Difference between revisions of "Talk:RCA DSB772WE Streaming Media Player"

From eLinux.org
Jump to: navigation, search
(Created page with "The LG BD5xx players seem to have also had similar internals as the RCA-DSB and ST6xx media players. I came across these instructions on getting a terminal from a defunct BD5xx h...")
 
Line 1: Line 1:
 
The LG BD5xx players seem to have also had similar internals as the RCA-DSB and ST6xx media players. I came across these instructions on getting a terminal from a defunct BD5xx hacking site, still listed on archive.org
 
The LG BD5xx players seem to have also had similar internals as the RCA-DSB and ST6xx media players. I came across these instructions on getting a terminal from a defunct BD5xx hacking site, still listed on archive.org
  
As terminal software can be used PuTTY. COM1 - 115200 8 N 1. After connecting the converter and runnig PuTTY you should poweron player and  
+
As terminal software can be used PuTTY. COM1 - 115200 8 N 1. After connecting the converter and runnig PuTTY you should power on player and  
 
 
 
quickly press Ctrl+C. You can see on the screen:
 
quickly press Ctrl+C. You can see on the screen:
 
    
 
    
 
   
 
   
 
  BCM76300010
 
  BCM76300010
Setting NAND Params
+
Setting NAND Params
  
CFE starting from ROM
+
CFE starting from ROM
Chip specific init
+
Chip specific init
TLB init
+
TLB init
Board init
+
Board init
Starting memory configuration  
+
Starting memory configuration  
Valid memory config = D3128256
+
Valid memory config = D3128256
Disable refresh - set byte lane 8
+
Disable refresh - set byte lane 8
Setting up PLL
+
Setting up PLL
Setting up memory controller
+
Setting up memory controller
Enable DDR encryption
+
Enable DDR encryption
SoooooooooooooooR
+
SoooooooooooooooR
Preparing to copy code to RAM
+
Preparing to copy code to RAM
Prepare for NAND loading
+
Prepare for NAND loading
  
  
Starting code in RAM
+
Starting code in RAM
Booting Secured CFE...
+
Booting Secured CFE...
  
  
BCM97630 B0-SEC-lg8_100126r0  CFE v2.11.10 (CFE core v2.11, BSP_REV 10), Endian Mode: Little
+
BCM97630 B0-SEC-lg8_100126r0  CFE v2.11.10 (CFE core v2.11, BSP_REV 10), Endian Mode: Little
Build Date: 2010. 01. 26. (í) 11:36:34 KST (khy2766@nexus)
+
Build Date: 2010. 01. 26. (í) 11:36:34 KST (khy2766@nexus)
Copyright (C) Broadcom Corporation.
+
Copyright (C) Broadcom Corporation.
  
  
*jjc* PROD_REVISION is 0x76300010
+
*jjc* PROD_REVISION is 0x76300010
*jjc* is 7630
+
*jjc* is 7630
  
DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz
+
DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
+
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
NAND vendor timing        : 98da9015 Toshiba TC58NVG1S3ETA00 SLC  t1(33535233) t2(80000b98)
+
NAND vendor timing        : 98da9015 Toshiba TC58NVG1S3ETA00 SLC  t1(33535233) t2(80000b98)
Secure boot                : Enabled
+
Secure boot                : Enabled
Port lock                  : Enabled
+
Port lock                  : Enabled
  
doupdatecheck: nothing new and no try_count
+
doupdatecheck: nothing new and no try_count
  
