Hi All

I'd like to download a copy of this Broadcom file. I've checked a few places. I don't suppose there's a repositary somewhere on OpenWRT ?

Failing that, if your router has this file e.g. DGN2200v1, have you already extracted the CFE from it ?

Cheers in advance

jeq
PS A photo of something similar here:
http://wiki.openwrt.org/_detail/doc/tec … ader%3Acfe
I presume that the version number can be read from inside the file somewhere ....

One thing that's become clear is that the version number is at address 0x0570.

There's a sting 'cfe-v' followed by 5 numbers. If those hex numbers are converted to decimal you get the broadcom version number. In the photo, you can see that its v1.0.37-3.6.

I have a copy of one CFE that's the one I'm looking for but the endianess issue has caused the values to be in the wrong positions.

I presume that this can be corrected quite easily. Anyone ?

A tiny program (301 bytes) is all that's required to restore the CFE file. So if you need that file, I now have it.

Haha, I feel as though I'm about to learn something rather basic ...

Thanks for that link. It doesn't have the CFE for the MBRN3000 or DGN2200v1 but I did take a look at the CFE for DG834GTB.

That one also seems to have the bytes in reverse order i.e. the endian issue.

This begs a question:
If you dump a block of memory, shouldn't the order of the bytes in the dump file match exactly what was in memory ?

What we seem to have here is that bytes have been taken 4 at a time, reversed and then placed in the dump file.

But clearly that process is completely reversible. Is that how JTAG tools work ?

I also had a look at the Globesurfer CFE which is quite different to the one I have. But thanks for the link, all the same. It's the sort of thing you expect should exist but sometimes hard to find.

It becomes clearer ... the copy of the CFE that I obtained is already in the correct state to be sent back to the router via JTAG. It's byte-swapped.

The person who backed up their CFE, generating that file, decided not to use the
/swap_endian

switch. If they had no need to search through or modify the CFE file, it would make life easier to just accept the file as the router's CPU generated it. And then send exactly the same file back afterwards.

So to answer your question, Anarchy, when I restored the CFE file I removed the byte-swapping.

I thought I needed to do that but that was wrong.

I also read that some CFE files contain a MAC address but I haven't seen one so far. I'm wondering if that would be present as 12 ascii characters and maybe 5 colon characters as well.

And it becomes slightly clearer again. That CFE version number applies to more than 1 CFE file and they have different contents depending on the router model.

I'm looking for the CFE for an MBRN3000v1. 64 KiB.

Has anybody dumped that CFE or know where it can be obtained e.g. in the Netgear open source download package ?

Yes, you can get it from the Netgear source code
http://download2.polytechnic.edu.na/pub … 0.65NA.zip
It's at targets/CFE subdirectory. BTW this bootloader might be different from the original at your device.

About endianess, newer versions of hairydairymaid software (i.e zjtag) are aware of endianness, they reverse endian automatically when reading/writing.