Damn ... Truly so, if you stupidly look at the files on F3 ...

By the way, in 2.2 there is also CFE Boot. That is, at least it does not need to be sought. It remains to find the JTAG itself on the board.

Posted on 09/17/2014, 13:43:



I think that the matter should be limited to one DB25 connector and a dozen resistors. For the lucky owners of a printer port, of course ;-)

my megaphone refuses to download from this resource (

here I downloadedf660v2-v2.20.20p4t5s.zip(13.23 MB)
but this is not MGTS firmware ...
This is the Belarusian Promsvyaz. I do not advise her to sew ... she is worse than the MGTS-ovskoy. (Older and there are flaws)
For one and 2 from my iron I’ll lay out whoever needs itf660v3v2.30.zip(20.77 MB)


Post has been editedcoqs - 17.09.14, 13:55

As expected.
What difference does it make if we are not going to use it for its intended purpose?

http: //wiki.openwrt.or...c/soc.broadcom.bcm63xx
here in the table it can be seen that our BMIPS4350 V8.0 (BCM63168) is not supported until ...
http://wiki.openwrt.org/toh/zyxel/vmg1312-b30a- this device has similar guts, (except without pon), I can try to fill it with zyxel, I ask, it seems like it supports 3g whistles.

Post has been editedqpu3uk - 17.09.14, 17:05

Well, that’s understandable (but this Zyxel was so similar!). Kernel could be grabbed from the piece of iron itself. It’s more interesting to attach fs to r / w, and throw something compiled for some similar mips there. And then with matyugs and hooting, try to attach modules to the binary core.

how did you make him shove the firmware?

I do not even have f660v2-v2.20.20p4t5s.bin flashing either through the normal menu or through recovery.

Post has been editedqpu3uk - 17.09.14, 19:49

When I said "grab the firmware" I put it wrong. I made him load the kernel and start it.
I went into the bootloader with a clamped reset, configured via "c" boot from tftp, loaded "r".

I messed up from the same bootloader also with a wedged reset by the w command.

qpu3uk,
So you have a different version of iron. try f660v3f660v3-v2.30.20p6t5.bin.zip(10.25 MB)

In fact, figs with them, with firmware,
the main task is to make him connect to the Internet through a LAN port
I also want to raise a VPN server on it (that's all I need)
and SIP functionality was present so that the phone could be connected.

Post has been editedcoqs - 17.09.14, 20:29

processor: 0
cpu model: Broadcom4350 V8.0
BogoMIPS: 359.42
wait instruction: yes
microsecond timers: yes
tlb_entries: 32
extra interrupt vector: no
hardware watchpoint: no
ASEs implemented:
shadow register sets: 1
core: 0
VCED exceptions: not available
VCEI exceptions: not available

unaligned exceptions: 20952
all that ..
hardware version V2.1
software version V2.21.20T4S
bootloader version V2.21.20

maybe he doesn’t want to install the older one, as he is trying to upgrade, but after rebooting V2.21.20T4S remains

Post has been editedqpu3uk - 17.09.14, 20:57

I have never seen such firmware ...

generally for clarity
there is v2.0 - broadcom4350 v7.0@360 MHz (firmware 2.20.20). Actually, I have one. 64 megabytes of RAM.
there is V2.1 - I don’t know what exactly differs from 2.20. But the firmware is not compatible.
There is v3 - percent Avanta @ 1 GHz (firmware 2.30) In general, another and modern device. Fast percent, 128 RAM, and wifi on realtek.

IMHO, you need to find a way to unpack - package the firmware. Here is an article about adsl 831 - there a person just wrote a compiler-decompilerhttp://robocraft.ru/blog/electronics/410.html. I lack the knowledge to do this.

Post has been edited777L - 18.09.14, 15:59

You won’t believe - now I have exactly this device on the table and I’m smoking this article exactly (while I’m reading about what JTAG is in the context of my bricked F660).
But I smoke it in a different direction:
- there CFE is almost the same
- from it I [almost] did what I wanted to do with the F660: I took the kernel from OpenWRT and loaded it on the ZTE831 [via tftp / with console cable]. Which, of course, is not supported, it knows such a percent (BCM6338), but at first it swore at the Unknown Board.
Ha, shchaz. His CFE can change the ID board to some prefedined list, it seems to put something out there with digits and buoys SV, and since we have Linux open source ;-) (and I was too lazy to assemble the toolchain and then honestly rebuild the kernel) patched the linux kernel binar from OpenWRT (after reading in the source what they generally are and which line is more convenient to patch ;-))
- and the kernel booted! Of course, it swore at the file system and the breakdown of mtd blocks and hung, respectively, as expected.

How would I do this on the F660 - happiness would be almost achievable, but the CFE Boot prevents it from slipping kernel parameters. Neither register in env, nor even temporary. For then [well, back then] I would load the kernel with tftp, and I would palm / dev / sda into it, that is, a USB flash drive.

In short, the default command line must be written to the kernel during assembly. Since 831 I had to drag the whole OpenWRT tree, now it compiles, first let it spawn a couple, and then I will generate a custom kernel. In the context of the F660, I’ll at least get a hand on this.

In my version, broadcom4350 v8.0 are different and there are two cores here

I have a question, can I change the bootloader for a start?
(How can I get it from the firmware, and flash it in telnet with yusb)
as I understand it, I have an ARM-based u-boot

Post has been editedcoqs - 18.09.14, 13:54

As far as I know, what I have is also suspicious of dual core:http: //www.broadcom.co... GPON-Solutions/BCM6818

Firmware V2.20 has the line BCM96816

Posted on 09/18/2014, 13:56:



Well, you can definitely, as my practice shows, with the w command from the bootloader from the console and with tftp.
Another thing is that if you change it wrong, then you will help me smoke jtag

Post has been editeddreadbit - 18.09.14, 13:56

on the device from mtdblock0 to mtdblock9 which one is the bootloader?
which command to use to write to this block (dd not what instead?)

Post has been editedcoqs - 18.09.14, 14:13

Do dd if = / dev / mtdblockN of = / tmp / smth
Throw off / tmp / smth somewhere on the computer, look for the CFE line in them and see what's next. The sought one will not be very big, only nvram, it seems, will be smaller.
Share the result

there is no dd in telnet, so far I have cp / dev / mtdblock0 / mnt / usb1_1
as a result, I get a file with the same IntxBLK content

Post has been editedcoqs - 18.09.14, 14:28

Rather cat // dev / mtdblock0>/ mnt / usb1_1 / file

Post has been editeddreadbit - 18.09.14, 14:28

And so it doesn’t work out how to throw dd there?

Post has been editedcoqs - 18.09.14, 14:34