# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "cfe"
mtd1: 00340000 00010000 "linux"
mtd2: 00281f40 00010000 "rootfs"
mtd3: 00060000 00010000 "resource"
mtd4: 00010000 00010000 "factory"
mtd5: 00010000 00002000 "nvram"
#
cat /dev/mtd/0 > /tmp/3w/0.jpg
cat /dev/mtd/1 > /tmp/3w/1.jpg
cat /dev/mtd/2 > /tmp/3w/2.jpg
cat /dev/mtd/3 > /tmp/3w/3.jpg
cat /dev/mtd/4 > /tmp/3w/4.jpg
cat /dev/mtd/5 > /tmp/3w/5.jpg

    2. Download mtd blocks(download from a browser or a download manager):

http://192.168.1.1/0.jpg 
   ...
http://192.168.1.1/5.jpg 

    3. Rename files:

0.jpg to cfe.bin
   ...
5.jpg to nvram.bin

CFE> help
Available commands:

et                  Broadcom Ethernet utility.
show clocks         Show current values of the clocks.
nvram               NVRAM utility.
reboot              Reboot.
flash               Update a flash memory device
batch               Load a batch file into memory and execute it
go                  Verify and boot OS image.
boot                Load an executable file into memory and execute it
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
ttcp                TCP test command.
tcp constest        tcp console test.
tcp listen          port listener.
tcp connect         TCP connection test.
rlogin              mini rlogin client.
ping                Ping a remote IP host.
arp                 Display or modify the ARP Table
ifconfig            Configure the Ethernet interface
help                Obtain help for CFE commands

# help

Built-in commands:
-------------------
        . : break cd continue eval exec exit export help login newgrp
        read readonly set shift times trap umask wait

# ATS reboot and need reflush status about msg queue and pid of ATS procedure

#
#

user_passwd=user
wl_ifname=
wl_bcn=100
wan0_hwaddr=
wl0_sta_retry_time=5
wl_nmode=-1
profile=
auto_validate_times=3
admin_passwd=admin

CFE> verifyImage
Decompressing...........done


CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Feb 27 11:17:46 CST 2012 (bcm@bcm-1)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller
CFE reboot flag0 = 0x12345678, flag1 = 0x0,flag2 = 0xffffffff,reboot_number = 0x1
CPU type 0x29029: 240MHz
Tot mem: 32768 KBytes

CFE mem:    0x80400000 - 0x804A0910 (657680)
Data:       0x80434670 - 0x80439130 (19136)
BSS:        0x80439130 - 0x8043A910 (6112)
Heap:       0x8043A910 - 0x8049E910 (409600)
Stack:      0x8049E910 - 0x804A0910 (8192)
Text:       0x80400000 - 0x80434668 (214632)

Compare factory.
Device eth0:  hwaddr 1C-1D-67-8E-50-B2, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Boot program checksum is invalid
CFE clear reboot_number: reboot_flag0 = 0x12345678, reboot_flag1 = 0x0,reboot_flag2 = 0xffffffff,reboot_number = 0x0
web info: Waiting for connection on socket 0.
CFE>

root@OpenWrt:/# cat /etc/banner
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 ATTITUDE ADJUSTMENT (bleeding edge, r29557) ----------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
 -----------------------------------------------------
root@OpenWrt:/#

Jan  1 00:00:50 OpenWrt kern.warn kernel: [   50.528000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
Jan  1 00:00:50 OpenWrt kern.warn kernel: [   50.544000] jffs2_build_filesystem(): unlocking the mtd device... done.
Jan  1 00:00:59 OpenWrt kern.warn kernel: [   50.548000] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
Jan  1 00:00:59 OpenWrt kern.notice kernel: [   59.192000] JFFS2 notice: (1020) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.