Timestamp started ...
+
Timestamp started ...
booting ARM...
+
booting ARM...
Reading flash0.ofefw.1 to V:0x80000000 from offset 0 len 1048576
+
Reading flash0.ofefw.1 to V:0x80000000 from offset 0 len 1048576
validating ofe fw_ldt@0x800fffb0 ...
+
validating ofe fw_ldt@0x800fffb0 ...
parsed fw_ldt@800fffb0 : ws0_sadr=0xc0000 ws0_eadr=0xdffff prodid:BD READER R02
+
parsed fw_ldt@800fffb0 : ws0_sadr=0xc0000 ws0_eadr=0xdffff prodid:BD READER R02
parsed fw_ws @800c0000 : vendor: LGH08SAN prodid: LG H08SAN BC7630
+
parsed fw_ws @800c0000 : vendor: LGH08SAN prodid: LG H08SAN BC7630
Reading flash0.ofews.1 to V:0x80100000 from offset 0 len 131072
+
Reading flash0.ofews.1 to V:0x80100000 from offset 0 len 131072
parsed  WS@80100000 :  Vendor:LGH08SAN Prodid:LG H08SAN BC7630
+
parsed  WS@80100000 :  Vendor:LGH08SAN Prodid:LG H08SAN BC7630
updating fw_ws@800c0000 with flash0.ofews.1
+
updating fw_ws@800c0000 with flash0.ofews.1
ws was updated in the fw image succesfully
+
ws was updated in the fw image succesfully
booting ARM...ofefw@0x2fd00000
+
booting ARM...ofefw@0x2fd00000
done
+
done
  
Elapsed time  263mS (263280 uS)
+
Elapsed time  263mS (263280 uS)
  
  
Automatic startup canceled via Ctrl-C
+
Automatic startup canceled via Ctrl-C
CFE> ^C
+
CFE> ^C
 
   
 
   
  
Line 68: Line 67:
 
   
 
   
 
  CFE> help
 
  CFE> help
Available commands:
+
Available commands:
  
info                Show CFE configuration information
+
info                Show CFE configuration information
splashsd            Load's and Display's yuv:422 Splash Screen image
+
splashsd            Load's and Display's yuv:422 Splash Screen image
splash              Load's and Display's yuv:422 Splash Screen image
+
splash              Load's and Display's yuv:422 Splash Screen image
loop                Loop a command
+
loop                Loop a command
dir                List the directory of a FAT file system
+
dir                List the directory of a FAT file system
macprog            Program MAC addresses.
+
macprog            Program MAC addresses.
macprog2            Program a specific MAC address.
+
macprog2            Program a specific MAC address.
initadv7622        Initialze adv7622 for HDMI showing CFE Logo
+
initadv7622        Initialze adv7622 for HDMI showing CFE Logo
tstamp              Time stamp utility
+
tstamp              Time stamp utility
flashmarkbb        Marks a specified block bad
+
flashmarkbb        Marks a specified block bad
flasherase          Erases a flash partition
+
flasherase          Erases a flash partition
flasheeprom        Update the EEPROM device on board
+
flasheeprom        Update the EEPROM device on board
flash              Update a flash memory device
+
flash              Update a flash memory device
memtest            Test memory.
+
memtest            Test memory.
f                  Fill contents of memory.  
+
f                  Fill contents of memory.  
e                  Modify contents of memory.
+
e                  Modify contents of memory.
d                  Dump memory.
+
d                  Dump memory.
u                  Disassemble instructions.
+
u                  Disassemble instructions.
reboot              Invoke hardware reboot.
+
reboot              Invoke hardware reboot.
batch              Load a batch file into memory and execute it
+
batch              Load a batch file into memory and execute it
go                  Start a previously loaded program.
+
go                  Start a previously loaded program.
load                Load an executable file into memory without executing it
+
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
+
save                Save a region of memory to a remote file via TFTP
boot                Load an executable file into memory and execute it
+
boot                Load an executable file into memory and execute it
ping                Ping a remote IP host.
+
ping                Ping a remote IP host.
ifconfig            Configure the Ethernet interface
+
ifconfig            Configure the Ethernet interface
sleep              Sleep for specified milliseconds.
+
sleep              Sleep for specified milliseconds.
show heap          Display information about CFE's heap
+
show heap          Display information about CFE's heap
show memory        Display the system physical memory map.
+
show memory        Display the system physical memory map.
show devices        Display information about the installed devices.
+
show devices        Display information about the installed devices.
unsetenv            Delete an environment variable.
+
unsetenv            Delete an environment variable.
printenv            Display the environment variables
+
printenv            Display the environment variables
setenv              Set an environment variable.
+
setenv              Set an environment variable.
help                Obtain help for CFE commands
+
help                Obtain help for CFE commands
  
For more information about a command, enter 'help command-name'
+
For more information about a command, enter 'help command-name'
*** command status = 0
+
*** command status = 0
CFE>  
+
CFE>  
 
