1.准备TFE.bin和/128K 重组的固件
brfwmod -decomp -i EU_DSL-2740B_2.73b246CFE.bin
2. 改所有展开文件的名字，并备份一个CFE.bin
copy cfe.bin tfe.bin
3.ultraedit编辑tag.bin ,0x8a处改成ASC “1”
4，完成重组
brfwmod -comp /m:2 /128K -o new273.bin
5. 拷贝brjtag.exe到重组固件的存放目录
=======================================================
1.开电，brjtag -erase:wholeflash /unppb， 完成后关电
2. 开电， brjtag -flash:tfe烧入刚才得到的TFE.BIN
3. 关电，上TTL线, 启动超级终端，电脑网线连在猫上，开电
4. 超级终端按空格进CFE> ,执行"e a" "y" 清楚整个flash
5. "e a" 完成后设备重启，终端上及时按空格进CFE>
6, IE访问CFE下载界面 htt://192.168.1.1
7, 下载new273.bin, 观察终端把固件烧在be020000
8. 在下载完成之后设备备重启，终端上及时按空格进CFE>
9. IE访问CFE下载界面 htt://192.168.1.1
10, 再次下载new273.bin, 观察终端把固件烧在be800000
11. 在下载完成之后设备备重启，恢复成功
终端的完整log 刚才打了一大半的消息,没有输入完,没有发出消息,有个朋友来了,离开了40分钟这样,结果消息发送失败.
谢谢你写的恢复步骤,我现在正在用最慢的办法做一次测试(直接写入WHOLEFLASH).估计要到下午4:00可以完成. 昨夜,我试过2.73 ,3.04,2.61,RG100A-AA的固件,全部都是用128K处理过了的.除2.61可以启动并引导外,其余的,都是在CFE启动后,初始化FLASH分区分配的时候死在那里了.
不过,我试刷第一分固件的时候是用0的标志,来不及用1的标志试(没有机会,因为0的标志都没有启动).我贴个图出来.
等到4点钟后,再按你92楼所讲的再做一遍.看看结果如何...这个就是前些天,我全部用128K 及 0 或1 重新打包的固件.
下面是昨夜一直在试刷的LOG记录文件.RG100A-AA CFE 到初始化分区的时候就停下,还没有能看得到提示按键终止.
[ 本帖最后由 天涯 于 2008-12-7 05:21 编辑 ] C:\rg100av12\261>brfwmod -comp -o 2.61-cfe-128k-1.bin /M:2 /128K
===============================================================
Broadcom Chip ADSL FW Image De/Compress Utility v1.5-hugebird
===============================================================
Warning!...Source TAG Checksum not match, but build continue...
============decoding Tag information===================
Tag Ver signature = '6'
SIG1(comany info) = 'Broadcom Corporatio'
SIG2(FW version) = '3.10.02.EU'
chip ID = '6358'
board ID = '96358GW'
FW endianess = Big Endian
=======================================================
->Start packing a new image
->CFE will load at 0xBFC00000, length 0x0000FDBC Bytes.
->get CFE NVRAM Board_ID: 96358GW
->get CFE NVRAM MacAddress: 007404E4908F
->build CFE NVRAM block. Done!
->use cfe length 64956 to cal RootFS loading addr
->RootFS will load at 0xBFC20100, length 0x00322000 Bytes.
->Kernel will load at 0xBFF42100, length 0x0007E24C Bytes.
->get RootFS+Kernel checksum. CRC32 = 0x4A603558
->get image checksum. CRC32 = 0x1570834E
->get tag checksum. CRC32 = 0xF516B180
->write Tag to new image...
->write buffer to new image...
->Done
*** REQUESTED OPERATION IS COMPLETE, Bye! ***
刚才改为1后,出现一个警告提示,之前我做别的版本都没有发现这个提示, 为何故呢?
要如何修正这个TAG的CRC32校验值? 谢谢 TAG修改一个数自然CRC32会有问题。每次重组，TAG的CRC都要重新计算，这个不用担心。
CFE里面试试用web界面刷fw，别用终端的f命令
[ 本帖最后由 hugebird 于 2008-12-7 06:00 编辑 ] 对的,昨晚一直都是用F命令加载的,我运行了那个3cdaemon 这个东东,这个使用上很方便,就用习惯了.等下午我用WEB页面加载,完全按照你写的步骤再来一次.看看能否顺利...
