IOS映像和密码恢复
IOS Image and Password Recovery
深圳职业技术学院计算机系网络专业
© 2006, Shenzhen Polytechnic. All rights reserved.
1
教学目标（ Objectives ）
1.路由器启动顺序（Router Startup Sequence ）
2.路由器加载IOS顺序
（Router Load IOS Sequence ）
3.配置路由器寄存器
（Configuring Router Configuration Register ）
4.路由器密码破解（Router Password Recovery）
5. IOS和配置文件备份
（Backup IOS and Configuration File）
6. IOS的恢复或升级
（ Recovery or Upgrade IOS ）
© 2006, Shenzhen Polytechnic. All rights reserved.
2
Cisco IOS
Internetwork
Operating
System
Cisco
IOS
Software
互联网操作系统
© 2006, Shenzhen Polytechnic. All rights reserved.
3
启动顺序预览（An Overview of System Startup）
• 上电自检（Power on self test (POST)）
• 装载引导程序（Load and run bootstrap code）
• 查找IOS（Find the IOS software）
• 装载IOS（ Load the IOS software）
• 查找配置文件（Find the configuration）
• 装载配置文件（Load the configuration）
• 运行（Run）
© 2006, Shenzhen Polytechnic. All rights reserved.
4
启动顺序（ Startup Sequence ）
RAM
Bootstrap
ROM
装载启动程序Load Bootstrap
装载IOS
Flash
TFTP Server
ROM
Cisco
Internetwork
Operating
System
装载配置文件或
进入Setup模式
NVRAM
TFTP Server
Console
© 2006, Shenzhen Polytechnic. All rights reserved.
Locate and Load
Operating System
Configuration
File
Locate and Load
Configuration File or
Enter Setup Mode
5
加载 IOS顺序（ Load IOS Sequence ）
show
startup-config
Console
show
version
NVRAM
Config register
配置寄存器
1.在配置文件中，boot system命令指定了查找顺序，路由器会依次使用
Global configuration mode boot system commands can be specified
to enter fallback sources for the router to use in sequence. The
router will use these commands as needed, in sequence, when it
restarts.
2.否则，路由器会使用自己的Flash中的IOS软件
If NVRAM lacks boot system commands that the router can use, the
system by default uses the Cisco IOS software in flash memory.
© 2006, Shenzhen Polytechnic. All rights reserved.
6
定位IOS（ Locating the Cisco IOS Software）
配置寄存器（ Configuration Registers ）
更改NVRAM中的寄存器，会改变Cisco IOS软件的基本选项，可以指定从哪里引导IOS
Router# configure terminal
Router(config)# boot system
Router(config)# boot system
Router(config)# boot system
[Ctrl-Z]
Router# copy running-config
flash IOS_filename
tftp IOS_filename tftp_address
rom
startup-config
Boot system commands not found In NVRAM
Get default Cisco IOS software from Flash
Flash memory empty
Get default Cisco IOS software from TFTP server
From ROM
© 2006, Shenzhen Polytechnic. All rights reserved.
7
ROM功能（ ROM Functions ）
ROM
Bootstrap
POST
show version
Mini IOS
ROM
monitor
Console
Mini IOS——RXBOOT模式
ROM monitor——ROMMON模式
© 2006, Shenzhen Polytechnic. All rights reserved.
8
查看当前配置寄存器的值
（Determining the Current Configuration Register Value）
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) C2600 Software (C2600-I-M), Version 12.2(8)T1, RELEASE
SOFTWARE (fc2)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2002 by cisco Systems, Inc.
Compiled Sat 30-Mar-02 20:08 by ccai
Image text-base: 0x80008074, data-base: 0x80A29E20
ROM: System Bootstrap, Version 12.2(7r) [cmong 7r], RELEASE
SOFTWARE (fc1)
Router uptime is 5 minutes
System returned to ROM by reload
System image file is "flash:c2600-i-mz.122-8.T1.bin“
……
Configuration register is 0x2102
© 2006, Shenzhen Polytechnic. All rights reserved.
9
配置寄存器组成（Component of Configuration Registers ）
寄存器组成：4位16进制
格式：0xABCD
15 14 13 12
实例
11 10 9 8
765 4
3210
A
B
C
D
2
1
0
2
Console口
D: 启动域
速率设定表
C：使得系统软件忽略NVRAM中的内容 ，关键位“6”
（1）值为０,当路由器启动后会从ＮＶＲＡＭ里面的配
置文件调到ＲＡＭ里运行
（2）值为１，路由器启动后会忽略ＮＶＲＡＭ的配置
A：13位，网络启动次数，值为1 ——5次
值为0——无数次
© 2006, Shenzhen Polytechnic. All rights reserved.
12 11
速率
0
0
9600
0
1
4800
1
0
1200
1
1
2400
10
启动域取值（ Boot Field Values）
Router#configure terminal
Router(config)#config-register 0x2102
[Ctrl-Z]
Router#reload
配置寄存器启动域值
Value of Boot Field
描述
Description
0x0
路由器启动后会进入
ROMMON模式
0x1
路由器从ROM中启动，进入
RXBOOT模式（FLASH空）
0x2 to 0xF
© 2006, Shenzhen Polytechnic. All rights reserved.
