# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Cherry Blossom

# Flytrap -- Firmware Upgrade Procedures - Belkin F5D8231

- 1
- 2
…
- 6
- 7
- 8
- 9

If an error occurs during the upgrade process AND the wireless client has kept
continual wireless connection to the device, the error will display in the
chkfw box (see below for an explanation of error codes). If the wireless client
has not had continual wireless connection to the device, but does currently
have wireless connection to the device, the status can be checked using
dumbbellc. In either case, at this point, the user should have a dumbbell
shell (see the DUMBBELL NOTES section) available for diagnosis. If an error
occurs, the device will not automatically reboot.
The user can at any time during the upgrade (assuming wireless connection)
check status using dumbbellc:
- open a cygwin command window
- cd to <HOME>/<PACKAGE>/wireless_client_files
- execute:
./dumbbellc/dumbbellc <WIRELESS_ROUTER_IP_ADDRESS> "/bin/cat /tmp/var/sn"
If using dumbbellc to check status, the status is appended to
the serial number. Here is the decoder ring:
'-' means the upgrade has started (i.e., the bootstrap script is executing
on the device). Note that the bootstrap script is located in
<HOME>/<PACKAGE>/webserver_files/a.sh.
'-W1' means that an nvram value could not be set back to its original
value (relatively harmless).
'-W2' means that dumbbelld could not be retrieved from the webserver
(you will not have the dumbbell shell - see "DUMBBELL NOTES" below).
'-W3' means that dumbbelld could not be made executable with chmod +x.
'-E1' means that the mtd_w flash writing program could not be retrieved
from the webserver
'-E2' means that mtd_w could not be made executable with chmod +x.
'-E3' means that the firmware file sq.bin could not be retrieved from the
webserver
'-E4' means that mtd_w program had an error when writing the sq.bin file
to flash.
'-S' means the upgrade was successful.
If you encounter any '-E' messages, you can try again with step 3. Any '-W'
messages are ignored by the script, although if a '-W' occurs, it is likely
that an '-E' will occur.
After clicking the "Check Firmware" button and checking the status with
dumbbellc, the '-' should show immediately. If not, then the most likely
cause of error is step 5. Repeat the operation starting from step 3 being
careful with paths and filenames.
Assuming the '-' is present, files are first transferred from the wireless
client to the device during the first 2 or 3 seconds. After this, the flash
writing takes another 60-70 seconds. The device will then reboot in another
4-8 seconds.
If any error ('-E') occurs, the script is stopped at that point, and the
router will not reboot. If dumbbelld was started successfully, the operator
can use dumbbellc (see "DUMBBELL NOTES" below) to diagnose the problem,
although this could be a time consuming procedure and requires knowledge
of linux and the bootstrapping procedure in the aforementioned a.sh. Still,
the flexibility is there for an expert user.

- 1
- 2
…
- 6
- 7
- 8
- 9