hs8546V的恢复出厂命令（restorehwmode.sh）分析

happyhack

hs8546V的恢复出厂命令（restorehwmode.sh）分析

0 d( f. H+ }8 Y6 Y3 p- v如下restorehwmode.sh这个命令的全部内容
+ j6 I$ ?7 Z$ S

1. #! /bin/sh
   
2. 
   $ w- i! g( n7 f
3. #set hw parameters
   1 M8 l; N- B4 C+ s2 g* e
4. #copy etc/wap/hw_default_ctree.xml to /mnt/jffs2/hw_ctree.xml
   : A1 g4 M, f8 a* E/ `% l
5. #set the spec para
   
6. 
   . i" B4 I8 M/ S5 ~
7. var_default_ctree=/mnt/jffs2/hw_default_ctree.xml;
   
8. var_ctree=/mnt/jffs2/hw_ctree.xml
   2 W$ Z/ ~2 z  D7 ?3 ?
9. var_customize=/mnt/jffs2/customizepara.txt
   * o' N( u! y# X$ S1 I
10. var_bms_prevxml_temp="/mnt/jffs2/hw_bms_prev.xml"
    
11. var_bms_oldcrc_temp="/mnt/jffs2/oldcrc"
    9 w" p4 V7 e6 X
12. var_bms_oltoldcrc_temp="/mnt/jffs2/oltoldcrc"
    - ]% B) f: K6 h4 e
13. var_bms_prevcrc_temp="/mnt/jffs2/prevcrc"
    
14. var_bms_oltprevcrc_temp="/mnt/jffs2/oltprevcrc"
    3 E1 Q6 V( x/ G
15. var_bms_oskvoice_temp="/mnt/jffs2/hw_osk_voip_prev.xml"
    
16. var_rebootsave="/mnt/jffs2/cwmp_rebootsave"
    
17. var_recovername_temp="/mnt/jffs2/recovername"
    / W9 D5 ~6 B& ]
18. var_usr_device_temp="/mnt/jffs2/usr_device.bin"
    $ q& b6 i. h' [
19. var_ftcrc_temp="/mnt/jffs2/FTCRC"
    3 Z. n) `) e" {% ]7 I# R2 a
20. var_ftvoip_temp="/mnt/jffs2/ftvoipcfgstate"
    
21. var_dhcp_temp="/mnt/jffs2/dhcpc"
    
22. var_dhcp6_temp="/mnt/jffs2/dhcp6c"
    
23. var_DHCPlasterrwan1_temp="/mnt/jffs2/DHCPlasterrwan1"
    
24. var_DHCPlasterrwan2_temp="/mnt/jffs2/DHCPlasterrwan2"
    
25. var_DHCPlasterrwan3_temp="/mnt/jffs2/DHCPlasterrwan3"
    
26. var_DHCPlasterrwan4_temp="/mnt/jffs2/DHCPlasterrwan4"
    * K2 Q6 b, z' r1 v" B
27. var_DHCPstatewan1_temp="/mnt/jffs2/DHCPstatewan1"
    * Q- g* n( k7 o+ J1 \9 H" U7 a
28. var_DHCPstatewan2_temp="/mnt/jffs2/DHCPstatewan2"
    + z1 c  z) ~. \# h5 r; N
29. var_DHCPstatewan3_temp="/mnt/jffs2/DHCPstatewan3"
    * f# J. n$ A( ?* _
30. var_DHCPstatewan4_temp="/mnt/jffs2/DHCPstatewan4"
    - `, w( `  T$ U2 `3 A! Z2 l
31. var_DHCPoutputwan1_temp="/mnt/jffs2/DHCPoutputwan1"
    / M* _9 o) [3 S1 I( S
32. var_boardinfo_file="/mnt/jffs2/hw_boardinfo"
    
33. var_boardinfo_bakfile="/mnt/jffs2/hw_boardinfo.bak"
    
