Brocade ICX6610 Licence Recovery

alifen

New Member
Jan 25, 2021
2
0
1
I read @fohdeesha's excellent guide on licence recovery without JTAG for PowerPC-based models where the licence configuration has accidently been cleared. I am trying this myself and wanted to check a detail.

Does dd f4000000 8388608 in the bootloader instruct it to read from memory address f4000000 for 8,388,608 bytes? i.e. the first number is hexadecimal and the second is decimal? I guess that would make sense as 8,388,608 bytes is 8 MB (for the definition of 1MB = 2^10 bytes)

I ask because, if so, I'd expect the command to stop at address F480 0000 but it is continuing to run much past that, although still outputting data. I'm wondering when I should give it up...

Thanks in advance!
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,292
2,381
113
30
fohdeesha.com
OK, to begin with we're dumping persistent flash, not memory (RAM). You can see what address ranges are mapped to what by running "show law" in the bootloader. Flash is usually the first "local bus" after RAM:

Code:
OS>show law
  LAW1: 0_00000000 20000000  DDR SDRAM
  LAW2: 0_f4000000 04000000  Local Bus
  LAW3: 0_40000000 40000000  PCI Express 1
  LAW4: 0_80000000 40000000  PCI Express 1
  LAW6: 0_ea000000 00008000  Local Bus
First column is the starting address (f4000000), second one is size in bytes (both in hex). So flash size is 0x04000000 bytes, or 67 megabytes. From more of my notes:

Just another note, the "length" argument for the dd command isn't byte amount in hex, it's "number of items" in decimal. Items in the case of dd being 32 bit double words. So (number of items argument) x 32 = how many flash bits to dump. So the argument 8388608 I gave you times 32 bits per item equals 268435456 bits, or 33.5 megabytes
so "dd f4000000 8388608" will actually only dump about half of the flash storage, if you want to dump exactly all 0x04000000 bytes, that'd be "dd f4000000 16777216" - but it will take a LONG time (a few days). if you get desperate, PM me the serial and lic ID and I can generate you replacements
 
Last edited:
  • Like
Reactions: klui and alifen

alifen

New Member
Jan 25, 2021
2
0
1
Great info - thank you so much!

I gave up at f5931ab0 as it looked as though everything since f4d9caa0 was ffffffff. I guess I was close as I think it would have finished at f6000000 based on the calculation in your reply.

Do you think there is a good chance the licence is in the other half of the flash?
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,292
2,381
113
30
fohdeesha.com
hard to say, I've seen them in all kinds of random places (including at the bottom). like I said if you PM me your license ID/serial I can generate new ones but it may be a few days until I have time to do it
 

fohdeesha

Kaini Industries
Nov 20, 2016
2,292
2,381
113
30
fohdeesha.com
also oops, in my first reply my example had f8000000 in it for the dd command, should be f4000000 (I've edited it). think f8000000 is for the ADX lol
 
  • Like
Reactions: alifen

mysy

Member
Apr 2, 2020
51
9
8
CHINA
I try to website and chat with their support. they could help to send me back my icx switch 10g port license.