Extracting Firmware from Linux Router using the U-Boot Bootloader and UART

In this video, we discuss how to extract firmware from a Linux Router using UART access to the device's bootloader. This device used U-Boot as the embedded system's bootloader which provides us with a way to extract flash memory contents using a few handy U-Boot commands. Then we use a small python script to convert the U-Boot hex dump to a binary file which we can analyze with binwalk.

video on finding UART:

tool to convert u-boot hex dump output to a binary file:

U-Boot command documentation:

IoT Hackers Hangout Community Discord Invite:

🛠️ Stuff I Use 🛠️

🪛 Tools:

🫠 Soldering & Hot Air Rework Tools:

🔬 Microscope Setup:

About Me:
My name is Matt Brown and I'm an Hardware Security Researcher and Bug Bounty Hunter. This channel is a place where I share my knowledge and experience finding vulnerabilities in IoT systems.

- Soli Deo Gloria

💻 Social:

#iot #uboot #linux #uart #iotsecurity

[Jay-lysz]

Love the channel. You explain things in a very understandable way. You DEFINITELY have a future in teaching, if you so choose.
A requested topic. Could you do a video talking about "reset" and how its implemented across SW, UART, and JTAG.
For instance, most SW connections include a rst pin or pad. Was wondering if you could maybe demonstrate it in action.
Keep up the great vids! I'm learning a lot!

[vintagekyoshodotcom]

Just found your channel! Awesome stuff, just started working with u-boot for a new risc-v board. Your info was awesome and helpful!

[DrSbaitsojr]

i have learned quite a bit watching your videos. thank you. i hope the algorithm picks you soon.

[victorchorques]

Many thanks! Clear and understandable! Keep up with this kind of videos

[polyscopes]

This is extremely helpful and clear info thanks a lot.

[timmturner]

Imagine dumping an entire Sega Dreamcast GD Rom like this, that's similar to how it was done initially.

[Sam-yzvm]

Nice video thanks Matt, I am watching all episodes like on netflix 😊

[rickevans]

Amazon has decent Chinese XLR condenser microphones with XLR to 1/4" adapters included for $29. Please. If you need it I've got a 48v usb phantom power supply. If you don't want to upgrade hardware, at least use Audacity to tweak EQ and nuke some of those crazy mids? Other than that, subbed bro. Good vid. Top notch technical stuff without the typical YouTuber BS and fluff. Hardcore bro.

[Anx]

Hey Matt, I LOVE your vids
Please keep it up
But I have to admin the mic is very very harsh and the overall volume of the vids is low (which makes it hard to watch on things like TV)
I I would suggest to tune on your mic a bit or even buying a completely new one
Anyways keep it up, you make great content ❤

[Tommy-]

Good content! Thank you.

Btw if your headset is a Logitech pro X, try improving your mic with the Logitech g hub app. Anyways, I have it and I could never get a good result

[navinsmash]

Please suggest video link how to write this bin files directly from uboot,
I have a Linux system and I want to clone it's nand memory

[TouChA]

Hello Matt I have a question is the hardware hacking needs to know programming languages?

[swordlion]

After extracting all of the flash rom like that. How can I pick only the firmware from it? I want to pick the firmware out, modify it and install it back using tftp. Any help is appreciated..

[MeisterJager]

Off topic but how'd you add icons to your i3bar?

[BlueeBubble]

Hey! Any chance you can explain how to update firmware with UTART for Uboot based routers? Many thanks!!

[gersonsoares]

bom video amigo, qual tecla voce uso para parar o u-boot a tecla voce fica pressionada quando liga o roteador ? e o comando MD ? obigado um abraço.

[NoName_silent]

Hi,

How to dump firmware huawei e5577s-932?

[triularity]

@11:01 - "xxd -g 4 -r -seek -0xbf80000" may have also been an option.

[poemtechno]

Hey need your help for locking a router firmware to Our systems

[Crux]

Trying to parse a dump with the script you wrote and I’m having issues. It only chews threw a few megs of data before it errors out.
“python non-hexadecimal number found in fromhex()”

Re-writing this code to rust I get the exact same output (at least as far as diff is concerned). Not sure exactly why though 😣

The dumped file from picocom is incomplete (terminal froze after so long — maybe I asked for a bad address range?) but the input is roughly 32 MB and output is ~2.3 MB. I’m very new to embedded but also willing to learn new things. Hope to work thru this issue soon