祝我好运 :) 我用BRJTAG 写入整个FLASH备份，在写到 26%的时候，再也写不下去了。D:\brjtag15>wflash
D:\brjtag15>brjtag -flash:WHOLEFLASH /dma /fc:79
==============================================
Broadcom EJTAG Debrick Utility v1.5-hugebird
==============================================
Probing bus ... Done
Instruction Length set to 5
CPU running under BIG endian
CPU Chip ID: 00000110001101011000000101111111 (0635817F)
*** Found a Broadcom BCM6358 Rev 1 CPU chip ***
- EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS16 MIPS32
*** DMA Mode Forced On ***
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Initialize EBI ... Skipped
Manual Flash Selection ... Match Flash Chip (VenID:DevID = 017e : 2101)
*** Manually Selected a Spansion S29GL128N/P Uni(16MB) Flash Chip ***
- Flash Chip Window Start .... : 1f000000
- Flash Chip Window Length ... : 01000000
- Selected Area Start ........ : 1f000000
- Selected Area Length ....... : 01000000
*** You Selected to Flash the WHOLEFLASH.BIN ***
=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 128
Erasing block: 1 (addr = 1f000000)...Done
Erasing block: 2 (addr = 1f020000)...Done
Erasing block: 3 (addr = 1f040000)...Done
Erasing block: 4 (addr = 1f060000)...Done
Erasing block: 5 (addr = 1f080000)...Done
Erasing block: 6 (addr = 1f0a0000)...Done
Erasing block: 7 (addr = 1f0c0000)...Done
Erasing block: 8 (addr = 1f0e0000)...Done
Erasing block: 9 (addr = 1f100000)...Done
Erasing block: 10 (addr = 1f120000)...Done
Erasing block: 11 (addr = 1f140000)...Done
Erasing block: 12 (addr = 1f160000)...Done
Erasing block: 13 (addr = 1f180000)...Done
Erasing block: 14 (addr = 1f1a0000)...Done
Erasing block: 15 (addr = 1f1c0000)...Done
Erasing block: 16 (addr = 1f1e0000)...Done
Erasing block: 17 (addr = 1f200000)...Done
Erasing block: 18 (addr = 1f220000)...Done
Erasing block: 19 (addr = 1f240000)...Done
Erasing block: 20 (addr = 1f260000)...Done
Erasing block: 21 (addr = 1f280000)...Done
Erasing block: 22 (addr = 1f2a0000)...Done
Erasing block: 23 (addr = 1f2c0000)...Done
Erasing block: 24 (addr = 1f2e0000)...Done
Erasing block: 25 (addr = 1f300000)...Done
Erasing block: 26 (addr = 1f320000)...Done
Erasing block: 27 (addr = 1f340000)...Done
Erasing block: 28 (addr = 1f360000)...Done
Erasing block: 29 (addr = 1f380000)...Done
Erasing block: 30 (addr = 1f3a0000)...Done
Erasing block: 31 (addr = 1f3c0000)...Done
Erasing block: 32 (addr = 1f3e0000)...Done
Erasing block: 33 (addr = 1f400000)...Done
Erasing block: 34 (addr = 1f420000)...Done
Erasing block: 35 (addr = 1f440000)...Done
Erasing block: 36 (addr = 1f460000)...Done
Erasing block: 37 (addr = 1f480000)...Done
Erasing block: 38 (addr = 1f4a0000)...Done
Erasing block: 39 (addr = 1f4c0000)...Done
Erasing block: 40 (addr = 1f4e0000)...Done
Erasing block: 41 (addr = 1f500000)...Done
Erasing block: 42 (addr = 1f520000)...Done
Erasing block: 43 (addr = 1f540000)...Done
Erasing block: 44 (addr = 1f560000)...Done
Erasing block: 45 (addr = 1f580000)...Done
Erasing block: 46 (addr = 1f5a0000)...Done
Erasing block: 47 (addr = 1f5c0000)...Done
Erasing block: 48 (addr = 1f5e0000)...Done
Erasing block: 49 (addr = 1f600000)...Done
Erasing block: 50 (addr = 1f620000)...Done
Erasing block: 51 (addr = 1f640000)...Done
Erasing block: 52 (addr = 1f660000)...Done
Erasing block: 53 (addr = 1f680000)...Done
Erasing block: 54 (addr = 1f6a0000)...Done
Erasing block: 55 (addr = 1f6c0000)...Done
Erasing block: 56 (addr = 1f6e0000)...Done
Erasing block: 57 (addr = 1f700000)...Done
Erasing block: 58 (addr = 1f720000)...Done
Erasing block: 59 (addr = 1f740000)...Done
