Notes on how to backup AR7 router firmware using telnet

Source: http://ar7.wikispaces.com/Firmware

# cat /dev/mtdblock/0 > /var/oldfs.img
# cat /dev/mtdblock/1 > /var/oldkernel.img
# cat /dev/mtdblock/2 > /var/Original_ADAM2.img
# cat /dev/mtdblock/3 > /var/mtd3.img
# /usr/sbin/thttpd -g -d /var -u root -p 1080


WindyCityTech Blogger
WindyWindyCityTech Wordpress

LMMC header on DLink router file, decoding the zlib zpipe Plaintext password

LMMC header on router file, decoding.

Inspired from http://www.koshatul.com/

Tested on a DLink DSL-G604T

Downloading the config file dumps a config.bin file.  The first line of the file has a LMMC which indicates a zlib header

Convert the file to a .Z file
dd if=config.bin of=test.config.bin.z bs=20 skip=1


download the zlib source and extract it.  http://zlib.net/zlib-1.2.7.tar.gz
go to the examples folder
compile zpipe.c using the command
gcc -o zipe zpipe.c -lz
now you will have something called zpipe

copy the zpipe command where the config files are and execute the command
./zpipe -d < test.config.bin.z > config.txt

now open config.txt and view it plaintext!

WindyCityTech Blogger
WindyWindyCityTech Wordpress