[shauno100]

Hi All,

I'm hoping someone can assist here. I have an Archer C3150 V2 and am in the process of providing Brainslayer the nvram and CFE dumps.

I have successfully obtained serial access to the router and have exported the nvram using nvram show.

I am having issues exporting the CFE however. The exported CFE.BIN on my PC running the TFTP server does not look right when opened in a HEX editor - all the data is FF FF FF etc

I originally used save 192.168.0.2:cfe.bin BC000000 40000

and then save 192.168.0.2:cfe.bin BC000000 400000 to dump the whole memory.

According to http://embedded-xinu.readthedocs.io/en/latest/mips/HOWTO-Backup-Router.html these were the correct commands to use.

The resulting BIN files however don't look right as previously mentioned.

My serial console looks like the below

Decompressing...done


CFE version 7.14.131.42 (r622851) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Fri Aug 12 08:26:39 CST 2016 (rock@rock-computer)
Copyright (C) 2000-2008 Broadcom Corporation.
-----------------------------------------
|Factory Boot - Double boot TP-LINK. |
-----------------------------------------

Init Arena
Init Devs.
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1400,*800*
et0(chipattach) MAC address: 50-c7-bf-a2-b6-ac
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.131.42 (r622851)
CPU type 0x0: 1400MHz
Tot mem: 262144 KBytes

CFE mem: 0x00F00000 - 0x00FDC938 (903480)
Data: 0x00F4C34C - 0x00F516C4 (21368)
BSS: 0x00F516D0 - 0x00F76938 (152168)
Heap: 0x00F76938 - 0x00FDA938 (409600)
Stack: 0x00FDA938 - 0x00FDC938 (8192)
Text: 0x00F00000 - 0x00F43C70 (277616)

Committing NVRAM...done
...
TP-LINK Data Recovery Check...
TP-LINK Data Recovery Done.
Device eth0: hwaddr 50-C7-BF-A2-B6-AC, ipaddr 192.168.0.1, mask 255.255.255.0
gateway not set, nameserver not set
Startup canceled
CFE> ^C


its showing the CFE portion of memory as CFE mem: 0x00F00000 - 0x00FDC938 (903480)

How could i adjust the save command to export just this portion of memory to a file?

Would save 192.168.0.2:cfe.bin 0x00F00000 903480 be correct?

Any assistance would be much appreciated.

[kernel-panic69]

I'm wondering if the contents of this article will help, even though its for dumping a recovery image (firmware):

http://jg.sn.sg/ontdump/

[Dr_K]

https://wiki.dd-wrt.com/wiki/index.php/CFE_backup

Don't trust the easiest

http://"routers local ip address"/backup/cfe.bin

Method even though its recommend in the peacock post

With alot if not all firmwares starting some years back...not really sure exactly

That method produces a bin file with a whole lot of FF FF FF FF hex in the produced cfe.bin fle...where as other methods produce hex that matches web based backups made many years ago on same router

Or...send that to Brainslayer and maybe he'll see a need to look into it....

[shauno100]

Thanks for the replies. I ended up exporting the CFE successfully via the below command. I should mention this is obviously from stock TP Link firmware and the CFE on this router has a very limited set of commands that can be used.

save 192.168.0.2:cfe.bin 0x00F00000 903480

I think it may have exported more then just the CFE however but it's done the trick.

Have sent all the dumps to Brainslayer. Here's hoping that he will develop a port for Archer C3150 V1 and V2

This router uses the exact same CPU and wireless chips as Asus RT-AC88U for example which is supported by DD WRT.

[kernel-panic69]

save 192.168.0.2:cfe.bin 0x00F00000 - 0x00FDC938 may have been more exact, perhaps. Hopefully, this does bring new device support in your favor.

[derlandes]

If I want to use the ddwrt firmware do asus rt ac88u on my tplink ac3150 v.2, will it perform properly?

[shauno100]

[kernel-panic69]

Recent commits regarding the v1.x and Archer C3200 v1.x:

https://svn.dd-wrt.com/changeset/52153
https://svn.dd-wrt.com/changeset/52154
https://svn.dd-wrt.com/changeset/52158
https://svn.dd-wrt.com/changeset/52159
https://svn.dd-wrt.com/changeset/52160
https://svn.dd-wrt.com/changeset/52169
https://svn.dd-wrt.com/changeset/52170
https://svn.dd-wrt.com/changeset/52171

Should see firmware images for these soon.