCM338031 TP0
1
Sync:1
346890
MemSize: 64 M
BootLoader Version: 2.3.0beta7 Pre-release Gnu pcminit spiboot reduced DDR drive
Build Date: Jul 2 2010
Build Time: 14:01:07
SPI flash ID 0x010216, size 8MB, block size 64KB, write buffer 256, busy bit 1
Signature/PID: a0e7
Reset BCM53115 - Low GPIO-16 5ms
Image 1 Program Header:
Signature: a0e7
Control: 0105
Major Rev: 0003
Minor Rev: 0000
Build Time: 2021/8/11 17:40:36 Z
File Length: 1543888 bytes
Load Address: 80010000
Filename: programstoreout.bin
HCS: ba11
CRC: 77e09e0a
Found image 1 at offset 20000
Image 2 Program Header:
Signature: a0e7
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2014/9/22 08:40:42 Z
File Length: 3322126 bytes
Load Address: 80004000
Filename: CG3101D-2VGUKS_V2.39.02u.bin
HCS: 71d0
CRC: 0fcc3057
Found image 2 at offset 400000
.
Performing CRC on Image 1...
CRC time = 24409267
Detected dual image header. Decompressing first image...
Detected LZMA compressed image... decompressing...
Target Address: 0x80010000
decompressSpace is 0x4000000
Elapsed time 429543413
Decompression failed... 1
Unable to load selected image.
Performing CRC on Image 1...
Image 1 CRC failed!
Unable to load selected image.
Board IP Address [0.0.0.0]: hjhgjhgjghjghjghjhgjfhgfhjghjjhgj
Board IP Mask [255.255.255.0]:
Board IP Gateway [0.0.0.0]:
Board MAC Address [00:10:18:ff:ff:ff]:
Internal/External phy? (e/i)[i]
Waiting for link up...
Main Menu:
==========
b) Boot from flash
g) Download and run from RAM
d) Download and save to flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
r) Read memory
w) Write memory
j) Jump to arbitrary address
z) Reset
Link up: 1G full
Mode Configuration Bits
=======================
0x8000 Boot
0x4000 Load-N-Go
0x0004 Boot image 1
0x0002 Verify image CRC
0x0001 Prompt
Phy Selection
-------------
0x0000 Default PHY
0x0100 Internal EPHY
0x0200 External EPHY
Enter hex value of desired features
MODE=8003: Enter new value:
Main Menu:
==========
b) Boot from flash
g) Download and run from RAM
d) Download and save to flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
r) Read memory
w) Write memory
j) Jump to arbitrary address
z) Reset
Mode Configuration Bits
=======================
0x8000 Boot
0x4000 Load-N-Go
0x0004 Boot image 1
0x0002 Verify image CRC
0x0001 Prompt
Phy Selection
-------------
0x0000 Default PHY
0x0100 Internal EPHY
0x0200 External EPHY
Enter hex value of desired features
MODE=8003: Enter new value: 8001
Updating MODE: 8001
Main Menu:
==========
b) Boot from flash
g) Download and run from RAM
d) Download and save to flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
r) Read memory
w) Write memory
j) Jump to arbitrary address
z) Reset
Saving permanent non-vol...
Erasing sector at 00000000...
As it turns out pressing or holding 'g' during boot enters this menu. Next, I tried to bypass CRC and see if it would decompress and run my image.
