Firmware and repair of Hame-A1, A15 and its clones on the RT5350 Chip | [firmware] How to flash, how to flash, how to get back to "life"



Rep: (398)
Firmware and ways to restore the Hame-A1, A5, A15 and its clones on the RT5350 chip

Discussion | Firmware repair |FAQ


The presented firmware of well-known brands, are purely informational and informative.
After reading them, it is strongly recommended to remove them from their devices, so as not to violate anyone's rights!


Attention! All actions with devices, you perform at your own peril and risk!
Keep in mind that if the firmware is unsuccessful or unpredictable architectural features
Your device, you can get a "Brick", which will be hard to restore !!!


Here will be posted firmware compatible with the specified routers,
Please follow the pattern structure!


Firmware for routers with 32 MB of memory
1. Upvel 312 N4G
VEB Interface

Attached Image
Attached Image

Description: A unique firmware! We can say one of the best ... The main advantages are the Russian VEB interface, support for modern modems, even Highlink, USB printers, and USB flash drives via FTP !. Built-in full-fledged terminal (analogue of Telnet).
LAN IP - 192.168.10.1
Username / Password - admin / admin
Wi-Fi password - Upvel123
Full - telnet
Command available - mtd_write
He sees the USB flash drive - / media / sda1
Booth supports TFTP - IP address on the computer 192.168.1.55
Works with Bout Booth
FullFlash for Programmer -Download
Firmware -Download


Zyuksel firmware - Kinetics -HAME MPR-A1 - Discussion (Fast sadykovildar # 36362053)
2. OpenWRT based firmware


Firmware for routers with 16 MB of memory -Experimentally, I do not have such, but the memory parameters correspond
1. SENSEIT R2 aka Megaphone R1
VEB interface

Attached Image
Attached Image

Description: Booth with TFTP support
FullFlash for Programmer -Download
Firmware -Download
Password and login on VEB -admin
WEPI -7c3ba188
FullFlash without a password for wifi -Download


Post has been editedPukinDukin - 13.06.19, 14:29



Rep: (398)
There will be everything related to the firmware technology of such routers.

A bit of theory:
Change and methods of firmware router depend on the factory loader! Different manufacturers of routers refer to this function in their own way. Some completely block this possibility, forcing you to use only their firmware. Some vice versa make it possible to change the firmware without any problems. Some leave a small “loophole” that can be used. So let's try to figure it out:
1. First of all, we try to “slip” a “foreign” firmware to the router through its VEB interface, in the firmware update section. If everything went well, you were incredibly lucky!
1.1. If it does not accept a “foreign” firmware, we search on the Internet forwards, reworked, patched, transitional firmware (if any) and again try to flash the router through VEB. ---------- In the editing stage ---------

Various ways to flash (kill) a router:
1. Stitching through the VEB interface

2. We are stitching with the help of a local VEB server
Actually download a simple VEB server -Download
We connect the router to the computer, wait for the full download and connect to it through the Telnet.
We start VEB server, we answer all questions in the affirmative. The address bar of the server should appear
SP from the range of your router. For example, the IP router 192.168.100.1, the VEB server 192.168.100. **.
If your computer has two network cards and the address in the server is in a different range, for example 192.168.0. **,
then it must be switched in the program settings - Menu - IP adress

Now go to the fun!
In Telnet we type the commands:
free - free memory should be at least 1Mb! If this is not the case, perform sequentially -
killall -9 syslogd
killall -9 nvram_daemon
killall -9 goahead