Erasing block: 60 (addr = 1f760000)...Done
Erasing block: 61 (addr = 1f780000)...Done
Erasing block: 62 (addr = 1f7a0000)...Done
Erasing block: 63 (addr = 1f7c0000)...Done
Erasing block: 64 (addr = 1f7e0000)...Done
Erasing block: 65 (addr = 1f800000)...Done
Erasing block: 66 (addr = 1f820000)...Done
Erasing block: 67 (addr = 1f840000)...Done
Erasing block: 68 (addr = 1f860000)...Done
Erasing block: 69 (addr = 1f880000)...Done
Erasing block: 70 (addr = 1f8a0000)...Done
Erasing block: 71 (addr = 1f8c0000)...Done
Erasing block: 72 (addr = 1f8e0000)...Done
Erasing block: 73 (addr = 1f900000)...Done
Erasing block: 74 (addr = 1f920000)...Done
Erasing block: 75 (addr = 1f940000)...Done
Erasing block: 76 (addr = 1f960000)...Done
Erasing block: 77 (addr = 1f980000)...Done
Erasing block: 78 (addr = 1f9a0000)...Done
Erasing block: 79 (addr = 1f9c0000)...Done
Erasing block: 80 (addr = 1f9e0000)...Done
Erasing block: 81 (addr = 1fa00000)...Done
Erasing block: 82 (addr = 1fa20000)...Done
Erasing block: 83 (addr = 1fa40000)...Done
Erasing block: 84 (addr = 1fa60000)...Done
Erasing block: 85 (addr = 1fa80000)...Done
Erasing block: 86 (addr = 1faa0000)...Done
Erasing block: 87 (addr = 1fac0000)...Done
Erasing block: 88 (addr = 1fae0000)...Done
Erasing block: 89 (addr = 1fb00000)...Done
Erasing block: 90 (addr = 1fb20000)...Done
Erasing block: 91 (addr = 1fb40000)...Done
Erasing block: 92 (addr = 1fb60000)...Done
Erasing block: 93 (addr = 1fb80000)...Done
Erasing block: 94 (addr = 1fba0000)...Done
Erasing block: 95 (addr = 1fbc0000)...Done
Erasing block: 96 (addr = 1fbe0000)...Done
Erasing block: 97 (addr = 1fc00000)...Done
Erasing block: 98 (addr = 1fc20000)...Done
Erasing block: 99 (addr = 1fc40000)...Done
Erasing block: 100 (addr = 1fc60000)...Done
Erasing block: 101 (addr = 1fc80000)...Done
Erasing block: 102 (addr = 1fca0000)...Done
Erasing block: 103 (addr = 1fcc0000)...Done
Erasing block: 104 (addr = 1fce0000)...Done
Erasing block: 105 (addr = 1fd00000)...Done
Erasing block: 106 (addr = 1fd20000)...Done
Erasing block: 107 (addr = 1fd40000)...Done
Erasing block: 108 (addr = 1fd60000)...Done
Erasing block: 109 (addr = 1fd80000)...Done
Erasing block: 110 (addr = 1fda0000)...Done
Erasing block: 111 (addr = 1fdc0000)...Done
Erasing block: 112 (addr = 1fde0000)...Done
Erasing block: 113 (addr = 1fe00000)...Done
Erasing block: 114 (addr = 1fe20000)...Done
Erasing block: 115 (addr = 1fe40000)...Done
Erasing block: 116 (addr = 1fe60000)...Done
Erasing block: 117 (addr = 1fe80000)...Done
Erasing block: 118 (addr = 1fea0000)...Done
Erasing block: 119 (addr = 1fec0000)...Done
Erasing block: 120 (addr = 1fee0000)...Done
Erasing block: 121 (addr = 1ff00000)...Done
Erasing block: 122 (addr = 1ff20000)...Done
Erasing block: 123 (addr = 1ff40000)...Done
Erasing block: 124 (addr = 1ff60000)...Done
Erasing block: 125 (addr = 1ff80000)...Done
Erasing block: 126 (addr = 1ffa0000)...Done
Erasing block: 127 (addr = 1ffc0000)...Done
Erasing block: 128 (addr = 1ffe0000)...Done
Loading WHOLEFLASH.BIN to Flash Memory...
26% bytes = 4468968
经过再次测试刷新,仍然是无法保存配置信息
Flash write error.Verify failedError writing flash sector 127.Flash write error.Verify failed
Error writing flash sector 127.Scratch pad is not initialized.
Scratch pad is not initialized.
No scratch pad found.Initialize scratch pad...
Flash write error.Verify failed
仍然是写 扇区 127 出错. 刚才把全部可以刷并可以启动的固件都试了一遍，RG100A，2.73，9113都试了，都无法保存配置。基本上都和这个类似的提示：Error writing flash sector 127.Flash write error.Verify failed
我恨死这个127，固件也直是固执，那个地方写不进去，怎么就不知道哪能写得进去的地方写呢？ ：）
只有等HUGEBIRD大大来指点了。