高兴得要哭了！！！！研究了N天，终于把我的华为 光猫救回来了
本帖最后由 qqppav520 于 2017-1-22 18:02 编辑你妹的，救砖回来过后web设置页面空白，应该是以前改E8C界面造成的。无法用cd等一些重要命令。
又再经历两次刷砖以后这次是终于真正的救回来了！！！！！！！！！！下图
下贴是HG8240 改配置后 TTL线下 猫的情况！！TTL线下任何按键 命令 均无法中断启动
telnet: can't connect to remote host (127.0.0.1): Connection refused
停在这里反复连接这个地址失败一直重复
https://www.chinadsl.net/forum.ph ... d&tid=128424&extra=
经过N天坚持不解的研究，终于救回来了。救砖过程如下
可能你们打死也猜不到我是怎么中断启动的
/*..............
System start ...
.............*/
收←◆
U-Boot 1.1.4 (Jul 31 2013 - 16:25:21)
U-Boot code: 90500000 -> 9051FC94BSS: -> 9054658C
RAM Configuration:
Bank #0: 90000000 64 MB
Flash: 16 MB
*** Warning - bad CRC, using default environment
收←◆In: serial
Out: serial
Err: serial
收←◆
Extend LSW IS AR8316
Initialize broadcast table ... ok
CPURTx Driver For Pilot <Board-A>!
收←◆### JFFS2 loading 'fsok' to 0x904bfe84
Scanning JFFS2 FS: .
收←◆|
收←◆/
收←◆-
收←◆\
收←◆|
收←◆Unknown node type: e002 len 149 offset 0x163f38
收←◆Unknown node type: e001 len 44 offset 0x171048
收←◆ done.
find_inode failed for name=fsok
load: Failed to find inode
### JFFS2 LOAD ERROR<0> for fsok!
No fsok file!
Scanning JFFS2 FS: Unknown node type: e001 len 55 offset 0x2aa8
Unknown node type: e002 len 89 offset 0x4b58
Unknown node type: e002 len 566 offset 0x6de8
Unknown node type: e002 len 645 offset 0x7020
收←◆.
收←◆Unknown node type: e002 len 923 offset 0x2f128
收←◆|
收←◆/
收←◆-
收←◆Unknown node type: e002 len 69 offset 0xe0168
Unknown node type: e002 len 87 offset 0xe01f8
Unknown node type: e001 len 45 offset 0xe0298
Unknown node type: e002 len 70 offset 0xe02c8
收←◆\
收←◆|
收←◆ done.
No board type file!
ui_board_id = 2
::Magic1:0x5a5a5a5a, magic2 0xa5a5a5a5, count 2, flag 0, MainAreaOK 0, slaveAreaOK 0
Start from normal system!
Magic1:0x5a5a5a5a, magic2 0xa5a5a5a5, count 3, flag 0
Kernel VER:VhwhwhwhC00SPC12PC12PC12 do not match FS VER:whwhwhwhC00SPC12PC12PC12, start from minisystem!Addr:0x0,Addr:0x40000,Addr:0x41000,Addr:0x60000,Addr:0x1e0000,Addr:0xae0000,Addr:0xe60000
BootArgs:noalign mem=50M console=ttyAMA0,115200 root=/dev/mtdblock6 rootfstype=squashfs mtdparts=hisilicon:0x40000(boot)ro,0x1000(flashcfg)ro,0x1f000(syspara)ro,0x180000(krnl)ro,0x8fffac@0x1e0054(rootfs)ro,0x248fe0@0xc17020(minisystem)ro,0x180000(jffs2cfg),-(reserved) user_debug=0x1f panic=1
收←◆Bootcmd:bootm 0x20ae0054
U-boot Start from NORMAL Mode !
