Archive for the ‘broadcom’ Category

3com 4500 bootloader debugging mode

May 9, 2011

This comment inspired me to do some more hacking.

The 3com 4500 50-port (3CR17562-91) is a BCM5655 switch fabric with a BCM4704 MIPS cpu.

The bootloader (BOOTROM) has some functions hidden behind CTRL-COMMAND + enter.



Linux? In my Dell Powerconnect 3324?

July 11, 2010

It’s more likely than you think! (more…)

Getting newer U-Boot code on the Dell Powerconnect 3324

July 11, 2010

In the last post I learned that the ‘board/bmw’ port was actually created a long time ago, and does not benefit from more recent advances in minimizing the board-specific code. (more…)

Running U-Boot on the Dell Powerconnect 3324

May 13, 2010

CFE is a nice bootloader, but it’s only focussed on booting VxWorks images.

The current preferred opensource embedded bootloader appears to be Das U-Boot. And U-Boot conveniently supports the ‘BMW’ platform.

So I grab the latest U-Boot (u-boot-2010.03.tar.bz2) and using the same ELDK toolchain as earlier I do:


Running Broadcom CFE

May 8, 2010

Well, that was easy.

I remember that Broadcom publically offered their bootloader source online for download. I downloaded version 1.4.2 and extracted this. Broadcom offers a bunch of crosscompiler toolchains for download, but only for the sb1, mips and mips64 architectures. Not for the PowerPC architecture that the MPC8245 is using.


JTAG Success!

May 8, 2010

For the next article I’ll have to provide some extra background.


Figuring out the .BIX checksums

April 17, 2010

The .BIX runtime format contains two checksums. A checksum over the runtime image and a checksum over the header. The bootloader does not verify these checksums when you’re uploading a file, but it does so when you’re trying to boot the files. If they’re wrong it will cause the following error:


CLI backdoor

April 14, 2010

It appears the backdoor I found earlier in the 3coms during bootup is also available on the CLI when logged in.

First you press <CTRL-G>, then you enter the password.


Uploading files with xmodem

April 14, 2010

PuTTy on Windows does not support zmodem, xmodem, etc. so I often used HyperTerminal, but the GUI of Hyperterminal annoys me.

So instead of switching between PuTTy and HyperTerminal all the time, I tried to use a different terminal emulator ‘TeraTerm Pro’. This seems fine, but for some reason it dumps a few random characters on the serial line after the file is transferred, falsely answering the multiple choice menu to decide between runtime, diag, multiple image or loader.


Accton bix multiple image format

April 12, 2010

I just realized the design of and the reason for the accton multiple image format. The .BIX format for older switches only has a 32-byte header in front of the gzipped runtime: