Convert a flashdump to sysupgrade (ar71xx)

From time to time you need to test things with the old image. But how do you test thing when the original build environment is lost and you want to test sysuprade against this old release (actually 12.09).

First you've to create a flashdump of the firmware paritition.

# grep firmware /proc/mtd
mtd5: 003d0000 00010000 "firmware"

# ssh root@192.168.1.1 dd if=/dev/mtd5 > /tmp/firmware_backup

Afterwards you can use binwalk to get the actual offsets of the different parts inside.

# binwalk /tmp/firmware_backup
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
512           0x200           LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 2813832 bytes
930352        0xE3230         Squashfs filesystem, little endian, version 4.0, compression:xz, size: 2194094 bytes, 728 inodes, blocksize: 262144 bytes, created: 2014-03-05 14:58:48
3145728       0x300000        JFFS2 filesystem, big endian

So sysupgrade images for ar71xx is still using the (old) layout of

----------
|KERNEL  |
----------
|squashfs|
----------
|jffs2   |
----------

While a sysupgrade image contains for those platforms:

--------------
|KERNEL      |
--------------
|squashfs    |
--------------
|jffs2-dummy |
--------------

So we will split-off the jffs2 Part and replace it with jffs2.

# dd if=/tmp/firwmare_backup bs=3145728 count=1 of=/tmp/sysupgrade.img

Next we add this jffs2-dummy by using the same tool LEDE is using it:

# /home/lynxis/lede/staging_dir/host/bin/padjffs2 /tmp/sysupgrade.img 64

The 64 means the padding size in kb. It's important to choose the right one, but for most devices this is 64k at least for ar71xx.

ssh root@192.168.1.1 dd if=/dev/mtd5 > /tmp/firmware_backup
binwalk /tmp/firmware_backup
dd if=/tmp/firwmare_backup bs=3145728 count=1 of=/tmp/sysupgrade.img
/home/lynxis/lede/staging_dir/host/bin/padjffs2 /tmp/sysupgrade.img 64

links

social