Recheck the available memory with the familiar command -free
If everything is OK, continue -
cd / tmp
cat / proc / mtd - in response, you should get something like that -
dev: size erasesize name
mtd0: 00400000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 003b0000 00010000 "Kernel"
This is the name of the sections of the router that we will flash. If there is an ALL section, you're in luck!
You can flash FullFlash immediately into the router (firmware along with the bootloader, merged with either the programmer or Telnet)
To do this, drag the FullFlash you need to the left window with the mouseVEB server (where the house is drawn)
Click once on the dragged file, the full path should be displayed in the address bar -
eg, "http: //192.168.100.**/Full_SWrt_B_3.0.bin"and copy this address to the clipboard.
In Telenet we recruit the following command -
wgethttp: //192.168.100.**/Full_SWrt_B_3.0.bin - we observe file transfer process ...
ls - check that the file is already in the router
mtd_write write /tmp/Full_SWrt_B_3.0.bin ALL - we observe the process of firmware, at the end we give the command -
reboot
The router is overloaded - you are a happy owner of a new firmware and bootloader!
If it is necessary to flash Boot and firmware separately, we do it by analogy, only the fileButa flashing in Bootloader
butKernel firmware . If your sections of the router are called differently - we choose it by experience.

P.S. commands are highlighted in bold text to avoid possible typing errors - use the clipboard,
IP addresses and file names substitute your own.

Firmware for Hame-A1, Hame-A15 router and its clones with Qualk interface
Micromax MMX 440W router firmware on RT5350 chip and 32 MB memory
How to flash router Upvel UR-312N4G
Installing Modified OpenWRT on ZyXel keenetic 4g ver. b
Firmware of the Chinese clone Nama on Chip RT5350f and 32 MB memory, with white-blue interface

Post has been editedPukinDukin - 04.07.17, 16:58



Rep: (398)
There will be everything related to the recovery technology of such routers.


All topics are open for review and content - welcome !!!
In order not to litter them, please discuss the discussion in the section -Discussion

Instructions for restoring the "killed" Hame A1 through "China Prog"
For those who do not start the "China Prog" under Win 7-10, for restoring devices
Homemade programmer
Not expensive industrial programmer with instructions!
Restore a router via UART (with live loader)
Recovery of A5-V11 router via UART (TTL) with live loader

Post has been editedPukinDukin - 20.06.17, 15:25



Rep: (1)
PukinDukin @ 01/12/17, 11:36*
MAC is there native, which was on the router. Where is he in Damp I do not know, nor when I did not bother with his replacement.

From the spoiler Upvel 312 N4G.
With the help of the laid out dump and programmer, I returned my MIFI 3G from the "other world". And I got confused with the MAC. Maybe someone will come in handy, poppy is at offset 040004. (poppy dump in header 2C: 67: FB: D3: D0: D6)

Post has been editedPukinDukin - 28.03.17, 10:42



Rep: (24)
I suppose that it’s more logical to put in this topic once the UPVEL is already touched upon

I have been using UR313N4G for a long time on the same platform.
For a budget router, it's quite possible! including
built-in FTP sharing SD card from modem.
And the program for this model in contrast to the UR312N4G is enough
regularly updated, latest prosh from Febr-2017!
it would be interesting if someone thread can port it for clones
c disabling unused ports all the same, this firmware
to the five-port model on the RT5350F with a USB port

Attached files

Attached fileUR313N4Gv110.19_080217.zip(3.31 MB)


Post has been editedalexb_spb - 26.02.17, 10:19



Rep: (24)
Since this topic is about firmware compatible with clones and suitable for their restoration, I will post the firmware from DiR506L A2 which is a more famous clone
HAME A2 with 8 meter flash drive and 32 meter RAM. flashing on the functionality almost completely repeats everything that is in HAME A2 including the media browser (storage tab), the WiFi client'om can work. With modems the same story as on the original HAMA firmware. The modem card reader does not recognize this firmware. Telnet is not available and how to open the 23rd port is not clear, in general, who can fit to restore A2, slip the Chinese onetouch flasher

Attached files

Attached fileDIR506L_V2_15b08.zip(6.3 MB)


Post has been editedalexb_spb - 26.02.17, 10:16



Rep: (24)
DiR 506 is not sewn either on oWRT or in UPVEL. Through the web in the regular update mode, the Appel firmware does not even load (the file does not go through in size) the transient smartWRT tries to skip, but crashes with an error message. TFTP access in normal mode NO. when booting with the reset button pressed in emergency recovery mode, DHCP is working, the router's address is 192.168.123.254 — accessible via TFTP and via WEB — but it doesn't give anything third-party firmware. This program hangs so it’s not stitching anything. something went wrong with the bootloader by doing the DliNk campaign by making very serious protection against * the curves * of the hands. So there was neither a DiR300 nor a DiR320 NRU. I will look and try other transitional images for RT5350 on English-language resources on open WRT

Post has been editedalexb_spb - 04.03.17, 00:26



Rep: (0)
With this (HAME MPR-A1 - Discussionloader from WErt (WErt), firmware upwel312 will work?



