GPON ZTE F660 -savagemessiahzine.com

> savagemessiahzine.com >Computers and peripherals >Internet and network equipment >Other devices and brands

42 pages
< 1 2 3 4 5 6 > »

GPON ZTE F660 | no one was friends with openwrt?

18.09.14, 14:49 | #42
●
Friendssavagemessiahzine.com
Rep: (4)

[email protected], 15:33

Rather cat // dev / mtdblock0>/ mnt / usb1_1 / file

And so it doesnвЂ™t work out how to throw dd there?

What does cat say?

18.09.14, 15:07 | #43
●
Friendssavagemessiahzine.com
Rep: (105)

[email protected], 15:49

What does cat say?

hangs for 5 minutes waiting for yusb margala unceasingly .... pulled it out, connected it, offers to format ...

18.09.14, 15:09 | #44
●
Friendssavagemessiahzine.com
Rep: (4)

[email protected], 16:07

hangs for 5 minutes waiting for yusb margala unceasingly .... pulled it out, connected it, offers to format ..

Exactly of = / mnt / usb1_1 / file.bin? Judging by the symptoms, you poured it somewhere in / dev / sda and erased the flash drive partishen map

UPD: in the sense, cat [partizhen]>/mnt/usb1_1/FILE.BIN, of course

Post has been editeddreadbit - 18.09.14, 15:10

18.09.14, 15:25 | #45
●
Friendssavagemessiahzine.com
Rep: (105)

[email protected], 16:09

UPD: in the sense, cat [partizhen]>/mnt/usb1_1/FILE.BIN, of course

ohhh, it turned out he shorter than 128MB threw it there mtdblock0
now IвЂ™m going to get some bread and continue
I donвЂ™t have CFE but u-boot found such a mention of U-Boot 2009.08 (6zh (в‚¬ 25 2013 - 08:20:02)

Post has been editedcoqs - 18.09.14, 15:30

18.09.14, 15:29 | #46
●
Friendssavagemessiahzine.com
Rep: (4)

[email protected], 16:25

ohhh, it turned out he shorter than 128MB threw it there mtdblock0

128M is a bit too much. There are only 32M flash drives in total (or am I wrong?)
Save, repeat with the rest of mtdblocks.

18.09.14, 15:59 | #47
●
Friendssavagemessiahzine.com
Rep: (28)

How would I do this on the F660 - happiness would be almost achievable, but the CFE Boot prevents it from slipping kernel parameters. Neither register in env, nor even temporary. For then [well, back then] I would load the kernel with tftp, and I would palm / dev / sda into it, that is, a USB flash drive.

those. It turns out that CFE is locked?

There are only 32M flash drives in total (or am I wrong?)

judging by the Chinese friends, there really is a 32 flash
(by the way, pictures of V3 opened by the Chinesehttp://www.chinadsl.net/thread-76008-1-1.html ) .

18.09.14, 16:01 | #48
●
Friendssavagemessiahzine.com
Rep: (4)

777L @ 09/18/2014, 16:59

those. It turns out that CFE is locked?

It turns out that CFE is stupid ;-)

Nifiga it is not locked, in one sense.

18.09.14, 16:34 | #49
●
Friendssavagemessiahzine.com
Rep: (105)

Dreadbit @ 09/18/2014, 17:01

judging by the Chinese friends, there really is a 32 flash (by the way, pictures of V3 opened by the Chinesehttp://www.chinadsl.net/thread-76008-1-1.html ) .

and in fact 128 .... how to check which team?

18.09.14, 16:36 | #50
●
Friendssavagemessiahzine.com
Rep: (4)

[email protected], 17:34

and in fact 128 .... how to check which team?

Lay other mtdblock, look at the results

18.09.14, 19:22 | #51
●
Friendssavagemessiahzine.com
Rep: (105)

[email protected], 17:36

Lay other mtdblock, look at the results

In general, such a picture emerges by blocks: block0 - 128Mb., Block1 - 2Mb.,
block2 - 4Mb., block3 - 20Mb., block4 - 4Mb., block5 - 8Mb., block6 - 20Mb., block7 - 6Mb.
(block0-mentioned about everything))))), block1-mentioned u-boot, block2-empty, block3-mentioned firmware version, block4-empty,
block5-almost empty there is something at the end, block6-the firmware version is mentioned,
block7-BootImageNum = 0x00000000, DownloadState = 0x00000003, LastBooting = 0x00000000, then empty)
block 0.3.6 - 7zip opens (and the firmware image is visible)
if compressed with zip 1 + 3 + 5 then we get approximately the size of the firmware.
Now the question is how can this whole thing be written in blocks from usb flash, without dd, in telnet?