34. var_boardinfo_temp="/mnt/jffs2/hw_boardinfo.temp"
    
35. var_jffs2_customize_txt_file="/mnt/jffs2/customize.txt"
    
36. var_jffs2_choose_xml_dir="/mnt/jffs2/choose_xml"
    - `5 U/ b& N4 R6 S1 f: U- _: e
37. var_jffs2_choose_xml_tar="/mnt/jffs2/choose_xml.tar.gz"
    
38. var_jffs2_spec_file="/mnt/jffs2/hw_hardinfo_spec"
    
39. var_jffs2_spec_bak_file="/mnt/jffs2/hw_hardinfo_spec.bak"
    ; T: m% z% h; b/ [" ^4 t
40. var_jffs2_feature_file="/mnt/jffs2/hw_hardinfo_feature"
    7 \0 i/ n* B1 n: @3 i( t5 ~$ |
41. var_jffs2_feature_bak_file="/mnt/jffs2/hw_hardinfo_feature.bak"
    3 }2 F+ M6 \( |: y+ w  w1 v- p
42. var_jffs2_hardinfo_para_file="/mnt/jffs2/hw_equip_hardinfo"
    ) x" I: _9 M6 I7 L  W- `
43. var_ontfirstonline_temp="/mnt/jffs2/ontfirstonlinefile"
    ! {! _4 t# U$ K- X
44. var_dublecore="/mnt/jffs2/doublecore"
    ' |3 Y! _* m& h# o  [. W" C9 p2 g
45. var_customize_telmex=/mnt/jffs2/TelmexCusomizePara
    ( x+ d/ H+ j2 b: G& T% ^
46. var_customize_dir="/mnt/jffs2/customize"
    1 R2 k+ V  t" j$ p
47. var_smartshowbssguide="/mnt/jffs2/smartshowbssguide"
    * v9 i8 X3 e# o$ v; |4 L
48. var_smartshowuserguide="/mnt/jffs2/smartshowuserguide"
    
49. var_old_ctree="/mnt/jffs2/hw_old_ctree.xml"
    + y' X; G! E  e( O+ P: h8 s+ M" }2 K
50. var_ctree_bak="/mnt/jffs2/hw_ctree_bak.xml"
    
51. var_cfgbackup="/mnt/jffs2/CfgFile_Backup"
    
52. var_PrimaryDir="/mnt/jffs2/PrimaryDir"
    
53. var_p2p_dhcp_file="/mnt/jffs2/p2pdhcpboot_prev.ini"
    
54. var_jffs2_hardversion_bak_file="/mnt/jffs2/hw_boardinfo.bak"
    
55. var_jffs2_specsn_file="/mnt/jffs2/customize_specsn"
    
56. 
    - E- h) J' o; X0 i
57. var_plat_root="/mnt/jffs2/platroot.crt"
    
58. var_plat_pub="/mnt/jffs2/platpub.crt"
    
59. var_plat_prvt="/mnt/jffs2/platprvt.key"
    , q; ^0 p$ d, m* u  f4 Y
60. 
    5 g' r2 h6 P+ V
61. # remove plugin files
    
62. HW_Script_RemovePluginFile()
    
63. {
    - O$ C. ~3 ^! R+ |0 u  F5 k4 n& m: D
64.         #通过特性开关来决定删除哪些插件
    
65.         var_feature_enble=`GetFeature HW_FT_OSGI_JVM_FROM_VAR`
    + C0 \  Y- A+ a% G8 ]
66.         if [ $var_feature_enble = 1 ];then
    
67.                 rm  -rf /mnt/jffs2/app/osgi/felix-cache;
    8 w& E" S2 W. w' j; m
68.         rm  -f /mnt/jffs2/app/osgi/prebundlestatus.info;
    
69.         rm  -f /mnt/jffs2/app/osgi/dlna.jar;
    
70.         rm  -f /mnt/jffs2/app/osgi/samba.jar;
    8 {# f1 s4 \& N5 F+ u( o
71.         else
    
72.                 rm  -rf /mnt/jffs2/app/osgi/* ;
    
73.         fi
    
74.         rm -rf  /mnt/jffs2/app/cplugin/* /var/cplugin/*;
    
75. }
    / l; q" J6 `! x$ \' Z* ?
76. 
    
