--- a/.hgignore	Fri Jan 19 05:15:50 2018 +0000
+++ b/.hgignore	Fri Jan 19 06:19:59 2018 +0000
@@ -28,6 +28,7 @@
 
 ^miscprog/atsc$
 ^miscprog/calextract$
+^miscprog/cinitdump$
 ^miscprog/factdiff$
 ^miscprog/ftmdump$
 ^miscprog/grokdsn$

--- a/miscprog/Makefile	Fri Jan 19 05:15:50 2018 +0000
+++ b/miscprog/Makefile	Fri Jan 19 06:19:59 2018 +0000
@@ -1,7 +1,8 @@
 CC=	gcc
 CFLAGS=	-O2
-STD=	atsc calextract factdiff ftmdump grokdsn memwrite-grep mokosrec2bin \
-	osmo2psi pirbattextr pircalextr pircksum pircksum2 rfcap-grep
+STD=	atsc calextract cinitdump factdiff ftmdump grokdsn memwrite-grep \
+	mokosrec2bin osmo2psi pirbattextr pircalextr pircksum pircksum2 \
+	rfcap-grep
 CRYPTO=	imeibrute pirimei
 PROGS=	${STD} ${CRYPTO}
 
@@ -15,6 +16,7 @@
 
 atsc:		atsc.c
 calextract:	calextract.c
+cinitdump:	cinitdump.c
 factdiff:	factdiff.c
 ftmdump:	ftmdump.c
 grokdsn:	grokdsn.c

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/miscprog/cinitdump.c	Fri Jan 19 06:19:59 2018 +0000
@@ -0,0 +1,55 @@
+/*
+ * This program dumps the cinit section records from a firmware image
+ * sans symbols, given just the cinit start address and knowing the
+ * record structure.
+ */
+
+#include <sys/types.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+FILE *inf;
+u_long offset;
+
+u_long
+get_word()
+{
+	u_char bytes[4];
+	u_long word;
+
+	fread(bytes, 1, 4, inf);
+	word = bytes[0] | (bytes[1] << 8) | (bytes[2] << 16) | (bytes[3] << 24);
+	printf("%8lx:\t%08lx\n", offset, word);
+	offset += 4;
+	return word;
+}
+
+main(argc, argv)
+	char **argv;
+{
+	u_long len, count;
+
+	if (argc != 3) {
+		fprintf(stderr, "usage: %s filename start-addr\n", argv[0]);
+		exit(1);
+	}
+	inf = fopen(argv[1], "r");
+	if (!inf) {
+		perror(argv[1]);
+		exit(1);
+	}
+	offset = strtoul(argv[2], 0, 0);
+	fseek(inf, offset, SEEK_SET);
+
+	for (;;) {
+		len = get_word();
+		if (!len)
+			break;
+		len = (len + 3) & ~3;
+		get_word();	/* bss address */
+		for (count = 0; count < len; count += 4)
+			get_word();
+		putchar('\n');
+	}
+	exit(0);
+}