This article discusses the restoration of corrupted embedd kernel using SDcard(Secure Digital card).
How I destroyed the kernel image
In my case, I attached an 8-pin SOIC clip directly to the NOR flash chip to read the firmware without performing a chip-off extraction, and then attempted to boot the device. However, the kernel image was corrupted, causing the boot sequence to fail during the checksum verification stage. Using 8-pin SOIC clip to restore kernel image is not impossible. But I was just scared to use it again, so I found another way, that uses SDcard, to restore kernel image.
1 2 3 4 5 6 7 8 9
## Booting kernel from Legacy Image at 00000000 ... Image Name: Linux-4.19.91 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1568528 Bytes = 1.5 MiB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... Bad Data CRC ERROR: can't get kernel image! nvt@:
To restore the corrupted kernel image, I should extract the kernel image from the original firmware and flash it into the kernel partition of the NOR flash memory. I used the original firmware, that I extracted before. By the way, In case you can only download a legacy firmware online, I believe flashing an entire legacy firmware in NOR flash chip and updating it to a stable firmware using apps, after reviving the device, is the one of the firmware restoring method.
On the first attempt, I extracted the kernel image through binwalk from the original firmware and flashed it into the kernel partition of the NOR flash memory. However, the device still failed to boot it. This is because binwalk extracts only 15685628 bytes, which is the data size, of kernel image from the kernel image offset. During the boot sequence, the checksum verification of the kernel calculates CRC value using the entire kernel section. Therefore, I had to extract 1568592(0x1e86a7-0x69757) bytes of the entire kernel section from the kernel image offset.
This extracted kernel image includes the dummy section, which is located between the end of the kernel image and the start of the next section(SquashFS). After extracting the kernel image, I had to flash it into the kernel partition. By checking the mtdparts environment variable through the bootloader shell using printenv command, I could see that the linux partition, which contains the kernel image, starts at address 0x100000 and has a size of 0x1b0000.
Therefore, I had to flash the linux partition to the kernel image extracted earlier. In my case, I used fatload command to load the kernel image on the device RAM, so I had to format the SDcard FAT in advance.
/dev/disk3 (synthesized): #: TYPE NAME SIZE IDENTIFIER 0: APFS Container Scheme - +494.4 GB disk3 Physical Store disk0s2 1: APFS Volume Macintosh HD 15.8 GB disk3s1 2: APFS Snapshot com.apple.os.update-... 15.8 GB disk3s1s1 3: APFS Volume Preboot 13.8 GB disk3s2 4: APFS Volume Recovery 2.1 GB disk3s3 5: APFS Volume Data 107.1 GB disk3s5 6: APFS Volume VM 20.5 KB disk3s6
/dev/disk4 (internal, physical): #: TYPE NAME SIZE IDENTIFIER 0: FDisk_partition_scheme *134.2 GB disk4 1: DOS_FAT_32 SDCARD 134.2 GB disk4s1
Since I was using MacOS, I used diskutil command to format the SDcard. In my case, the SDcard was /dev/disk4.
1 2 3 4 5 6 7 8 9 10 11
% diskutil eraseDisk FAT32 SDCARD MBRFormat /dev/disk4 Started erase on disk4 Unmounting disk Creating the partition map Waiting for partitions to activate Formatting disk4s1 as MS-DOS (FAT32) with name SDCARD 512 bytes per physical sector /dev/rdisk4s1: 262049216 sectors in 4094519 FAT32 clusters (32768 bytes/cluster) bps=512 spc=64 res=32 nft=2 mid=0xf8 spt=32 hds=255 hid=32768 drv=0x80 bsec=262113280 bspf=31989 rdcl=2 infs=1 bkbs=6 Mounting disk Finished erase on disk4
After formatting the SDcard, I copied kernel image, which I extracted earlier to file system of the SDcard.
1
% cp ./kernel.bin /Volumes/SDCARD/
Restoring the kernel image
Back to the bootloader shell, first I attached the SDcard to the device, and then I checked if the device could recognize the SDcard and set the current mmc(MultiMediaCard) device through mmc command. In my case, mmc index of the SDcard was 0.
1 2
nvt@: mmc dev 0 mmc0 is current device
After setting the current mmc device, I loaded the kernel image, which I stored into the SDcard, on 0x00000000 address of the device RAM through fatload command.
1 2
nvt@: fatload mmc 0:1 0x00000000 kernel.bin 1568592 bytes read in 77 ms (19.4 MiB/s)
On the second attempt, I tried to boot the device from 0x00000000 address of RAM through bootm command to see the result of the checksum verification. The checksum verification of kernel image was succeed. However, as expected, the boot sequence still failed.
1 2 3 4 5 6 7 8 9 10
nvt@: bootm 0x00000000 ## Booting kernel from Legacy Image at 00000000 ... Image Name: Linux-4.19.91 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1568528 Bytes = 1.5 MiB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK ERROR: can't get kernel image! nvt@:
Because during the boot sequence, NVT bootloader will find the kernel image in the kernel partition of NOR flash memory, but I had not yet properly flash the kernel image into the NOR flash memory. So the corrupted kernel image is still at the kernel partition of the NOR flash memory. To flash the NOR flash memory, I used sf command. And I set the current SPI(NOR) flash chip to use it. In my case, the index of the NOR flash chip was 0.
1 2
nvt@: sf probe 0 SF: Detected GigaDevice 25Q128E ...(omitted)
After setting the current NOR flash chip, I flashed kernel image, which is loaded on 0x00000000 address of the device RAM, into 0x100000 address of NOR flash memory, which is kernel partition, 0x1b0000 bytes.
After flashing kernel partition, finally I could boot the device through nvt_boot command. I could see the bootcmd environment variable through printenv command. Additionally, you can also flash the entire firmware into the NOR flash memory through the same method. And if the bootloader is also corrupted and cannot load anything, just perform a chip-off extraction(optional) and use an 8-pin SOIC clip to flash the entire firmware into the NOR flash chip.