路由器属于正常启动，如果
路由器有FLASH，2是缺省值
11
Case Study(1)
分别按下面步骤修改寄存器的值，然后重新启动
，并比较不同点：
1.将寄存器的值修改为0x2100
2.将寄存器的值修改为0x2101
3.将寄存器的值修改为0x2102
4.将寄存器的值修改为0x2142
Configuration register value in show version
0x2102 ：工业默认值
0x2142 ：从FLASH中启动，但不使用NVRAM中的配置文件（用于口
令恢复）
© 2006, Shenzhen Polytechnic. All rights reserved.
12
路由器密码破解(Password Recovery)
?
Password
I don’t know.
So,how can I do?
密码恢复
© 2006, Shenzhen Polytechnic. All rights reserved.
13
破解步骤(Steps)
© 2006, Shenzhen Polytechnic. All rights reserved.
14
准备TFTP服务器（Preparing for TFTP）
FLASH
TFTP
Server
RAM
Router# show flash
System flash directory:
File Length
Name/status
1
5848552 c2600-i-mz.122-8.T1.bin
[5848616 bytes used, 10928600 available, 16777216 total]
16384K bytes of processor board System flash (Read/Write)
Router# ping tftp_address
...
!!!!!
(On the TFTP server, for example, a UNIX host)
dir c2600-i-mz.122-8.T1.bin
确定TFTP服务器有足够的空间
Verify that Flash memory has roomfor the Cisco IOS image
© 2006, Shenzhen Polytechnic. All rights reserved.
15
备份IOS （Backup IOS ）
FLASH
copy flash tftp
RAM
TFTP
Server
Router# show flash
System flash directory:
File Length Name/status
1 5848552 c2600-i-mz.122-8.T1.bin
[5848616 bytes used, 10928600 available, 16777216 total]
16384K bytes of processor board System flash (Read/Write)
Router# copy flash tftp
Source filename [c2600-i-mz.122-8.T1.bin]?
Address or name of remote host []? 10.1.1.2
Destination filename [c2600-i-mz.122-8.T1.bin]?
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Router#
© 2006, Shenzhen Polytechnic. All rights reserved.
16
从网络升级IOS
（Upgrading IOS from the Network）
FLASH
RAM
copy tftp flash
TFTP
Server
Router# copy tftp flash
IP address or name of remote host [255.255.255.255]? 10.1.1.2
Name of tftp filename to copy into flash []? c2600-i-mz.122-8.T1.bin
copy c2600-i-mz.122-8.T1.binfrom10.1.1.2 into flash memory? [confirm] <Return>
xxxxxxxx bytes available for writing without erasure.
erase flash before writing? [confirm] <Return>
Clearing and initializing flash memory (please wait)####...##
Loading from 10.1.1.2: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!(text omitted) [OK - 324572/524212 bytes]
Verifying checksum...
VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV
VVVVVV(text omitted)
Flash verification successful. Length = 1804637, checksum = 0xA5D3
© 2006, Shenzhen Polytechnic. All rights reserved.
17
备份配置文件到TFTP服务器
（Backup Running-config to Tftp Server）
Network
server
running-config
R1#copy running-config tftp
Address or name of remote host []? 10.1.1.2
Destination filename [r1-confg]?
!!
691 bytes copied in 0.725 secs
© 2006, Shenzhen Polytechnic. All rights reserved.
18
从TFTP下载配置文件
（Update Running-config from Tftp Server）
Network
server
running-config
R1#copy tftp running-config
Address or name of remote host []? 10.1.1.2
Source filename []? r1-confg
Destination filename [running-config]?
Accessing tftp://10.1.1.2/r1-confg...
Loading r1-confg from 10.1.1.2 (via FastEthernet0/0): !
[OK - 691/1024 bytes]
691 bytes copied in 0.854 secs
© 2002, Cisco Systems, Inc. All rights reserved.
Case Study (2)
1.Cisco IOS 备份
2.running-config备份与加载
R1
fa0/0:10.1.1.1/24
TFTP
SERVER
© 2006, Shenzhen Polytechnic. All rights reserved.
PC1:10.1.1.2/24
GW:10.1.1.1
20
深入实验（Further Study ）
R1
R2
fa0/0:10.1.1.1/24
TFTP
SERVER
© 2006, Shenzhen Polytechnic. All rights reserved.
PC1:10.1.1.2/24
GW:10.1.1.1
21
Case Study(4)
从TFTP Server加载IOS
Router
© 2006, Shenzhen Polytechnic. All rights reserved.
Network
server
22
思考题（Questions）
1.Cisco 默认加载IOS的顺序是什么？
2.配置寄存器的启动域的0,1和2所代表的含义是什么?
3.用什么命令可以查看配置寄存器的值?
4.用什么命令可以修改配置寄存器的值?
5. 配置寄存器的值2102是十进制还是十六进制?
6.在什么模式下可以恢复路由器的密码?
7.当我们升级IOS时,应该注意哪些事情?
8.用什么命令可以从TFTP服务器上下载新的IOS?
9.路由器的启动顺序是怎样的?
10.如何查看IOS软件的大小?
11.备份配置文件的命令包含哪些?
12.路由器密码破解的核心思想是什么?
© 2006, Shenzhen Polytechnic. All rights reserved.
23