Extracting Brocade Firmware
Around the v8060 codetrain and above, Brocade seems to have moved to using the standard FIT image type for their firmware files. These contain the linux kernel, ramdisk, device tree, etc, all in a standard structure, so we can extract them. This is not an exhaustive or detailed guide, some knowledge of linux etc is assumed.
Trim the firmware file
Brocade adds some Brocade-specific metadata in front of the FIT image, so it needs to be removed before FIT tools will recognize it. For most files it seems to be 512 bytes we need to remove:
dd if="SPR08080e.bin" of="trimmed.bin" bs=512 skip=1
For the newer "UFI" images (where they've combined the bootloader and OS in one file), it seems to usually be 1360 bytes:
dd if=SPR08091ufi.bin of="trimmed.bin" bs=1360 skip=1
dd if=TNR08091ufi.bin of="trimmed.bin" bs=1276 skip=1
D0 0D FE ED(the FIT file should start with
D0 0D FE ED)
Now install u-boot-tools:
apt install u-boot-tools
wget http://ftp.us.debian.org/debian/pool/main/u/u-boot/u-boot-tools_2019.01+dfsg-7_amd64.deb dpkg -i u-boot-tools_2019.01+dfsg-7_amd64.deb
dumpimageto view a list of all the components in the firmware package:
dumpimage -l trimmed.bin
root@testing:~# dumpimage -l trimmed.bin FIT description: Linux kernel and FDT blob Created: Fri Jun 7 00:19:54 2019 Image 1 (fdt@1) Description: ICX7650.dtb Created: Fri Jun 7 00:19:54 2019 Type: Flat Device Tree Compression: uncompressed Data Size: 27517 Bytes = 26.87 KiB = 0.03 MiB Architecture: AArch64 Load Address: 0x81200000 Hash algo: crc32 Hash value: fd8efcc8 Image 3 (ramdisk@1) Description: Ramdisk -rootfs Created: Fri Jun 7 00:19:54 2019 Type: RAMDisk Image Compression: lzma compressed Data Size: 57735137 Bytes = 56381.97 KiB = 55.06 MiB Architecture: AArch64 OS: Linux Load Address: 0x00000000 Entry Point: 0x00000000 Hash algo: crc32 Hash value: 0749eb07 -----trimmed-----
Choose a part to extract to a separate file, putting the image number after the
-T argument must always be set to
-T flat_dt, even if you are extracting a different image type, only change the
dumpimage -T flat_dt -p 3 -i trimmed.bin ramdisk.zip
ramdisk.zipwith 7zip or similar, you'll be able to explore the switch filesystem, including the interesting init scripts under
FastIron.xz - this is the FastIron binary that gets uncompressed and ran after Linux boots, and this is what provides the FastIron interface you're used to.
With the appropriate tools (such as
mkimage) you can modify the filesystem/ramdisk, kernel, etc after extraction, and repackage them for flashing back to the switch. You will most likely need to update the checksum for the new FIT package in the brocade metadata. More info on packaging FIT images here.
Bonus: Viewing FDTs
If you extract firmware device trees, like below for example:
dumpimage -T flat_dt -p 1 -i trimmed.bin ICX7650.bin
apt install device-tree-compiler fdtdump ICX7650.bin
You'll get a nice human-readable view of the device tree.