    
 
    
  

Revision as of 13:14, 17 December 2011

The LG BD5xx players seem to have also had similar internals as the RCA-DSB and ST6xx media players. I came across these instructions on getting a terminal from a defunct BD5xx hacking site, still listed on archive.org

As terminal software can be used PuTTY. COM1 - 115200 8 N 1. After connecting the converter and runnig PuTTY you should power on player and quickly press Ctrl+C. You can see on the screen:


BCM76300010
Setting NAND Params
CFE starting from ROM
Chip specific init
TLB init
Board init
Starting memory configuration 
Valid memory config = D3128256
Disable refresh - set byte lane 8
Setting up PLL
Setting up memory controller
Enable DDR encryption
SoooooooooooooooR
Preparing to copy code to RAM
Prepare for NAND loading


Starting code in RAM
Booting Secured CFE...


BCM97630 B0-SEC-lg8_100126r0  CFE v2.11.10 (CFE core v2.11, BSP_REV 10), Endian Mode: Little
Build Date: 2010. 01. 26. (í) 11:36:34 KST (khy2766@nexus)
Copyright (C) Broadcom Corporation.


*jjc* PROD_REVISION is 0x76300010
*jjc* is 7630
DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
NAND vendor timing         : 98da9015 Toshiba TC58NVG1S3ETA00 SLC  t1(33535233) t2(80000b98)
Secure boot                : Enabled
Port lock                  : Enabled
doupdatecheck: nothing new and no try_count
Timestamp started ...
booting ARM...
Reading flash0.ofefw.1 to V:0x80000000 from offset 0 len 1048576
validating ofe fw_ldt@0x800fffb0 ...
parsed fw_ldt@800fffb0 : ws0_sadr=0xc0000 ws0_eadr=0xdffff prodid:BD READER R02
parsed fw_ws @800c0000 : vendor: LGH08SAN prodid: LG H08SAN BC7630
Reading flash0.ofews.1 to V:0x80100000 from offset 0 len 131072
parsed  WS@80100000 :  Vendor:LGH08SAN Prodid:LG H08SAN BC7630
updating fw_ws@800c0000 with flash0.ofews.1
ws was updated in the fw image succesfully
booting ARM...ofefw@0x2fd00000
done
Elapsed time  263mS (263280 uS)


Automatic startup canceled via Ctrl-C
CFE> ^C

You can use some CFE commands to see some important information. First try to type HELP <ENTER>


CFE> help
Available commands:
info                Show CFE configuration information
splashsd            Load's and Display's yuv:422 Splash Screen image
splash              Load's and Display's yuv:422 Splash Screen image
loop                Loop a command
dir                 List the directory of a FAT file system
macprog             Program MAC addresses.
macprog2            Program a specific MAC address.
initadv7622         Initialze adv7622 for HDMI showing CFE Logo
tstamp              Time stamp utility
flashmarkbb         Marks a specified block bad
flasherase          Erases a flash partition
flasheeprom         Update the EEPROM device on board
flash               Update a flash memory device
memtest             Test memory.
f                   Fill contents of memory. 
e                   Modify contents of memory.
d                   Dump memory.
u                   Disassemble instructions.
reboot              Invoke hardware reboot.
batch               Load a batch file into memory and execute it
go                  Start a previously loaded program.
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
boot                Load an executable file into memory and execute it
ping                Ping a remote IP host.
ifconfig            Configure the Ethernet interface
sleep               Sleep for specified milliseconds.
show heap           Display information about CFE's heap
show memory         Display the system physical memory map.
show devices        Display information about the installed devices.
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands
For more information about a command, enter 'help command-name'
*** command status = 0
CFE> 
 

INFO command shows information about CFE.


