hs8546V的恢复出厂命令（restorehwmode.sh）分析

happyhack

hs8546V的恢复出厂命令（restorehwmode.sh）分析
% A! c  t0 V2 |$ r
如下restorehwmode.sh这个命令的全部内容
1 x8 u) c7 C4 d

1. #! /bin/sh
   2 x+ s4 I2 _  m1 ?# l
2. 
   
3. #set hw parameters
   
4. #copy etc/wap/hw_default_ctree.xml to /mnt/jffs2/hw_ctree.xml
   
5. #set the spec para
   ' `& {+ \6 d; S6 b
6. 
   
7. var_default_ctree=/mnt/jffs2/hw_default_ctree.xml;
   
8. var_ctree=/mnt/jffs2/hw_ctree.xml
   " a7 [4 S8 O+ u3 W* g
9. var_customize=/mnt/jffs2/customizepara.txt
   # E$ z/ |  E+ w# l+ v
10. var_bms_prevxml_temp="/mnt/jffs2/hw_bms_prev.xml"
    ' f! |; k# ^! K4 V
11. var_bms_oldcrc_temp="/mnt/jffs2/oldcrc"
    ; Q( F4 v4 B. v* x" A+ M1 F
12. var_bms_oltoldcrc_temp="/mnt/jffs2/oltoldcrc"
    0 u  Q2 h% R4 y5 J) j1 b
13. var_bms_prevcrc_temp="/mnt/jffs2/prevcrc"
    ! @6 L6 _2 l" d7 }) J
14. var_bms_oltprevcrc_temp="/mnt/jffs2/oltprevcrc"
    
15. var_bms_oskvoice_temp="/mnt/jffs2/hw_osk_voip_prev.xml"
    1 E! L- z* R1 w$ ^% [3 z
16. var_rebootsave="/mnt/jffs2/cwmp_rebootsave"
    ) f+ F7 ]: [8 g" V6 E
17. var_recovername_temp="/mnt/jffs2/recovername"
    ) z  t( M5 S9 `" i+ q$ T
18. var_usr_device_temp="/mnt/jffs2/usr_device.bin"
    5 [' X1 _; y( P" `( |5 `- g) Y
19. var_ftcrc_temp="/mnt/jffs2/FTCRC"
    
20. var_ftvoip_temp="/mnt/jffs2/ftvoipcfgstate"
    & y/ K1 s/ a4 `3 Q  v: X& V
21. var_dhcp_temp="/mnt/jffs2/dhcpc"
    
22. var_dhcp6_temp="/mnt/jffs2/dhcp6c"
    
23. var_DHCPlasterrwan1_temp="/mnt/jffs2/DHCPlasterrwan1"
    3 C2 n; }+ {- l: ]; Z$ e
24. var_DHCPlasterrwan2_temp="/mnt/jffs2/DHCPlasterrwan2"
    
25. var_DHCPlasterrwan3_temp="/mnt/jffs2/DHCPlasterrwan3"
    
26. var_DHCPlasterrwan4_temp="/mnt/jffs2/DHCPlasterrwan4"
    4 I4 g) Y7 z, M% j
27. var_DHCPstatewan1_temp="/mnt/jffs2/DHCPstatewan1"
    
28. var_DHCPstatewan2_temp="/mnt/jffs2/DHCPstatewan2"
    
29. var_DHCPstatewan3_temp="/mnt/jffs2/DHCPstatewan3"
    , D. b% Q, `- z6 a
30. var_DHCPstatewan4_temp="/mnt/jffs2/DHCPstatewan4"
    
31. var_DHCPoutputwan1_temp="/mnt/jffs2/DHCPoutputwan1"
    - ^; Q5 M& D* I7 S
32. var_boardinfo_file="/mnt/jffs2/hw_boardinfo"
    
33. var_boardinfo_bakfile="/mnt/jffs2/hw_boardinfo.bak"
    0 h$ ]- U0 l0 U  U1 ]6 R! f' ~  \$ g
34. var_boardinfo_temp="/mnt/jffs2/hw_boardinfo.temp"
    
35. var_jffs2_customize_txt_file="/mnt/jffs2/customize.txt"
    9 e! t4 |& q) K4 ^& i& d3 X, O: z
36. var_jffs2_choose_xml_dir="/mnt/jffs2/choose_xml"
    