In general, in the sum of blocks from 1 to 7 we get 64Mb, I think this is nand flash.

777L, and what version of iron do you have?

Post has been editedShoore - 16.10.14, 00:11

Reason for editing: combined

18.09.14, 20:45 | #52
●
Friendssavagemessiahzine.com
Rep: (28)

It turns out that CFE is dumb

then picking it without a working jtag is fraught ...
I will dig further.

coqs , 2.0 :(

By the way, instead of dd, we have an interesting utility mtd_debug
try (if you have it on v3)

/ usr / bin # mtd_debug info / dev / mtd0
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 16384 (16K)
mtd.erasesize = 16384 (16K)
mtd.oobblock = 512
mtd.oobsize = 16
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ usr / bin # mtd_debug info / dev / mtd1
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 14663680 (13M)
mtd.erasesize = 16384 (16K)
mtd.oobblock = 512
mtd.oobsize = 16
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ usr / bin # mtd_debug info / dev / mtd2
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 14663680 (13M)
mtd.erasesize = 16384 (16K)
mtd.oobblock = 512
mtd.oobsize = 16
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ usr / bin # mtd_debug info / dev / mtd3
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 1048576 (1M)
mtd.erasesize = 16384 (16K)
mtd.oobblock = 512
mtd.oobsize = 16
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ usr / bin # mtd_debug info / dev / mtd4
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 2097152 (2M)
mtd.erasesize = 16384 (16K)
mtd.oobblock = 512
mtd.oobsize = 16
mtd.ecctype = (unknown ECC type - new MTD API maybe?)

By the way - when do you have a modem? I want to buy v3 too, I'm afraid to run into v2 - outwardly you cannot distinguish them

Post has been edited777L - 18.09.14, 21:05

18.09.14, 21:06 | #53
●
Friendssavagemessiahzine.com
Rep: (105)

777L @ 09/18/2014, 9:45 PM

By the way, instead of dd, we have an interesting utility mtd_debug try (if you have it on v3)

Something like this .... basically everything converges.
How to record something using this utility?
And I understood everything, I apologize write)))

/ # mtd_debug info / dev / mtd0
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 134217728 (128M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 2048 (2K)
mtd.oobsize = 64
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ # mtd_debug info / dev / mtd1
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 2097152 (2M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 2048 (2K)
mtd.oobsize = 64
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ # mtd_debug info / dev / mtd2
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 4194304 (4M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 2048 (2K)
mtd.oobsize = 64
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ # mtd_debug info / dev / mtd3
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 20971520 (20M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 2048 (2K)
mtd.oobsize = 64
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ # mtd_debug info / dev / mtd4
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 4194304 (4M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 2048 (2K)
mtd.oobsize = 64
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ # mtd_debug info / dev / mtd5
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 8388608 (8M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 2048 (2K)
mtd.oobsize = 64
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ # mtd_debug info / dev / mtd6
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 20971520 (20M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 2048 (2K)
mtd.oobsize = 64
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

/ # mtd_debug info / dev / mtd7
mtd.type = MTD_NANDFLASH
mtd.flags =
mtd.size = 6291456 (6M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 2048 (2K)
mtd.oobsize = 64
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

Post has been editedcoqs - 18.09.14, 21:12

18.09.14, 21:11 | #54
●
Friendssavagemessiahzine.com
Rep: (28)

mtd_debug write<device><offset><len><source-filename>

another question is how to edit something ..

Post has been edited777L - 18.09.14, 21:12

18.09.14, 21:16 | #55
●
Friendssavagemessiahzine.com
Rep: (105)

I have a file system mounted rw
you can change and do image
I canвЂ™t connect it to the Internet ..... both from the lan port
make wan. I'm trying to make contact with the Chinese,
maybe theyвЂ™ll send the latest firmware, but on the other hand thereвЂ™s a device
on the same open source process only without optics
Actiontec mi424wr revIhttps://wikidevi.com/w...ctiontec_MI424WR_rev_I

/ # cat / proc / mounts
rootfs / rootfs rw 0 0
proc / proc proc rw 0 0
sysfs / sys sysfs rw 0 0
devpts / dev / pts devpts rw 0 0
/ dev / mtdblock2 / tagparam jffs2 rw 0 0
tmpfs / var tmpfs rw 0 0
/ dev / mtdblock5 / userconfig jffs2 rw 0 0
none / proc / bus / usb usbfs rw 0 0

Post has been editedcoqs - 18.09.14, 21:28

18.09.14, 21:19 | #56
●
Friendssavagemessiahzine.com
Rep: (28)

I have a file system mounted rw

only now does not allow to edit anything from the system.
I personally need to add a script to startup:
that's what i get in return

/ bin / sh: cannot create rcS: Read-only file system

how to make lan from wan port

on the contrary, you wanted to say?
if you tell me where dhcp and pppoe client live there, then everything is solved. It will only work until the first reboot.

