查看小米路由vmlinuz.trx格式解析的源代码

== 应用 ==

小米路由R1D内的flash分区：

<source lang=bash>
root@XiaoQiang:/userdisk/mtd# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00010000 "boot"
mtd1: 00300000 00010000 "os"
mtd2: 00300000 00010000 "os1"
mtd3: 00890000 00010000 "squashfs"
mtd4: 00010000 00010000 "crash"
mtd5: 00100000 00010000 "overlay"
mtd6: 00010000 00010000 "board_data"
mtd7: 00010000 00010000 "nvram"
mtd8: 00fe0000 00010000 "firmware"
</source>

mtd0 为 CFE 所在

mtd1 和 mtd2 为内核所在，即 vmlinuz.trx 刷写的位置，系统自带的刷机脚本 /bin/flash.sh：

<source lang=bash>
 24 upker() {
 25         if [ -f vmlinuz.trx ]; then
 26                 if [ "$part" = "1" ]; then
 27                         if [ -e /dev/mtd1 ]; then
 28                                 klogger -n "Burning Linux Kernel 1st Image..."
 29                                 mtd write vmlinuz.trx os >& /dev/null
 30                                 if [ $? -eq 0 ]; then
 31                                         klogger "Done"
 32                                 else
 33                                         klogger "Error"
 34                                         exit 1
 35                                 fi
 36                         fi
 37                 else
 38                         if [ -e /dev/mtd2 ]; then
 39                                 klogger -n "Burning Linux Kernel 2nd Image..."
 40                                 mtd write vmlinuz.trx os1 >& /dev/null
 41                                 if [ $? -eq 0 ]; then
 42                                         klogger "Done"
 43                                 else
 44                                         klogger "Error"
 45                                         exit 1
 46                                 fi
 47                         fi
 48                 fi
 49         fi
 50 }
</source>


路由现在刷的 0.4.58 的固件，直接从 mtd1 和 mtd2 提取内核：

<source lang=bash>
root@XiaoQiang:/userdisk/mtd# cat /dev/mtd0 > mtd0.boot
root@XiaoQiang:/userdisk/mtd# cat /dev/mtd1 > mtd1.os
root@XiaoQiang:/userdisk/mtd# cat /dev/mtd2 > mtd2.os1
root@XiaoQiang:/userdisk/mtd# cat /dev/mtd3 > mtd3.squashfs
root@XiaoQiang:/userdisk/mtd# cat /dev/mtd8 > mtd8.fw

root@XiaoQiang:/userdisk/mtd# ls -l                                                                   
-rw-r--r--    1 root     root        262144 Nov 27 22:07 mtd0.boot                                    
-rw-r--r--    1 root     root       3145728 Nov 27 22:07 mtd1.os                                      
-rw-r--r--    1 root     root       3145728 Nov 27 22:07 mtd2.os1                                     
-rw-r--r--    1 root     root       8978432 Nov 27 22:08 mtd3.squashfs                                
-rw-r--r--    1 root     root      16646144 Nov 27 22:09 mtd8.fw

root@XiaoQiang:/userdisk/mtd# echo $((0xfe0000))
16646144
root@XiaoQiang:/userdisk/mtd# echo $((0x300000))
3145728

root@XiaoQiang:/userdisk/mtd# dd if=mtd1.os of=vmlinuz.trx1 bs=1 count=$((0x002a
f000))
2813952+0 records in
2813952+0 records out
2813952 bytes (2.7MB) copied, 23.000804 seconds, 119.5KB/s
root@XiaoQiang:/userdisk/mtd# dd if=mtd2.os1 of=vmlinuz.trx2 bs=1 count=$((0x002
b4000))
2834432+0 records in
2834432+0 records out
2834432 bytes (2.7MB) copied, 23.511877 seconds, 117.7KB/s

root@XiaoQiang:/userdisk/mtd# md5sum vmlinuz.trx2
2b0d8f7e05b1f5b170a2fd1ff7af5608  vmlinuz.trx2

root@XiaoQiang:/userdisk/mtd# cd ../rom/0.4.58/
root@XiaoQiang:/userdisk/rom/0.4.58# mkxqimage -x ../brcm4709_all_1635f_0.4.58.bin
root@XiaoQiang:/userdisk/rom/0.4.58# ls -l
-rw-r--r--    1 root     root      34941768 Nov 27 22:43 root.ext4.lzma
-rw-r--r--    1 root     root       7962624 Nov 27 22:43 root.squashfs
-rw-r--r--    1 root     root       2834432 Nov 27 22:43 vmlinuz.trx
root@XiaoQiang:/userdisk/rom/0.4.58# md5sum  vmlinuz.trx 
2b0d8f7e05b1f5b170a2fd1ff7af5608  vmlinuz.trx

root@XiaoQiang:/userdisk/rom/0.4.58# md5sum /userdisk/mtd/vmlinuz.trx2
2b0d8f7e05b1f5b170a2fd1ff7af5608  /userdisk/mtd/vmlinuz.trx2

</source>


提取 CFE 可以直接 tftpboot 加载后启动的格式（lzma压缩格式）：

<source lang=bash>
root@XiaoQiang:/userdisk/mtd# dd if=mtd1.os of=vmlinuz.1 bs=1 skip=$((0x1c)) count=$((0x002af000-0x1c))
2813924+0 records in
2813924+0 records out
2813924 bytes (2.7MB) copied, 25.377537 seconds, 108.3KB/s
root@XiaoQiang:/userdisk/mtd# dd if=mtd2.os1 of=vmlinuz.2 bs=1 skip=$((0x1c)) count=$((0x002b4000-0x1c))
2834404+0 records in
2834404+0 records out
2834404 bytes (2.7MB) copied, 23.204559 seconds, 119.3KB/s
</source>

<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br>
<br><br><br><br>
<br><br>
<br><br>
<br><br>
<br><br>