37. var_jffs2_choose_xml_tar="/mnt/jffs2/choose_xml.tar.gz"
    
38. var_jffs2_spec_file="/mnt/jffs2/hw_hardinfo_spec"
    0 H9 @0 h' A/ i* ?* @
39. var_jffs2_spec_bak_file="/mnt/jffs2/hw_hardinfo_spec.bak"
    ; y1 n6 E3 p. v/ \; g
40. var_jffs2_feature_file="/mnt/jffs2/hw_hardinfo_feature"
    
41. var_jffs2_feature_bak_file="/mnt/jffs2/hw_hardinfo_feature.bak"
    
42. var_jffs2_hardinfo_para_file="/mnt/jffs2/hw_equip_hardinfo"
    
43. var_ontfirstonline_temp="/mnt/jffs2/ontfirstonlinefile"
    ; r" e% o* S4 N) ?" d0 P
44. var_dublecore="/mnt/jffs2/doublecore"
    
45. var_customize_telmex=/mnt/jffs2/TelmexCusomizePara
    ! C$ X* N( e0 g
46. var_customize_dir="/mnt/jffs2/customize"
    
47. var_smartshowbssguide="/mnt/jffs2/smartshowbssguide"
    
48. var_smartshowuserguide="/mnt/jffs2/smartshowuserguide"
    2 R  _6 W) D2 e. C# `
49. var_old_ctree="/mnt/jffs2/hw_old_ctree.xml"
    
50. var_ctree_bak="/mnt/jffs2/hw_ctree_bak.xml"
    & K. ?8 B5 U' @
51. var_cfgbackup="/mnt/jffs2/CfgFile_Backup"
    5 Y! K1 S, ?9 P: `
52. var_PrimaryDir="/mnt/jffs2/PrimaryDir"
    
53. var_p2p_dhcp_file="/mnt/jffs2/p2pdhcpboot_prev.ini"
    
54. var_jffs2_hardversion_bak_file="/mnt/jffs2/hw_boardinfo.bak"
    0 J% R# g% ^+ f; I, j( Y
55. var_jffs2_specsn_file="/mnt/jffs2/customize_specsn"
    * N. n- j' o( e7 D
56. 
    
57. var_plat_root="/mnt/jffs2/platroot.crt"
    - f! h" ~% v9 i* S) [# W2 K
58. var_plat_pub="/mnt/jffs2/platpub.crt"
    
59. var_plat_prvt="/mnt/jffs2/platprvt.key"
    
60. 
    6 X* B# i* o; p% g0 @5 _: W
61. # remove plugin files
    
62. HW_Script_RemovePluginFile()
    & l# }- z6 ?8 f+ x+ _
63. {
    
64.         #通过特性开关来决定删除哪些插件
    0 K1 c6 w7 ?  |0 M4 C) |) X
65.         var_feature_enble=`GetFeature HW_FT_OSGI_JVM_FROM_VAR`
    $ j( A1 Q1 c, Z  S+ A8 }3 c
66.         if [ $var_feature_enble = 1 ];then
    
67.                 rm  -rf /mnt/jffs2/app/osgi/felix-cache;
    ' q4 M/ A6 Y. s3 T) _( V3 W
68.         rm  -f /mnt/jffs2/app/osgi/prebundlestatus.info;
    ) V  x) G0 t0 {; ~' @9 E
69.         rm  -f /mnt/jffs2/app/osgi/dlna.jar;
    ! y2 I+ Y2 c; j& ?2 ?/ v6 m- Y' I
70.         rm  -f /mnt/jffs2/app/osgi/samba.jar;
    
71.         else
    
72.                 rm  -rf /mnt/jffs2/app/osgi/* ;
    
73.         fi
    
74.         rm -rf  /mnt/jffs2/app/cplugin/* /var/cplugin/*;
    # u7 T5 M0 w% ~. V7 ]$ H
75. }
    2 z; l6 N" p4 {2 \$ p& g) g  T9 l& v
76. 
    