## Booting image at 20ae0054 ...
Bad Magic Number
hisilicon #
hisilicon #
收←◆h
收←◆e
收←◆l
收←◆p
收←◆
? - alias for 'help'
base - print or set address offset
bdinfo- print Board Info structure
bootm - boot application image from memory
crc32 - checksum calculation
echo - echo args to console
erase - erase FLASH memory
flinfo- print FLASH memory information
fsinfo - print information about filesystems
fsload - load binary file from a filesystem image
help - print online help
lastword- print last word
loadboardinfo- download file from tftp server
loadflashcfg- download file from tftp server
loadfs- download file system from tftp server
loadjffs2- download file from tftp server
loadkernel- download file from tftp server
loadminisystem- download file from tftp server
loadsystem- download file from tftp server
loaduboot- download file from tftp server
loop - infinite loop on address range
ls - list files in a directory (default /)
md - memory display
mtest - simple RAM test
mw - memory write (fill)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv- set environment variables
tftp - download or upload image via network using TFTP protocol
vdecrest- vdecrest
vencrest- vencrest
version - print monitor version
hisilicon #
收←◆v
收←◆e
收←◆r
收←◆s
收←◆i
收←◆o
收←◆n
收←◆
U-Boot 1.1.4 (Jul 31 2013 - 16:25:21)
hisilicon #
收←◆p
收←◆r
收←◆i
收←◆n
收←◆t
收←◆e
收←◆n
收←◆v
收←◆
bootdelay=1
baudrate=115200
ethaddr=00:00:00:00:00:02
ipaddr=192.168.0.10
serverip=192.168.0.1
netmask=255.255.255.0
bootfile="Image"
stdin=serial
stdout=serial
stderr=serial
verify=n
bootargs=noalign mem=50M console=ttyAMA0,115200 root=/dev/mtdblock6 rootfstype=squashfs mtdparts=hisilicon:0x40000(boot)ro,0x1000(flashcfg)ro,0x1f000(syspara)ro,0x180000(krnl)ro,0x8fffac@0x1e0054(rootfs)ro,0x248fe0@0xc17020(minisystem)ro,0x180000(jffs2cfg),-(reserved) user_debug=0x1f panic=1
bootcmd=bootm 0x20ae0054
Environment size: 502/131068 bytes
hisilicon #
收←◆s
收←◆e
收←◆t
收←◆e
收←◆n
收←◆v
收←◆
收←◆s
收←◆e
收←◆r
收←◆v
收←◆e
收←◆r
收←◆i
收←◆p
收←◆
收←◆1
收←◆9
收←◆2
收←◆.
收←◆1
收←◆6
收←◆8
收←◆.
收←◆1
收←◆.
收←◆9
收←◆9
收←◆
收←◆hisilicon #
收←◆s
收←◆e
收←◆r
收←◆
收←◆
Usage:
setenv- set environment variables
hisilicon #
收←◆s
收←◆e
收←◆t
收←◆e
收←◆n
收←◆v
收←◆
收←◆i
收←◆p
收←◆a
收←◆d
收←◆d
收←◆r
收←◆
收←◆1
收←◆9
收←◆2
收←◆.
收←◆1
收←◆6
收←◆8
收←◆.
收←◆1
收←◆.
收←◆1
收←◆
hisilicon #
收←◆s
收←◆a
收←◆v
收←◆e
收←◆e
收←◆n
收←◆v
收←◆
Saving Environment to Flash...
Un-Protected 1 sectors
Erasing Flash... <Erase 00%>
收←◆%100 Erased 1 sectors
Writing to Flash... start_sect:1, end_sect:1, addr:0x20020000, cnt:131072, src:0x904c0008
start addr:0x20020000, end addr:0x20040000
收←◆ <Erase 00%>
收←◆%100 <Write 00%>010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899 100%> done
Protected 1 sectors
hisilicon #
收←◆p
收←◆r
收←◆i
收←◆n
收←◆t
收←◆e
收←◆n
收←◆v
收←◆
bootdelay=1
baudrate=115200
ethaddr=00:00:00:00:00:02
netmask=255.255.255.0
bootfile="Image"
stdin=serial
stdout=serial
stderr=serial
verify=n
bootargs=noalign mem=50M console=ttyAMA0,115200 root=/dev/mtdblock6 rootfstype=squashfs mtdparts=hisilicon:0x40000(boot)ro,0x1000(flashcfg)ro,0x1f000(syspara)ro,0x180000(krnl)ro,0x8fffac@0x1e0054(rootfs)ro,0x248fe0@0xc17020(minisystem)ro,0x180000(jffs2cfg),-(reserved) user_debug=0x1f panic=1
bootcmd=bootm 0x20ae0054
serverip=192.168.1.99
ipaddr=192.168.1.1
Environment size: 502/131068 bytes
hisilicon #
收←◆p
收←◆i
收←◆n
收←◆g
收←◆
收←◆1
收←◆9
收←◆2
收←◆.
