4.1 KiB
Extracting Brocade Firmware
Around the v8060 codetrain and above, Brocade seems to have moved to using the standard FIT image type for their firmware files. These contain the linux kernel, ramdisk, device tree, etc, all in a standard structure, so we can extract them. This is not an exhaustive or detailed guide, some knowledge of linux etc is assumed.
Trim the firmware file
Brocade adds some Brocade-specific metadata in front of the FIT image, so it needs to be removed before FIT tools will recognize it. For most files it seems to be 512 bytes we need to remove:
dd if="SPR08080e.bin" of="trimmed.bin" bs=512 skip=1
For the newer "UFI" images (where they've combined the bootloader and OS in one file), it seems to usually be 1360 bytes:
dd if=SPR08091ufi.bin of="trimmed.bin" bs=1360 skip=1
However some images seem to need 1276 bytes removed:
dd if=TNR08091ufi.bin of="trimmed.bin" bs=1276 skip=1
To be sure, just open the firmware file with a hex editor and highlight and delete everything before the HEX values D0 0D FE ED (the FIT file should start with D0 0D FE ED)
Now install u-boot-tools:
apt install u-boot-tools
Debian 9 (and maybe others) have a very old uboot-tools version in the default repo, and does not come with the required dumpimage program. In that case, just manually install the recent tools:
wget http://ftp.us.debian.org/debian/pool/main/u/u-boot/u-boot-tools_2019.01+dfsg-7_amd64.deb
dpkg -i u-boot-tools_2019.01+dfsg-7_amd64.deb
Now use dumpimage to view a list of all the components in the firmware package:
dumpimage -l trimmed.bin
You'll get a list of everything in the package:
root@testing:~# dumpimage -l trimmed.bin
FIT description: Linux kernel and FDT blob
Created: Fri Jun 7 00:19:54 2019
Image 1 (fdt@1)
Description: ICX7650.dtb
Created: Fri Jun 7 00:19:54 2019
Type: Flat Device Tree
Compression: uncompressed
Data Size: 27517 Bytes = 26.87 KiB = 0.03 MiB
Architecture: AArch64
Load Address: 0x81200000
Hash algo: crc32
Hash value: fd8efcc8
Image 3 (ramdisk@1)
Description: Ramdisk -rootfs
Created: Fri Jun 7 00:19:54 2019
Type: RAMDisk Image
Compression: lzma compressed
Data Size: 57735137 Bytes = 56381.97 KiB = 55.06 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x00000000
Entry Point: 0x00000000
Hash algo: crc32
Hash value: 0749eb07
-----trimmed-----
Choose a part to extract to a separate file, putting the image number after the -p argument.
Note: The -T argument must always be set to -T flat_dt, even if you are extracting a different image type, only change the -p number:
dumpimage -T flat_dt -p 3 -i trimmed.bin ramdisk.zip
The above example extracts the ramdisk from the above firmware file, which is the main filesystem for the switch. If you open up the resulting ramdisk.zip with 7zip or similar, you'll be able to explore the switch filesystem, including the interesting init scripts under /etc/:
Note: Notice FastIron.xz - this is the FastIron binary that gets uncompressed and ran after Linux boots, and this is what provides the FastIron interface you're used to.
Packaging Modifications
With the appropriate tools (such as mkimage) you can modify the filesystem/ramdisk, kernel, etc after extraction, and repackage them for flashing back to the switch. You will most likely need to update the checksum for the new FIT package in the brocade metadata. More info on packaging FIT images here.
Bonus: Viewing FDTs
If you extract firmware device trees, like below for example:
dumpimage -T flat_dt -p 1 -i trimmed.bin ICX7650.bin
and want to see them in human-readable form, run the following:
apt install device-tree-compiler
fdtdump ICX7650.bin
You'll get a nice human-readable view of the device tree.