77. # remove files
    
78. HW_Script_RemoveFile()
    # J/ t# c' ]  t* b: m: w6 k
79. {
    ; T, v1 U2 [7 ^* p5 _: Q
80.         rm -f $var_default_ctree
    
81.         rm -f $var_ctree
    / s+ [  X: J' R' h
82.         rm -f $var_customize
    
83.         rm -f $var_bms_prevxml_temp
    ) ^. k/ r9 \$ v, g; ^3 d# V
84.         rm -f $var_bms_oldcrc_temp
    1 F% x; a& V& }+ [* ~
85.         rm -f $var_bms_oltoldcrc_temp
    1 x7 _& X. F1 n/ T/ @2 r# \6 W" @
86.         rm -f $var_bms_prevcrc_temp
    % o1 \4 m* A9 {) w4 p. A+ J+ K
87.         rm -f $var_bms_oltprevcrc_temp
    
88.         rm -f $var_bms_oskvoice_temp
    
89.         rm -f $var_rebootsave
    
90.         rm -f $var_recovername_temp
    
91.         rm -f $var_usr_device_temp
    1 P5 d* Z0 c( D( y3 q7 H$ H
92.         rm -rf $var_ftcrc_temp
    
93.         rm -rf $var_ftvoip_temp
    8 x+ ?( n; U6 O
94.         rm -rf $var_dhcp_temp
    
95.         rm -rf $var_dhcp6_temp
    9 N7 `0 k' E1 ^# C: J
96.         rm -rf $var_DHCPlasterrwan1_temp
    : G1 ~, w9 K  @5 N
97.         rm -rf $var_DHCPlasterrwan2_temp
    7 `- V0 i$ p2 l
98.         rm -rf $var_DHCPlasterrwan3_temp
    
99.         rm -rf $var_DHCPlasterrwan4_temp
    
100.         rm -rf $var_DHCPstatewan1_temp
     
101.         rm -rf $var_DHCPstatewan2_temp
     
102.         rm -rf $var_DHCPstatewan3_temp
     
103.         rm -rf $var_DHCPstatewan4_temp
     , ]; J8 M) x% k3 W- p! d* V4 b
104.         rm -rf $var_DHCPoutputwan1_temp
     
105.         rm -rf $var_jffs2_customize_txt_file
     
106.         rm -rf $var_jffs2_choose_xml_dir
     3 K" @& |; S) P) k; B  ~( R( R
107.         rm -f $var_jffs2_choose_xml_tar
     9 \5 Q. g7 R# R9 X
108.         rm -fr $var_jffs2_spec_file
     , ^: Z/ L* T" G- o# n7 @: N: S
109.         rm -fr $var_jffs2_spec_bak_file
     9 K) l/ [! ]. x5 v# N# ^' Q3 I& S
110.         rm -fr $var_jffs2_feature_file
     
111.         rm -fr $var_jffs2_feature_bak_file
     
112.         rm -fr $var_jffs2_hardinfo_para_file
     
113.         rm -fr $var_ontfirstonline_temp
     / v7 k, s3 t7 r8 E$ x  K
114.         rm -f $var_dublecore
     % K$ [5 Z6 n8 V( W( X5 q: [
115.         rm -f /mnt/jffs2/simcard_flowflag
     
116.         rm -f /mnt/jffs2/simcardreadflag
     5 V% j. D3 k6 a4 O4 k0 F( X% v% V
117.         rm -f /mnt/jffs2/typeword
     
118.         rm -f $var_customize_telmex
     
119.         rm -rf $var_customize_dir
     
120.         rm -f $var_smartshowbssguide
     & ~) i% {9 B) Q/ e) L! [: c4 r
121.         rm -rf $var_smartshowuserguide
     
122.         rm -fr $var_old_ctree
     % j( F7 D( b8 a: K8 l6 ^
123.         rm -fr $var_ctree_bak
     5 a) [: l2 K6 ?9 T% J
124.         rm -fr $var_cfgbackup
     : S+ C( S1 h: e- T0 U5 s( q' A
125.         rm -f $var_jffs2_hardversion_bak_file
     
126.         rm -rf $var_PrimaryDir
     
127.         rm -rf /mnt/jffs2/p2ploadcfgdone
     ; \3 @$ Y% R. ?
128.         rm -rf /mnt/jffs2/dhcp6c
     : K0 w$ F* h8 |, m2 A, F
129.     rm -rf /mnt/jffs2/dhcpc
     # Q& S& [% V/ S7 ]2 [+ `/ r! P4 ?
130.         rm -rf /mnt/jffs2/onlinecounter
     