收←◆1
收←◆6
收←◆8
收←◆.
收←◆1
收←◆.
收←◆9
收←◆9
收←◆
host 192.168.1.12 is alive
hisilicon #
收←◆l
收←◆o
收←◆a
收←◆d
收←◆j
收←◆f
收←◆f
收←◆s
收←◆2
收←◆
Please input the file name(rootfs.1.jffs2):
收←◆h
收←◆w
收←◆_
收←◆b
收←◆o
收←◆a
收←◆r
收←◆d
收←◆i
收←◆n
收←◆f
收←◆o
收←◆.
收←◆x
收←◆m
收←◆l
收←◆Start to load file to by
TFTP from server 192.168.1.12; our IP address is 192.168.1.1
Download Filename 'hw_boardinfo.xml'.
Download to address: 0x90a00000
Downloading: *%
收←◆
0.000 MB download ok.
Bytes transferred = 790 (316 hex)
收←◆Download file with byte(s) succeed.
Start to erase jffs FS from 0x20e60000, len +0x180000
<Erase 00%>
收←◆%08
收←◆%16
收←◆%25
收←◆%33
收←◆%41
收←◆%50
收←◆%58
收←◆%66
收←◆%75
收←◆%83
收←◆%91
收←◆%100 Erased 12 sectors
Start to write data from to with byte(s)
Copy to Flash... start_sect:115, end_sect:115, addr:0x20e60000, cnt:790, src:0x90a00000
start addr:0x20e60000, end addr:0x20e80000
收←◆ <Erase 00%>
收←◆%100 <Write 00%>010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899 100%> done
hisilicon #
上传未修改备份的hw_boardinfo.xml 文件后
命令用完，重启那熟的红灯又开始闪烁了~！救砖成功
我就是死马当成活马医，用镊子把内存芯片弄短路（按住其中两只脚就行了，可以从TLL信息看出来短路对了没）。让系统认为芯片坏了，强制自己中断而启动华为的 U-boot也就是hisilicon # 命令
就这么简单！ TTL不能中断的可以用我的方法，当然芯片烧坏不负责哈
linuxoa 发表于 2017-1-22 11:39
这个很好！ 关心是将内存闪存芯片哪两只脚短路掉才能起作用。
这个我真忘了，反正各种尝试，好像是芯片左边，有蓝点那一面有两只脚行 lq2001 发表于 2017-1-22 09:22
8240，8245两版的固件都有全的shell哇，
重刷个固件试试
没找着，昨晚刷了个低版本的，又刷死了，费了好大劲才又救回来了
不敢乱刷包了，再刷死不知道救不救得回来了 FLASH短接这个好像是万能法,短接数据脚来的; 短接FLASH数据脚是万能大法,不过得是数据脚来的; lq2001 发表于 2017-1-22 00:09
短接FLASH数据脚是万能大法,不过得是数据脚来的;
关键是救回来了，web页登陆后无显示又得再继续研究了 qqppav520 发表于 2017-1-22 00:37
关键是救回来了，web页登陆后无显示又得再继续研究了
telnet 192.168.1.1
root
admin
shell
cd mnt/jffs2
boardtype.sh -c
reboot mayi5147 发表于 2017-1-22 00:47
telnet 192.168.1.1
root
无法用CD等一系列命令 qqppav520 发表于 2017-1-22 01:41
无法用CD等一系列命令
8240，8245两版的固件都有全的shell哇，
重刷个固件试试 这个很好！ 关心是将内存闪存芯片哪两只脚短路掉才能起作用。