P
BCM338031 TP0
1
Sync:1
346890
MemSize: 64 M
BootLoader Version: 2.3.0beta7 Pre-release Gnu pcminit spiboot reduced DDR drive
Build Date: Jul 2 2010
Build Time: 14:01:07
SPI flash ID 0x010216, size 8MB, block size 64KB, write buffer 256, busy bit 1
Signature/PID: a0e7
Reset BCM53115 - Low GPIO-16 5ms
Image 1 Program Header:
Signature: a0e7
Control: 0105
Major Rev: 0003
Minor Rev: 0000
Build Time: 2021/8/11 17:40:36 Z
File Length: 1543888 bytes
Load Address: 80010000
Filename: programstoreout.bin
HCS: ba11
CRC: 77e09e0a
Found image 1 at offset 20000
Image 2 Program Header:
Signature: a0e7
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2014/9/22 08:40:42 Z
File Length: 3322126 bytes
Load Address: 80004000
Filename: CG3101D-2VGUKS_V2.39.02u.bin
HCS: 71d0
CRC: 0fcc3057
Found image 2 at offset 400000
Board IP Address [0.0.0.0]: ggggggggggggggggggggg
Board IP Mask [255.255.255.0]:
Board IP Gateway [0.0.0.0]:
Board MAC Address [00:10:18:ff:ff:ff]:
Internal/External phy? (e/i)[i]
Waiting for link up...
Main Menu:
==========
b) Boot from flash
g) Download and run from RAM
d) Download and save to flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
r) Read memory
w) Write memory
j) Jump to arbitrary address
z) Reset
Mode Configuration Bits
=======================
0x8000 Boot
0x4000 Load-N-Go
0x0004 Boot image 1
0x0002 Verify image CRC
0x0001 Prompt
Phy Selection
-------------
0x0000 Default PHY
0x0100 Internal EPHY
0x0200 External EPHY
Enter hex value of desired features
MODE=8003: Enter new value: 8005
Updating MODE: 8005
Main Menu:
==========
b) Boot from flash
g) Download and run from RAM
d) Download and save to flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
r) Read memory
w) Write memory
j) Jump to arbitrary address
z) Reset
Link up: 1G full
Image 1 Program Header:
Signature: a0e7
Control: 0105
Major Rev: 0003
Minor Rev: 0000
Build Time: 2021/8/11 17:40:36 Z
File Length: 1543888 bytes
Load Address: 80010000
Filename: programstoreout.bin
HCS: ba11
CRC: 77e09e0a
Found image 1 at offset 20000
Image 2 Program Header:
Signature: a0e7
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2014/9/22 08:40:42 Z
File Length: 3322126 bytes
Load Address: 80004000
Filename: CG3101D-2VGUKS_V2.39.02u.bin
HCS: 71d0
CRC: 0fcc3057
Found image 2 at offset 400000
.
Bypassing CRC Verifiction on Image 1...
CRC time = 133
Detected dual image header. Decompressing first image...
Detected LZMA compressed image... decompressing...
Target Address: 0x80010000
decompressSpace is 0x4000000
Elapsed time 429576371
Decompression failed... 1
Bypassing CRC Verifiction on Image 2...
CRC time = 115
Detected dual image header. Decompressing first image...
Loading non-compressed image 2...
Target Address: 0xFFFFFFFF
Length: -1
******************** CRASH ********************
EXCEPTION TYPE: 3/TLB (store)
TP0
r00/00 = 00000000 r01/at = 83f8b920 r02/v0 = 83f90000 r03/v1 = ffffffff
r04/a0 = a2f0005c r05/a1 = 00000000 r06/a2 = 00000001 r07/a3 = 00000002
r08/t0 = ffffffff r09/t1 = 00000008 r10/t2 = ffffffff r11/t3 = 5d000010
r12/t4 = 00000004 r13/t5 = 000000a8 r14/t6 = 00000000 r15/t7 = 00000000
r16/s0 = 83f852dc r17/s1 = ac620000 r18/s2 = 0000002b r19/s3 = 00000003
r20/s4 = 00000002 r21/s5 = 00000000 r22/s6 = 83fffe38 r23/s7 = 000062e4
r24/t8 = 00000002 r25/t9 = 00001021 r26/k0 = 46460a0d r27/k1 = 00322e2e
r28/gp = 9fc00d8c r29/sp = 83fffe30 r30/fp = 0000014d r31/ra = 83f852c4
pc : 0x83f852dc sr : 0x00000002
cause: 0x0000800c addr: 0xffffffff
It still failed to decompress the image and when it falls back onto image 2, it crashes. Do note because the mode setting wasn't saved, rebooting the device allows it to boot image 2 (the stock image) just fine again.