131.         rm -rf $var_jffs2_specsn_file
     
132.         rm -rf /mnt/jffs2/reboot_bind_tag
       p: J% G/ y8 Y1 T: Q( K5 M3 F& B
133.         rm -rf $var_p2p_dhcp_file
     
134.                
     + D* o4 w2 @4 a* Q0 U+ a
135.         rm  -rf /mnt/jffs2/app/osgi/*
     5 v5 S5 i# K  p" Z% h
136.         rm  -rf /mnt/jffs2/app/cplugin/*
     " v- N. T) t4 f# ~3 M& E  O% _
137.        
     
138.         rm -f /mnt/jffs2/smooth_finsh
     
139.         rm -f /mnt/jffs2/gdstbmac.bin
     
140.        
     
141.         rm -f $var_plat_root
     3 s7 P7 I) m% G! [+ z
142.         rm -f $var_plat_pub
     
143.         rm -f $var_plat_prvt
     7 {( w, H/ e. X  e, X
144. 
     : A7 q2 S6 g' K9 }1 f# x" _
145.         HW_Script_RemovePluginFile
     $ O: g5 Z/ ^1 g7 y: P. c
146.         return
     
147. }
     
148. 
     - ~2 M% v$ v1 U0 c$ }
149. #creat files
     / A2 z" R/ R" \+ C, z  `
150. HW_Script_CreateFile()
     
151. {
     " U) c5 N* @; s3 F2 L
152.         var_telnet_flag=/mnt/jffs2/ProductLineMode
     ; L9 m) h- x; z# N
153. 
     * A9 `) n! K) N
154.         echo "" > $var_telnet_flag
     7 Q. @# c2 T, w8 p. J& `
155.         if [ 0 -ne $? ]
     
156.         then
     
157.         {
     2 c  w* ?6 u- t; i0 n7 x. w8 `
158.                 echo "ERROR::Failed to create telnet flag!"
     
159.         return 1
     ( ^+ D- C# @7 w) `& ~
160.         }
     1 g! q! ^. W% `. Z
161.         fi
     
162. 
     
163.         return 0
     
164. }
     
165. 
     # g  M9 K' F5 J& E  h3 p
166. # copy files
     + G  Z& W7 ?6 i8 c
167. HW_Script_CopyFile()
     2 Q7 ~9 d, n5 U, e2 d$ |+ e1 N. W
168. {
     
169.         var_etc_def=/etc/wap/hw_default_ctree.xml
     + Y# m4 ?  R7 `; U/ C" x9 x1 m
170.        
       u. s! z- @7 J$ R( C
171.         #增加延时，确保DB不保存
     3 k0 i( I, T, J- o2 k; ?
172.         echo > /var/notsavedata
     
173.         sleep 1
     
174. 
     , R3 q& _7 u. B3 N% o
175.         cp -f $var_etc_def $var_ctree
     : S+ P' V! @' e( ?- D( ~
176.         if [ 0 -ne $? ]
     
177.         then
     
178.                 rm -rf /var/notsavedata
     0 `! y" A) t  U7 y3 r' Y
179.                 echo "ERROR::Failed to cp hw_default_ctree.xml to hw_ctree.xml!"
     ( Z: n: f. y7 Z
180.                 return 1
     
181.         fi
     
182. 
     
183.         return
     
184. }
     
185. 
     
186. # set spec data
     : L' B( R5 A: j
187. HW_Script_SetData()
     4 M# J6 ^% W$ E' O6 q
188. {
     
189.         cat $var_boardinfo_file | while read -r line;
     2 R' A  i+ M# k/ `; P
190.         do
     
191.                 obj_id_temp=`echo $line | sed 's/\(.*\)obj.value\(.*\)/\1/g'`
     
192.                 obj_id=`echo $obj_id_temp | sed 's/\(.*\)"\(.*\)"\(.*\)/\2/g'`
     
193. 
     