Rep: (169)
* jwoleg4, Works, checked personally. Wonderful firmware I will say. Put from 312 in the workshop in the old holes 300 B7 was surprised that all lan ports are working, I thought there will be only two.

Post has been editedextozi - 26.03.17, 14:23



Rep: (15)
I ask for help, I have Chinese HAME on the RT5350 Chip
the interface was kvalkomovsky
killed by flashing, not by me, there is a USB-UART on the CH340 chip

Attached Image


I can not fill the boot via tftp or through serial
Buta files tried different, can there be verified?
and yes, if I pour the firmware 32 megabytes?
log

U-Boot 1.1.3 (Jul 8 2013 - 10:13:26)

Board: Ralink APSoC DRAM: 32 MB
relocate_code Pointer at: 81fb4000
spi_wait_nsec: 42
spi device id: c2 20 16 c2 20 (2016c220)
find flash: MX25L3205D
raspi_read: from: 30000 len: 1000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 3.6.0.0
--------------------------------------------
ASIC 5350_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: SDRAM
DRAM_SIZE: 256 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 32 MBytes
Flash component: SPI Flash
Date: Jul 8, 2013 Time: 10: 13: 26
============================================
icache: sets: 256, ways: 4, linesz: 32, total: 32768
dcache: sets: 128, ways: 4, linesz: 32, total: 16384

##### The CPU freq = 360 MHZ ####
estimate memory size = 32 Mbytes

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
unenter reset button ...


You choosed 7

0
raspi_read: from: 40028 len: 6
.

7: System Load Boot Loader then write to Flash via Serial.
## Ready for binary (kermit) download to 0x80100000 at 57600 bps ...
# ЕЎN +(here I am sending the boot.img file)
## Total Size = 0x00000000 = 0 Bytes
## Start Addr = 0x80100000
raspi_erase_write: offs: 0, count: 0
Done!

U-Boot 1.1.3 (Jul 8 2013 - 10:13:26)

Board: Ralink APSoC DRAM: 32 MB
relocate_code Pointer at: 81fb4000
******************************
Software system reset occurred
******************************
spi_wait_nsec: 42
spi device id: c2 20 16 c2 20 (2016c220)
find flash: MX25L3205D
raspi_read: from: 30000 len: 1000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 3.6.0.0
--------------------------------------------
ASIC 5350_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: SDRAM
DRAM_SIZE: 256 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 32 MBytes
Flash component: SPI Flash
Date: Jul 8, 2013 Time: 10: 13: 26
============================================
icache: sets: 256, ways: 4, linesz: 32, total: 32768
dcache: sets: 128, ways: 4, linesz: 32, total: 16384

##### The CPU freq = 360 MHZ ####
estimate memory size = 32 Mbytes

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
unenter reset button ...


You choosed 3

0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from: 50000 len: 40
.Bad illegal image!


Post has been editeddks9 - 04.04.17, 09:01



Rep: (398)
* dks9,
Boots -
HAME MPR-A1 - Discussion (Post Den4al # 48360323)
HAME MPR-A1 - Discussion (Post WErt (WErt) # 49686809)

Firmware for 32 MB.



Rep: (15)
Unfortunately does not pass: (
I think the converter UART
at home there are two more, on PL2303 and CP2102
but at home I will be only on Friday, then I'll check
here is the log with uboot_usb_256_03.img

I also tried uboot_usb_128_03.img, but there is no effect, but I’m looking at the memory to decrease.