CFE> info
============================================================

DDR  : Bank0:128MB@667MHz | Bank1:256MB@667MHz NAND Boot  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B NAND vendor timing  : 98da9015 Toshiba TC58NVG1S3ETA00 SLC t1(33535233) t2(80000b98) Secure boot  : secure boot enabled, BSECK locked Port lock  : Enabled

Total memory used by CFE: 0x87000000 - 0x870936E4 (603876) Initialized Data: 0x8708F860 - 0x87092C00 (13216) BSS Area: 0x87092D00 - 0x870936E4 (2532) Local Heap: 0x87093800 - 0x87893800 (8388608) Stack Area: 0x87893800 - 0x87895800 (8192) Text (code) segment: 0x87000000 - 0x87023E18 (146968)

CFE driver build information: LDR: ELF 1; BIN 1; SREC 1 UI: LEVEL 3; MIN 0 FS: FAT 1; FAT32 1 NET: STACK 1; ENET 1; TCP 0 USB: STACK 0; ETH 1; DISK 1; SERIAL 1; HID 1 FLASH: NAND p starts at b152a004, ends at b152a004

Total mem_sys_init write to register 0 times Step Address Value

=========================
=========================
============================================================
      • command status = 0

CFE>

Important command PRINTENV shows information about system STARTUP. Don't try to change anything here using SETENV command!!!


CFE> printenv

Variable Name Value


--------------------------------------------------

       BOOT_CONSOLE uart0
        ETH0_HWADDR E8:5B:5B:A1:48:0D
            STARTUP splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 

OFE_SB=y quiet console=0,115200n8'

        CFE_VERSION 2.11.19
      CFE_BOARDNAME BCM97630 B0-SEC-RDEN400
     CFE_MEMORYSIZE 128
      • command status = 0

CFE>


Aby uzyskac dostep do ROOT systemu operacyjnego i ujrzec caly proces BOOT playera trzeba w linie polecen CFE wpisac komende:

If you want to get an access to ROOT of operating system and see BOOT process you need to use command below:

splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose debug

console=0,115200n8 single ro'


CFE> splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose 

console=0,115200n8 single ro'


Display splash screen Using valid user input parameters - Resolution 576p on Component [ Default Video ] : Current Video Output : Component @ Resolution : 576p Loading PAL SD image to 0x06646c00 size 829440 bytes Reading flash0.splash to V:0xa6646c00 from offset 4838400 len 829440 Done displaying splash screen Reading flash0.splash to V:0xa6e00000 from offset 5667840 len 44 Loader:elf Filesys:raw Dev:flash0.kernel File: Options:root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y

verbose console=0,115200n8 single ro Loading: 0x80008000/5427744 0x80535220/1327744 Successfully loaded secure elf image.... Entry address is 0x8000c330 Starting program at 0x8000c330

[ 0.000000] -- DDR Bank 0: 128 MB [ 0.000000] -- DDR Bank 1: 256 MB [ 0.000000] Linux version 2.6.28.9 (ykhong@hyori) (gcc version 4.2.0 20070124 (prerelease) - BRCM 10ts-20080721) #189 Thu Jan 28

18:54:14 KST 2010 [ 0.000000] Kernel command line: root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose

console=0,115200n8 single ro [4294667.366000] DIGSIG: no valid key, digsig security disabled [4294667.389000] checker_0 control 0x00000008 addr low 0x00001000 hi 0x003be000 [4294667.396000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00000000 [4294667.405000] checker_1 control 0x00000008 addr low 0x003bf000 hi 0x027fff80 [4294667.412000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4f8a0 [4294667.421000] checker_2 control 0x00000008 addr low 0x20000000 hi 0x238fff80 [4294667.428000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4f8a0 [4294667.437000] checker_3 control 0x00000010 addr low 0x2fd00000 hi 0x2fdfff80 [4294667.444000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00010000 [4294667.466000] Driver 'sd' needs updating - please use bus_type methods [4294667.473000] Driver 'sr' needs updating - please use bus_type methods [4294667.487000] scsi 0:0:0:0: CD-ROM LGH08SAN LG H08SAN BC7630 0591 PQ: 0 ANSI: 5 [4294667.497000] sr 0:0:0:0: Attached scsi generic sg0 type 5 [4294667.544000] brcmnand_probe: Found SLC device TOSHIBA SLC TC58NVG1S3ETA00 [4294667.550000] brcmnand_probe() oobSize: 16, pageSize : 2048, blockSize: 131072<7>Writing nand config register 0x01402848 with

