Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
python code to deal with talking to routers using the brnboot bootloader through a serial port and doing simple tasks like backing up the firmware
branch: master

Prettified the hex conversion (related to previous bugfix). "%x"%addr…

… does not produce 0x nor L and the if/else is avoided.
latest commit 8b61d1e7c0
@rvalles authored


This tool can, so far, given a serial port connected to a device with
brnboot/amazonboot, dump its flash into a file.


It has been tested with
- Arcadyan ARV4518PW (as distributed by the spanish isp
- Arcadyan ARV7506PW11 (tested by Jan-Philipp Litza)
- SMC SMC7904WBRA (as distributed by the spanish isp

About brnboot:

git clone git://

The serial port in these two devices is hidden inside their case. If opened,
there's a 5x2 header. Going horizontally from the marked pin, which is
1: 2.RX, 3.TX, 5.GND, 6.+3.3v. UART is at 115200bps.

Some devices might have a different pinout, but I have yet to encounter any
such hardware.

To dump the whole flash of my AR4518PW into some file, I do:
./ --read=AR4518PW_whole.dump --addr=0xB0000000 --verbose

And then turn it on.

A successful flash block read will output '.' while a botched one (a byte or
more gets lost in the serial port) will output '!' and retry. Even so, unless
in a hurry, I'd recommend to at least dump twice and compare the dumps, just
to be on the safe side.

See the "erase flash" menu on the menus brnboot provides through the serial
port in order to figure out the flash layout in these devices. I cannot
guarantee that none of the devices using brnboot will just start erasing the
whole flash by just selecting the option, so act at your own risk.

Thanks to Jan-Philipp Litza for patches and confirming ARV7506PW11 works.
Roc Vallès.
Something went wrong with that request. Please try again.