194.                 if [ "0x00000003" == $obj_id ];then
     ( p6 l% q- k3 `; R1 u
195.                         echo "obj.id = "0x00000003" ; obj.value = "";"
     
196.                 elif [ "0x00000004" == $obj_id ];then
     8 Y7 y7 m. Y2 q0 U) ^% N
197.                         echo "obj.id = "0x00000004" ; obj.value = "";"
       I$ K& M4 t/ V/ Q4 ?- U
198.                 elif [ "0x00000005" == $obj_id ];then
     
199.                         echo "obj.id = "0x00000005" ; obj.value = "";"
     
200.                 elif [ "0x00000006" == $obj_id ];then
     6 O# M! H& t. u! p5 h8 j
201.                         echo "obj.id = "0x00000006" ; obj.value = "";"
     / E/ D" j8 t* R" z0 E
202.                 elif [ "0x00000016" == $obj_id ];then
     
203.                         echo "obj.id = "0x00000016" ; obj.value = "";"
     5 s2 S3 t( }1 G1 H+ r$ M
204.                 elif [ "0x0000001a" == $obj_id ];then
     3 p+ L/ x; f- W3 l! S: j
205.                         echo "obj.id = "0x0000001a" ; obj.value = "COMMON";"
     " p, ]0 ?- Y* A* U, x3 y! X+ w
206.                 elif [ "0x0000001b" == $obj_id ];then
     
207.                         echo "obj.id = "0x0000001b" ; obj.value = "COMMON";"
     * h% y& k- v" F: `5 V! ]$ N
208.                 elif [ "0x00000019" == $obj_id ];then
     
209.                         echo "obj.id = "0x00000019" ; obj.value = "";"
     
210.                 elif [ "0x00000020" == $obj_id ];then
     % ?+ b8 d% O, V) ]$ U  A+ X
211.                         echo "obj.id = "0x00000020" ; obj.value = "";"
     0 S9 P  I( h: D  G! n
212.                 elif [ "0x00000031" == $obj_id ];then
     6 H" {4 G3 G& E* f( D. N
213.                         echo "obj.id = "0x00000031" ; obj.value = "NOCHOOSE";"
     
214.                 elif [ "0x00000035" == $obj_id ];then
     
215.                         echo "obj.id = "0x00000035" ; obj.value = "";"
     
216.                 elif [ "0x0000003a" == $obj_id ];then
     
217.                         echo "obj.id = "0x0000003a" ; obj.value = "";"
     5 Q3 ~) ~6 W7 o# l* |8 ^" m
218.                 else
     ; y; |- Z9 @) [& A; s* }
219.                         echo -E $line
     9 k" q" c! U+ S. ?, g) y3 I
220.                 fi
     
221.         done  > $var_boardinfo_temp
       b: n0 a+ Z3 I! P6 L
222. 
     7 M1 n% h) M" w4 Z
223.         mv -f $var_boardinfo_temp $var_boardinfo_file
     9 @4 I* f- v* \' Y; L& ^7 D/ B
224. 
     
225.         return
     
226. }
     ! B6 Q/ `  T+ _! }2 B2 i. m
227. 
     
228. # 刷新boardinfo文件的crc行
     
229. HW_Customize_ValidateBoardinfoCRC()
     
230. {
     4 l$ K, u# {" j/ |- d" F( W. T
231.         if [ -z $1 ]; then
     2 ~- {* S% s7 J; v' j
232.                 return 0
     , ~/ O1 D/ \5 f/ b7 L! b5 V0 K4 l
233.         fi
     
234.         if [ -x /bin/factparam ]; then
     
235.                 /bin/factparam -v $1
     
236.                 if [ 0 -ne $? ]; then
     ! \) B0 H, H* l' f  u2 m' g
237.                         echo "ERROR::Failed to validate boardinfo crc on $1!"
     : I2 ?  T) d  g" Q
238.                         return 1
     7 ]% d2 H' `. P) n! ^
239.                 fi
     
240.         fi
     
241. }
     - \* G1 O& ]# k' q
242. 
     
243. # 清除出厂参数备份
     # f/ G7 |4 @( t& V, F3 R. x
244. HW_Customize_ClearFactoryParamsBackup()
     
245. {
     
246.         if [ -x /bin/factparam ]; then
     . q4 C" W& e5 ?( `/ l$ n4 N5 {) H
247.                 /bin/factparam -e reserved
     
248.                 if [ 0 -ne $? ]; then
     4 k; ~( I7 A' P, t7 e
249.                         echo "ERROR::Failed to clear factory parameter backup area!"
     4 N- F* g. y2 M) w8 a* Y
250.                         return 1
     
251.                 fi
     
252.         fi
     - G$ f( I9 g" f2 u0 R0 ^
253. }
     
254. 
     