U-Boot 1.1.3 (Jul 8 2013 - 10:13:26)

Board: Ralink APSoC DRAM: 16 MB
relocate_code Pointer at: 80fb4000
spi_wait_nsec: 42
spi device id: c2 20 16 c2 20 (2016c220)
find flash: MX25L3205D
raspi_read: from: 30000 len: 1000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 3.6.0.0
--------------------------------------------
ASIC 5350_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: SDRAM
DRAM_SIZE: 128 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 16 MBytes
Flash component: SPI Flash
Date: Jul 8, 2013 Time: 10: 13: 26
============================================
icache: sets: 256, ways: 4, linesz: 32, total: 32768
dcache: sets: 128, ways: 4, linesz: 32, total: 16384

##### The CPU freq = 360 MHZ ####
estimate memory size = 16 Mbytes

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
unenter reset button ...


You choosed 7

0
raspi_read: from: 40028 len: 6
.

7: System Load Boot Loader then write to Flash via Serial.
## Ready for binary (kermit) download to 0x80100000 at 57600 bps ...
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
# N3
## Total Size = 0x00000000 = 0 Bytes
## Start Addr = 0x80100000
raspi_erase_write: offs: 0, count: 0
Done!

U-Boot 1.1.3 (Jul 8 2013 - 10:13:26)

Board: Ralink APSoC DRAM: 16 MB
relocate_code Pointer at: 80fb4000
******************************
Software system reset occurred
******************************
spi_wait_nsec: 42
spi device id: c2 20 16 c2 20 (2016c220)
find flash: MX25L3205D
raspi_read: from: 30000 len: 1000
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 3.6.0.0
--------------------------------------------
ASIC 5350_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: SDRAM
DRAM_SIZE: 128 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 16 MBytes
Flash component: SPI Flash
Date: Jul 8, 2013 Time: 10: 13: 26
============================================
icache: sets: 256, ways: 4, linesz: 32, total: 32768
dcache: sets: 128, ways: 4, linesz: 32, total: 16384

##### The CPU freq = 360 MHZ ####
estimate memory size = 16 Mbytes

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
unenter reset button ...


You choosed 3

0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from: 50000 len: 40
.Bad illegal image!


Post has been editeddks9 - 04.04.17, 12:04



Rep: (398)
* dks9,
Have you ever poured Serial Booth before? What terminal do you use?



Rep: (15)
terminal (https://sites.google.com/site/terminalbpp/ )
Huper Terminal slows down a lot, but Putty can't Send file

All the question is removed, TX came off,
(in the sense of while stitching, fell off)
will lie until the programmer arrives, I'll fill in a full flash

Post has been editeddks9 - 04.04.17, 17:39



Rep: (452)
* dks9,
CH340 shit is full.
Memory less due to uart 5 volts. In bootstrap mode pushes the chip



Rep: (1)
Help to flash the router. Qualcomm interface. Memory M12L2561616A

Attached images
Attached Image
Attached Image



Rep: (398)
* Edis
HAME MPR-A1 - Discussion (Post PukinDukin # 44734190)



Rep: (41)
OpenWRT Chaos Calmer 15/05/1 for A5-V11 with 16 MB flash drive
Pure OpenWRT + luci unchanged, without add-ons, non-GMO for A5-V11 with a 16MB re-spi flash
I tried unsuccessfully to find an assembly for a large flash without additional changes, I had to assemble myself.
Attached fileopenwrt-ramips-rt305x-a5-v11-squashfs-sysupgrade.zip(3.17 MB)



Rep: (398)
* tmr
Looking bad -
Modified OpenWRT firmware for Hame-A1, A15 and its clones (Post PukinDukin # 45137099)



Rep: (41)
This is some kind of regular house with pre-installed packages, but not normal - bare OpenWrt



Rep: (398)
* tmr
And who needs a naked VRT, some kmod packages will not be installed on it due to a kernel version conflict!


Full version    

Help     rules

Now: 07.21.19, 19:20