记一次失败的修改中兴F7607P rootfs分区的尝试

rootfs为jffs2格式，挂载为只读。看了启动脚本，没有找到可以利用的地方来调用其他可写分区的脚本，于是尝试修改分区后再写回闪存。

挂载jffs2镜像的方法可以参考这里：https://elinux.org/Mount_jffs2，修改开机自启动脚本/etc/rcS.d/S99modules，在最后加上

sleep 10
/userconfig/start.sh &
sleep 20
/mnt/usb1_1/start.sh &

目的就是开机后自动调用可写分区/userconfig和优盘根目录下的start.sh脚本，这样就方便我们以后随时在start.sh加入自定义的内容，即使恢复出厂telnet被关闭也可以插上优盘自动运行任意命令。修改完后umount，把/dev/mtd0 dd成rootfs_mod.bin，放到opentftpserver目录下，准备下载到光猫闪存内

rootfs分区在闪存中的位置为0x1920000-0x3e00000，size: 0x024e0000，被包含在kernel1分区内，kernel2和kernel1内容完全相同。

tftp 0x88000000 rootfs_mod.bin
nand erase 0x1920000 0x024e0000
nand write 0x88000000 0x1920000 0x024e0000
reset

报错如下

vmlinuz crc error 0x9932f447
Failture: boot kernel

说明kernel分区有crc校验，修改内容后就通不过校验，搜索到一篇文章有提到：http://www.chinadsl.net/forum.php?mod=viewthread&tid=168275

把修改后的rootfs_mod分区替换到kernel1分区内的对应位置，找到kernel1分区中的crc校验位应该在0x150-0x153，替换成前述启动错误日志中给出的值0x9932f447，写回光猫，启动，报错如下：

zboot info init done!
header crc error,add=0x01600000
header crc error,add=0x03e00000
none fully-formed version
Erro: do_search  failed
Failture: boot kernel

中兴不仅校验kernel分区的内容，还要校验用来校验分区的header部分，双层套娃验证，和上述帖子中的情况不同，F7607P的uboot并没有给出计算出来的正确crc校验值。猜测存储此校验值的位置在0x1e0-0x1e3，后面跟着编译日期。遗憾的是并不知道校验方式和范围，只能作罢。尝试修改不同位置的值再写回光猫启动，发现校验范围至少包括0x0-0x1df，但是校验方式不清楚。再尝试修改了一位校验范围外的值写回光猫，这次不报header crc error了，又来个这个

verify vmlinuz success!!
RSA Verify error!
Failture: boot kernel

我服了你中兴，还有RSA签名，三层套娃验证，原来分区头部的那一串怪怪的东西是RSA签名。

至此彻底放弃了这条路，想看看能不能绕过所有验证直接启动kernel，printenv看到bootcmd为

bootcmd=setenv bootargs console=$(console) swiotlb=128 root=/dev/mtdblock12 ro rootfstype=jffs2 pcie_pme=nomsi  vid=15 mem=$(memsize);bootm 0x88000240;

正常启动过程日下：

Hit any key to stop autoboot:  0
rx data disable
zboot info init done!
select=0x0
<nand_read_skip_bad_,1199>!mtdpart=0x6,offset=0x0,mtdpartoffset=0x200000,mtdPartsize=0x200000,length=0x1000
tmp=0x00000001, value=1
select=0x1
search=0x2
search->result[1].entry=3e00240,offset=240
<nand_read_skip_bad_,1199>!mtdpart=0x3,offset=0x0,mtdpartoffset=0x3e00000,mtdPartsize=0x2800000,length=0x1d60000
verify vmlinuz success!!
RSA Verify OK
start 3e00000-6600000
no jffs2 found!
<nand_read_skip_bad_,1199>!mtdpart=0x0,offset=0x0,mtdpartoffset=0x0,mtdPartsize=0x180000,length=0xc0000
lseek=0x8c088430
cmdline=U-Boot V2.0.5P1N1 20211203105956
Saving Environment to NAND...
Erasing 0x180000 - 0x1a0000:<nand_erase_skip_bad_,1397>!mtdpart=0x1,start=0x0,mtdpartoffset=0x180000,mtdPartsize=0x80000,length=0x20000
                [Done]
Writing to Nand:<nand_write_skip_bad_,1292>!mtdpart=0x1,offset=0x0,mtdpartoffset=0x180000,mtdPartsize=0x80000,length=0x20000
                [Done]
kernel start step1..images->state:70f
    ==BOOTM_STATE_START:1
    ==BOOTM_STATE_FINDOS:2
## Loading kernel from FIT Image at 88000240 ...
   Using 'conf@132SG' configuration
   Trying 'kernel@A53' kernel subimage
     Description:  Unify(TODO) Linux kernel for project-131G
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x88000348
     Data Size:    3198889 Bytes = 3.1 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x80080000
     Entry Point:  0x80080000
   Verifying Hash Integrity ... OK
    ==BOOTM_STATE_FINDOTHER:4
## Loading fdt from FIT Image at 88000240 ...
   Using 'conf@132SG' configuration
   Trying 'fdt@132SG' fdt subimage
     Description:  Flattened Device Tree blob for project-132SG
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8830d3e0
     Data Size:    35163 Bytes = 34.3 KiB
     Architecture: AArch64
   Verifying Hash Integrity ... OK
   Booting using the fdt blob at 0x8830d3e0
    ==BOOTM_STATE_LOADOS:8
   Uncompressing Kernel Image ... OK
kernel start step6..
   Loading Device Tree to 0000000083ff4000, end 0000000083fff95a ... OK

Starting kernel ...

first spin
first spin
first spin
first spin
CPUID:0 cpunoline 1 nucpus 4 try wake up secondary cpu from rom.
CPUID:1  wake up from rom.
CPUID:2  wake up from rom.
CPUID:3  wake up from rom.
init psci ok!!
cpu 1 power on
cpu 1 has been powered on
cpu 2 power on
cpu 2 has been powered on
cpu 3 power on
cpu 3 has been powered on

可以看到启动的初始位置在kernel分区的0x240处，直接把分区读入内存然后跳到这个位置启动呢？

nand read 0x88000000 0x1600000 0x2800000
bootm 0x88000240

它真的绕过了所有验证，直接启动了内核，直到这里

cpu 1 power on
cpu 1 has been powered on
cpu 2 power on
cpu 2 has been powered on
cpu 3 power on
cpu 3 has been powered on

启动日志都和正常启动一模一样，然后没有任何预兆到这里又自动重启了，连个查找问题的线索都没有

至此彻底放弃，写回原始的分区镜像，装上外壳插上光纤继续使用。