0x16152300 [4294667.585000] Creating 20 MTD partitions on "bcm7xxx-nand": [4294667.591000] 0x00000000-0x00100000 : "cfe" [4294667.596000] 0x00100000-0x00700000 : "splash" [4294667.601000] 0x00700000-0x00700090 : "macadr" [4294667.606000] mtd: partition "macadr" doesn't end on an erase block -- force read-only [4294667.614000] 0x00700090-0x00700800 : "nvram" [4294667.619000] mtd: partition "nvram" doesn't start on an erase block boundary -- force read-only [4294667.628000] 0x00700800-0x00800000 : "virtual" [4294667.633000] mtd: partition "virtual" doesn't start on an erase block boundary -- force read-only [4294667.642000] 0x00800000-0x00900000 : "bct" [4294667.647000] 0x00900000-0x00b00000 : "dbg" [4294667.652000] 0x00b00000-0x00f00000 : "kernel1" [4294667.657000] 0x00f00000-0x01300000 : "kernel" [4294667.662000] 0x01300000-0x07900000 : "rootfs1" [4294667.668000] 0x07900000-0x0df00000 : "rootfs" [4294667.674000] 0x0df00000-0x0e000000 : "drmregion" [4294667.679000] 0x0e000000-0x0e100000 : "eeprom" [4294667.684000] 0x0e100000-0x0f900000 : "setup" [4294667.689000] 0x0f900000-0x0fb00000 : "ofefw.0" [4294667.695000] 0x0fb00000-0x0fc00000 : "ofews.0" [4294667.700000] 0x0fc00000-0x0fe00000 : "ofefw.1" [4294667.705000] 0x0fe00000-0x0ff00000 : "ofews.1" [4294667.710000] 0x00700000-0x00800000 : "config" [4294667.715000] 0x00000000-0x0ff00000 : "all"


Masz dostep do ROOT uCLinux w trybie pojedynczego uzytkownika

You have an ROOT access of uCLinux in single mode


# cat /etc/fstab


none /dev/pts devpts gid=5,mode=620 0 0 none /sys sysfs defaults 0 0 none /proc proc defaults 0 0 none /proc/bus/usb usbfs defaults 0 0 none /usr/vfs ramfs size=5m 0 0 none /filecache ramfs size=72m 0 0 none /tmp tmpfs size=60m 0 0 none /var tmpfs size=32k 0 0


Ponizej opisuje procedure zrzutu Kernel oraz Rootfs na serwer TFTP w LAN zakladajac, ze adres serwera TFTP to 192.168.1.150 a adres 

playera 192.168.1.200. [msg] oznacza komunikat Linux

Kernel and Rootfs dump procedure is decribed below assuming that TFTP server has address 192.168.1.150 and player address is

192.168.1.200.[msg] means a Linux reply.


##### start as ROOT #####

mount -t proc none /proc mount -t /dev/sda1 /tmp cd /tmp ls cat /proc/mtd

[msg] dev: size erasesize name [msg] mtd0: 00100000 00020000 "cfe" [msg] mtd1: 00600000 00020000 "splash" [msg] mtd2: 00000090 00020000 "macadr" [msg] mtd3: 00000770 00020000 "nvram" [msg] mtd4: 000ff800 00020000 "virtual" [msg] mtd5: 00100000 00020000 "bct" [msg] mtd6: 00200000 00020000 "dbg" [msg] mtd7: 00400000 00020000 "kernel1" [msg] mtd8: 00400000 00020000 "kernel" <----- THIS [msg] mtd9: 06600000 00020000 "rootfs1" [msg] mtd10: 06600000 00020000 "rootfs" <----- THIS [msg] mtd11: 00100000 00020000 "drmregion" [msg] mtd12: 00100000 00020000 "eeprom" [msg] mtd13: 01800000 00020000 "setup" [msg] mtd14: 00200000 00020000 "ofefw.0" [msg] mtd15: 00100000 00020000 "ofews.0" [msg] mtd16: 00200000 00020000 "ofefw.1" [msg] mtd17: 00100000 00020000 "ofews.1" [msg] mtd18: 00100000 00020000 "config" [msg] mtd19: 0ff00000 00020000 "all"

ifconfig eth0 192.168.1.200 netmask 255.255.255.0 up

nanddump /dev/mtd8 -f kernel.gz

[msg] Block size 131072, page size 2048, OOB size 64 [msg] Dumping data starting at 0x00000000 and ending at 0x00400000...

tftp -p 192.168.1.150 -l kernel.gz ls [msg] kernel.gz rm kernel.gz

nanddump /dev/mtd10 -s 0 -l 53477375 -f rootfs_1.bin

[msg] Block size 131072, page size 2048, OOB size 64 [msg] Dumping data starting at 0x00000000 and ending at 0x032fffff...

tftp -p 192.168.1.150 -l rootfs_1.bin

ls [msg] rootfs_1.bin rm rootfs_1.bin

nanddump /dev/mtd10 -s 53477376 -l 53477376 -f rootfs_2.bin

[msg] Block size 131072, page size 2048, OOB size 64 [msg] Dumping data starting at 0x03300000 and ending at 0x06600000...

tftp -p 192.168.1.150 -l rootfs_2.bin

ls [msg] rootfs_2.bin rm rootfs_2.bin

          1. End of DUMP procedure #####


Zrzut rootfs odbyl sie w dwoch czesciach ktore pozniej zostaly scalone w jeden plik.

The dump of rootfs was made in two parts which were concatenated into one file.


Files to download:
 

kernel 8.31.231C.gz   - 4 MB

rootfs 8.31.231C.rar - 67,9 MB


<begin>

We will dump mtds' data directly to remote NFS mount - by Aleksey

[Preparations (if you don't already have modified rootfs with telnet)]

1. Prepare NFS share on PC, which have enough freespace (~600 Mb for full dump). Assuming you doing it at linux.

  Owner of the shared folder: root
  Access mode: rwx for all (chmod u+rwx,o+rwx,g+rwx /path/to/share)

2. Boot BD560 in verbose & single mode.

3. Run partially /etc/init.d/rcS:

  export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
  export LD_LIBRARY_PATH=.:/usr/local/lib
  mount -a
  echo /sbin/hotplug > /proc/sys/kernel/hotplug 
  cat /proc/sys/kernel/sched_rt_period_us > /proc/sys/kernel/sched_rt_runtime_us
  echo 131071 > /proc/sys/net/core/rmem_max
  echo 131071 > /proc/sys/net/core/wmem_max
  echo "4096 87380 2080768" > /proc/sys/net/ipv4/tcp_rmem
  echo "4096 16384 2080768" > /proc/sys/net/ipv4/tcp_wmem
  mkdir /var/lock /var/log /var/run /var/tmp
  touch /var/run/utmp /var/log/wtmp
  chgrp utmp /var/run/utmp /var/log/wtmp
  chmod 0664 /var/run/utmp /var/log/wtmp
  ifconfig lo 127.0.0.1 netmask 255.0.0.0 up
  date 080100002010
  portmap

4. Up the network: ifconfig eth0 192.168.1.254 (ip is example, use any you like/can)

5. Mount remote fs: mount your_pc_ip:/path/to/share /mnt/nfs

[Dumping]

1. List mtds you have (useful): cat /proc/mtd

2. Chdir to /mnt/nfs

3. This is simple inline script for dumping all mtds (type at '#' prompt):

  for n in `seq 0 19`; do nanddump -f mtd$n.dump /dev/mtd$n; done

4. You should got 20 files in your shared folder:

  leshij[/home/share/nand/new]$ ls -l 
 -rw-r--r-- 1 nobody nogroup   1048576 2010-10-17 13:43 mtd0.dump
 -rw-r--r-- 1 nobody nogroup 106954752 2010-10-17 13:45 mtd10.dump
 -rw-r--r-- 1 nobody nogroup   1048576 2010-10-17 13:45 mtd11.dump
 -rw-r--r-- 1 nobody nogroup   1048576 2010-10-17 13:45 mtd12.dump
 ...etc...


[Restoring] - WARNING WARNING - this can be dangerous step. You should know what you're doing. Of course you have second

                                                                 partition with kernel and rootfs and you can restore system but you must 

be careful :)

1. Assuming you still at /mnt/nfs and there is located mtdX.dump you want to write to NAND partition mtdX.

2. Even simplier:

  nandwrite -e /dev/mtdX mtdX.dump

3. This will flash all acontents of mtdX with erasing first (-e key).