本帖最后由 xxcat 于 2016-3-23 22:39 编辑
! a5 n2 O% M" ]
& W8 {; Z9 z9 [. C. [! [$ R先搞定telnet登陆上去,进去shell,你可以先cat /proc/mtd,感受一下固件怎么存储的。- WAP(Dopra Linux) # cat /proc/mtd
$ ?$ F' l6 k& I/ p- v0 d - dev: size erasesize name
) K2 g8 w: z: R. N; S6 t3 L - mtd0: 00100000 00020000 "startcode"
" |3 U5 f) K( q P# L* E - mtd1: 0ff00000 00020000 "ubifs"! l2 D v- u/ b6 L$ D
- mtd2: 70000000 00020000 "reserved"
8 P& Y2 M3 A _% W* e6 l! t3 }7 ~ - mtd3: 0009b000 0001f000 "ubootA"
3 A5 \- }4 s* |- p7 M - mtd4: 0009b000 0001f000 "ubootB": R& B6 U9 S/ c( X
- mtd5: 0003e000 0001f000 "flash_configA"
7 d$ x m% I$ p! L+ N - mtd6: 0003e000 0001f000 "flash_configB"
# v- [3 S. l3 K% \ - mtd7: 0003e000 0001f000 "slave_paramA"9 J+ O7 s P( H
- mtd8: 0003e000 0001f000 "slave_paramB", X7 m% k6 H9 p' Y: ~, v. Y
- mtd9: 00307000 0001f000 "kernelA"
: y3 B: N# [6 G4 K - mtd10: 00307000 0001f000 "kernelB"7 P8 P. |8 d! m) K3 o
- mtd11: 02815000 0001f000 "rootfsA"
/ L8 g* ?+ i) ] - mtd12: 02815000 0001f000 "rootfsB"
1 A) s/ K& X% h* N - mtd13: 0003e000 0001f000 "wifi_paramA"0 E$ v( [: ~& g
- mtd14: 0003e000 0001f000 "wifi_paramB"" b1 x, ], o2 G1 X
- mtd15: 0003e000 0001f000 "system_param"
+ f0 b/ c, T$ p( k6 f9 ] - mtd16: 0141a000 0001f000 "file_system"
2 Y3 ?: e* N7 N1 |/ z - mtd17: 0801e000 0001f000 "app"
0 p# Z7 ~! G( `$ y3 v s0 S9 ]
复制代码 % m/ H. d* U5 q5 |; Y2 t/ c# |8 Y
然后cd /var,然后cat /dev/mtdblock0 > 0.bin如此内推,到cat /dev/mtdblock16 > 16.bin,你就得到了1.bin....16.bin这样一堆文件在/var目录下,然后插个U盘拷贝出去,或者开个tftp服务器传出去,然后你需要知道怎么把固件从这一堆东西里面分离出来,然后你需要知道怎么打包成固件包,挺麻烦吧?不过现在有个新的英文版固件,改改也能用的。2 o2 T$ @. C3 p
- H0 G# E I8 [; ^3 ~ |