本帖最后由 xxcat 于 2016-3-23 22:39 编辑 0 \/ M/ E$ h1 f& R7 i
6 l: R/ c+ n8 q# A
先搞定telnet登陆上去,进去shell,你可以先cat /proc/mtd,感受一下固件怎么存储的。- WAP(Dopra Linux) # cat /proc/mtd
! B4 D/ [7 o# I3 N - dev: size erasesize name& z# G: C V! I
- mtd0: 00100000 00020000 "startcode"! j- ?! `9 G2 z: H
- mtd1: 0ff00000 00020000 "ubifs"8 i9 G. b9 ^9 j4 z6 ]* O) q
- mtd2: 70000000 00020000 "reserved"- y9 B% q: M8 S- \, [
- mtd3: 0009b000 0001f000 "ubootA"
2 ~8 U3 a) n7 ^% O - mtd4: 0009b000 0001f000 "ubootB"
4 z/ A: F$ c$ X8 ^4 L+ q+ w - mtd5: 0003e000 0001f000 "flash_configA"3 A2 B$ {, l, N8 M5 ?- u) W }
- mtd6: 0003e000 0001f000 "flash_configB"* l5 X- j+ M8 U5 f. j8 K
- mtd7: 0003e000 0001f000 "slave_paramA"5 j# {+ }) ?; s& ~; ^
- mtd8: 0003e000 0001f000 "slave_paramB"7 k c3 e |: t, d% d% l
- mtd9: 00307000 0001f000 "kernelA"5 Y4 x. u& E2 P- ?+ w
- mtd10: 00307000 0001f000 "kernelB"
. M- @' l; q. I e5 L. a - mtd11: 02815000 0001f000 "rootfsA"
: E0 ^! u( e% v, e. a4 b& s0 U - mtd12: 02815000 0001f000 "rootfsB" |% x+ f0 y. i; ~5 @) o+ P- j
- mtd13: 0003e000 0001f000 "wifi_paramA"
5 T! B& {5 _" b! n- E' ]6 p - mtd14: 0003e000 0001f000 "wifi_paramB"' K6 w" q) Y+ }* F6 C1 ]
- mtd15: 0003e000 0001f000 "system_param"
1 u2 ?: I) c6 S - mtd16: 0141a000 0001f000 "file_system"
Q4 X" v* n1 I2 K! y1 t2 {& C' D) O - mtd17: 0801e000 0001f000 "app"# e# |- h6 v7 p1 ]2 V, W
复制代码 2 ^; s6 {+ ~9 O
然后cd /var,然后cat /dev/mtdblock0 > 0.bin如此内推,到cat /dev/mtdblock16 > 16.bin,你就得到了1.bin....16.bin这样一堆文件在/var目录下,然后插个U盘拷贝出去,或者开个tftp服务器传出去,然后你需要知道怎么把固件从这一堆东西里面分离出来,然后你需要知道怎么打包成固件包,挺麻烦吧?不过现在有个新的英文版固件,改改也能用的。% S3 Z# Q* X* a- _1 a% Z% L
9 y+ l/ C1 G" V* a
|