I have a inexpensive Chinese IP-Camera that runs a linux (busybox, to be precise) off a 8-MB SPI flash IC.I'm trying to get access to the device. It has a hardware serial port, and I've gotten access to it, but the linux terminal appears to be disabled or simply turned off. Basically, I get the loading linux kernel message, and then the serial port becomes unresponsive.Is there any way to retrieve the firmware image on a device using U-Boot?U-Boot log:U-Boot 2010.06-svn (Jun 16 2014 - 09:36:52)DRAM:  256 MiBCheck spi flash controller v350... FoundSpi(cs1) ID: 0xC2 0x20 0x17 0xC2 0x20 0x17Spi(cs1): Block:64KB Chip:8MB Name:MX25L6406Eenvcrc 0x5878e4b2ENV_SIZE = 0xfffcIn:    serialOut:   serialErr:   serialPress Ctrl+C to stop autobootCFG_BOOT_ADDR:0x580400008192 KiB hi_sfc at 0:0 is now current device### boot load complete: 1884992 bytes loaded to 0x82000000### SAVE TO 80008000 !## Booting kernel from Legacy Image at 82000000 ...   Image Name:   linux   Image Type:   ARM Linux Kernel Image (uncompressed)   Data Size:    1884928 Bytes = 1.8 MiB   Load Address: 80008000   Entry Point:  80008000load=0x80008000,_bss_end=80829580,image_end=801d4300,boot_sp=807c71d8   Loading Kernel Image ... OKOKStarting kernel ...Uncompressing Linux... done, booting the kernel.And the u-boot environment:hisilicon # printenvbootcmd=fload;bootm 0x82000000baudrate=115200bootfile=uImageda=mw.b 0x82000000 ff 1000000;tftp 0x82000000 u-boot.bin.img;sf probe 0;flwritedu=mw.b 0x82000000 ff 1000000;tftp 0x82000000 user-x.cramfs.img;sf probe 0;flwritedr=mw.b 0x82000000 ff 1000000;tftp 0x82000000 romfs-x.cramfs.img;sf probe 0;flwritedw=mw.b 0x82000000 ff 1000000;tftp 0x82000000 web-x.cramfs.img;sf probe 0;flwritedc=mw.b 0x82000000 ff 1000000;tftp 0x82000000 custom-x.cramfs.img;sf probe 0;flwriteup=mw.b 0x82000000 ff 1000000;tftp 0x82000000 update.img;sf probe 0;flwriteua=mw.b 0x82000000 ff 1000000;tftp 0x82000000 upall_verify.img;sf probe 0;flwritetk=mw.b 0x82000000 ff 1000000;tftp 0x82000000 uImage; bootm 0x82000000dd=mw.b 0x82000000 ff 1000000;tftp 0x82000000 mtd-x.jffs2.img;sf probe 0;flwriteipaddr=192.168.1.10serverip=192.168.1.107netmask=255.255.255.0ethaddr=00:12:12:4b:6b:b6HWID=8043420004048425ob_start=0ob_data=7bappSystemLanguage=SimpChineseappVideoStandard=PALbootdelay=5bootargs=mem=40M console=ttyAMA1,115200 console=ttyAMA0,115200 root=/dev/mtdblock1 rootfstype=cramfs mtdparts=hi_sfc:256K(boot),3520K(romfs),2560K(user),1280K(web),256K(custom),320K(mtd)stdin=serialstdout=serialstderr=serialverify=nver=U-Boot 2010.06-svn (Jun 16 2014 - 09:36:52)Environment size: 1272/65532 bytesU-Boot help prompt (I think you can build u-boot with optional modules. This shows what's built into this instance of u-boot?):hisilicon # help?       - alias for 'help'base    - print or set address offsetboot    - boot default, i.e., run 'bootcmd'bootd   - boot default, i.e., run 'bootcmd'bootm   - boot application image from memorybootp   - boot image via network using BOOTP/TFTP protocolcmp     - memory comparecp      - memory copycrc32   - checksum calculationfload   - fload  - load binary file from a filesystem image for system bootflwrite - SPI flash sub-systemgetinfo - print hardware informationgo      - start application at address 'addr'help    - print command description/usagelip     - lip      - set local ip address but not save to flashloadb   - load binary file over serial line (kermit mode)loady   - load binary file over serial line (ymodem mode)loop    - infinite loop on address rangemac     - mac      - set mac address and save to flashmd      - memory displaymii     - MII utility commandsmm      - memory modify (auto-incrementing address)mtest   - simple RAM read/write testmw      - memory write (fill)nm      - memory modify (constant address)ping    - send ICMP ECHO_REQUEST to network hostprintenv- print environment variablesrarpboot- boot image via network using RARP/TFTP protocolreset   - Perform RESET of the CPUrun     - run commands in an environment variablesaveenv - save environment variables to persistent storagesetenv  - set environment variablessf      - SPI flash sub-systemsip     - sip      - set server ip address but not save to flashtftp    - tftp  - download or upload image via network using TFTP protocolversion - print monitor versionNote that the consoles specified in the bootargs variable are from my experimentation. I've tried both ttyAMA0, ttyAMA1, tty0, and lots of other similar variables. The processor is a HiSilicon Hi3518, which is a ARM SoC.Right now, the only thing I can think of is to hot-air the flash IC off the board and dump it that way, but that's a lot of work, and I'd rather see if there is a software option first.
Extracting a firmware image via U-Boot
hardware;firmware