255. if [ 0 -ne $# ]; then
     % l4 k: \/ G4 B  R) C1 g
256.         echo "ERROR::input para is not right!";
     * m6 a, T+ u- f+ k
257.         exit 1;
     
258. else
     
259. HW_Script_CreateFile
     / O7 a: E; l4 \8 b; P
260. [ ! $? == 0 ] && exit 1
     
261. 
       |' ~. V7 L* c% @' M5 t5 P+ I
262. HW_Script_RemoveFile
     
263. [ ! $? == 0 ] && exit 1
     " T. H( R! z9 K: W+ u: E# ^% y5 p: }* |
264. 
     
265. HW_Script_CopyFile
     7 p" T- {& H& v( Q" L6 k# e
266. [ ! $? == 0 ] && exit 1
     
267. 
     
268. HW_Script_SetData
     
269. [ ! $? == 0 ] && exit 1
     
270. 
     5 p' H3 F& Z5 x, l# d, s  p/ w
271. rm -rf $var_boardinfo_bakfile
     . C6 p$ D% z9 x( ], t- U* w
272. 
     7 {$ t8 ?. K% g) N8 E$ }
273. ctrg_support=`GetFeature HW_SSMP_FEATURE_CTRG`
     * t0 \9 L+ J8 B5 G3 x0 x
274. if [ $ctrg_support = 1 ] ;then
     
275.         dbus-send --system --print-reply --dest=com.ctc.saf1 /com/ctc/saf1 com.ctc.saf1.framework.Restore > /dev/null
     
276. fi
     8 l6 D2 f8 p2 |4 T
277. 
     ) s$ d+ G% u' g$ p6 F8 I
278. # 必须刷新boardinfo文件的crc行，并且清除reserved分区的出厂参数备份
     1 l! ?- t! l& {# n  |7 K: W2 ^' K
279. HW_Customize_ValidateBoardinfoCRC $var_boardinfo_file
     & J& k8 \; y3 u# q4 x2 D7 Y
280. [ ! $? == 0 ] && exit 1
     / ^  S/ c- d: O7 I  n1 y
281. HW_Customize_ClearFactoryParamsBackup
     
282. [ ! $? == 0 ] && exit 1
     ; U+ M/ @' y5 n  M
283. 
     
284. echo "success!"
     
285. 
     . ]) v* q  I# p% d+ R6 J: v2 n( M8 U
286. exit 0
     
287. fi
     

复制代码

第一部分的etc/wap/hw_default_ctree.xml ，文件附后，

1 @0 h- r3 p' n# l6 U4 f; _7 bhw_default_ctree.xml这个文件也就是恢复命令后jffs2下的hw_ctree.xml文件，内容大家可以参考下
! `% m. a+ I* z7 P' `0 _) K
+ C% Z9 C+ K/ k- i0 O
中间部分的含义见https://www.chinadsl.net/thread-131336-1-2.html，也就是hw_boardinfo文件内容

9 o0 }  C% x+ B至于jffs2/app的内容，恢复命令后删除，直接删除app数据

这也就是为什么使用命令后，大家手机上使用天翼网关app不能连接光猫的原因

# W- j! B8 ?# I$ ~7 y
至于其他内容，欢迎各位继续探讨   
/ `! P6 j; l/ x5 x/ c9 s/ r2 G% l5 O
8 U- e$ y+ a3 @9 J, ~7 C' M
! `  I% h, j  @6 ]
9 a. g& \2 O$ o( x* \  F

happyhack

) }5 f0 `' h2 Y: o
restorehwmode.sh打包附后，
3 K+ p4 q7 d# R; Y0 D

大家看下，个人猜测这个应该是跟手机app控制光猫的一些文件

ligang667

这个是不是要破解才能用的？

wzyf

技术贴，谢谢，学习了

pillhe

值得拥有。。。。

pillhe

技术学习了

mimmm

专门学习的，楼主辛苦！

hallos

谢谢，楼主无私的分享你宝贵的经验，顺便来赚个猫粮

zhanzuoson

专门学习的，楼主辛苦！

ahy1

感谢lz的分享