Post has been edited777L - 18.09.14, 21:29

18.09.14, 21:24 | #57
●
Friendssavagemessiahzine.com
Rep: (105)

777L @ 09/18/2014, 10:19

only now does not allow to edit anything from the system.

and what needs to be edited, by the way, what editor is there?
I also need a script, but I have not yet decided which
and how to edit there in general)
And where should these clients usually be? (Maybe this is / bin / dhcpc and / bin / pppd?)

Post has been editedcoqs - 06.06.15, 17:08

18.09.14, 21:35 | #58
●
Friendssavagemessiahzine.com
Rep: (28)

and what needs to be edited, by the way what editor is there?

hmm .. no .. you can use the cat and echo commands.
You can copy it to a USB flash drive, there you can redo it and copy it back to the device.
It just wonвЂ™t work, because read only file system. And for this we need deeper research .. I hope thatdreadbit get jtag to collect

block 0.3.6 - 7zip opens (and the firmware image is visible)

hmm .. but the firmware image is in what format? open something?

And where should these clients usually be? (Maybe this is / bin / dhcpc and / bin / pppd?)

itвЂ™s like itвЂ™s true, though it doesnвЂ™t want to force something on dhcp
I understand which file it reads

Post has been edited777L - 18.09.14, 21:45

18.09.14, 21:45 | #59
●
Friendssavagemessiahzine.com
Rep: (105)

777L @ 09/18/2014, 10:35 PM

hmm .. but the firmware image is in what format? open something?

Post has been editedcoqs - 18.09.14, 21:47

18.09.14, 21:49 | #60
●
Friendssavagemessiahzine.com
Rep: (4)

Removed from his working MGTSnogo mtdblocks.
It is V4.1 (like the one I messed up, the quote is ".F660v4.1 .... error! Wrong board !! You may upgrade (6818) F660v4 version on new Board (6818C0)."); That is, 2.2 firmware should eat.
mtdblock0 16384, similar to nvram
mtdblock1 14320K, it looks like CFE (incl micro_httpd), but not 14M? The tail clearly contains something compounded.
mtdblock2 14320K, there is also something similar, but the files are different
mtdblock3 == mtdblock4 1048576, contains something like "BootImageNum = 0
DownloadState = 3
LastBooting = 0
IsOmciUpgrading = 0 "

In short, nothing is clear to me by the results.

The device that I screwed up behaves strangely. On the 1st and 2nd internet, he has a carrier and he blinks an LED if there is activity, on 3 and 4 - no. It also lights up with a WPS light. Somehow it does not look like a completely killed CFE, maybe it's a killed nvram?

About reset type 30-30-30 I know that does not help.

You will find the PDFs from BCM6818 (but it seems that it is not needed and do you need to flash a flash drive?), As well as from the 17th and 16th.

FLASH has NAND (which is read by sectors, not ROM), do I understand correctly that there should be something that forces it to be read first in RAM, then run it?

UPD: By the way, a smart article about JTAGing of a similar device:http: // huaweihg612hack ... roadcom-bcm6368-hg612 /on BCM6368, there is also NAND flash

777L @ 09/18/2014, 10:35 PM

You can copy it to a USB flash drive, there you can redo it and copy it back to the device.
It just wonвЂ™t work, because read only file system. And for this we need deeper research .. I hope that dreadbit will be able to collect jtag

In general, jtag will not help here at all. As in the article about ZTE831 there it is necessary to tear squashfs, and then assemble it back.

Post has been editedShoore - 16.10.14, 00:13

Reason for editing: combined

18.09.14, 22:13 | #61
●
Friendssavagemessiahzine.com
Rep: (105)

777L,
in the / etc / folder, I can do whatever I want .... (within>64Mb)
only in the / proc / folder not everything is allowed

Post has been editedcoqs - 18.09.14, 22:14

42 pages
< 1 2 3 4 5 6 > »

Full version

Help rules

Now: 09/14/19, 18:21

©savagemessiahzine.com2005-2019. All rights reserved.
savagemessiahzine.com^®- registered trademark.
Terms of Use | Denial of responsibility | Advertising placement

Forum IP.Board © 2019 IPS, Inc .