77. # remove files
    3 E2 c8 e5 k7 b- p' ]1 X
78. HW_Script_RemoveFile()
    8 j/ a$ j& }2 T- j: `  [) e
79. {
    
80.         rm -f $var_default_ctree
    
81.         rm -f $var_ctree
    0 X$ e  s3 U9 A# D
82.         rm -f $var_customize
      [# c0 f+ N% z4 a3 a% i. ~
83.         rm -f $var_bms_prevxml_temp
    1 q4 j; k' L+ A: N* a$ K
84.         rm -f $var_bms_oldcrc_temp
    3 S' R3 N& e; y1 ^$ }4 Q
85.         rm -f $var_bms_oltoldcrc_temp
    ' _* J  ~( o" H& z
86.         rm -f $var_bms_prevcrc_temp
    9 K  J, e8 v3 V: o3 _. i
87.         rm -f $var_bms_oltprevcrc_temp
    : a3 U& g9 d6 n& H' ?
88.         rm -f $var_bms_oskvoice_temp
    
89.         rm -f $var_rebootsave
    
90.         rm -f $var_recovername_temp
    
91.         rm -f $var_usr_device_temp
    
92.         rm -rf $var_ftcrc_temp
    9 b- ^- Y4 O* S0 H# Q
93.         rm -rf $var_ftvoip_temp
    
94.         rm -rf $var_dhcp_temp
    . U% }- V% i, a: C3 W/ P% o
95.         rm -rf $var_dhcp6_temp
      T5 |3 X4 z4 G% B$ X3 x. m
96.         rm -rf $var_DHCPlasterrwan1_temp
    % Q9 ?& v+ i, C. n: j% _
97.         rm -rf $var_DHCPlasterrwan2_temp
    
98.         rm -rf $var_DHCPlasterrwan3_temp
    & n8 F* F6 e3 P; Z0 c( i
99.         rm -rf $var_DHCPlasterrwan4_temp
    
100.         rm -rf $var_DHCPstatewan1_temp
     
101.         rm -rf $var_DHCPstatewan2_temp
     
102.         rm -rf $var_DHCPstatewan3_temp
     - `7 y0 j) s9 f6 L& \. F' U% ?
103.         rm -rf $var_DHCPstatewan4_temp
     
104.         rm -rf $var_DHCPoutputwan1_temp
     8 l. [* U. w2 f: i; k8 J
105.         rm -rf $var_jffs2_customize_txt_file
     # ]3 b8 J/ C  @& G0 e3 F& J. q
106.         rm -rf $var_jffs2_choose_xml_dir
     
107.         rm -f $var_jffs2_choose_xml_tar
     
108.         rm -fr $var_jffs2_spec_file
     2 d7 L5 ^" W7 n9 \, z
109.         rm -fr $var_jffs2_spec_bak_file
     
110.         rm -fr $var_jffs2_feature_file
     / H% g1 f( v* G, g
111.         rm -fr $var_jffs2_feature_bak_file
     
112.         rm -fr $var_jffs2_hardinfo_para_file
     
113.         rm -fr $var_ontfirstonline_temp
     
114.         rm -f $var_dublecore
     
115.         rm -f /mnt/jffs2/simcard_flowflag
     
116.         rm -f /mnt/jffs2/simcardreadflag
     - n: R- u/ ^1 P
117.         rm -f /mnt/jffs2/typeword
     
118.         rm -f $var_customize_telmex
     
119.         rm -rf $var_customize_dir
     9 y: \4 G: D; w' C+ R+ _8 h( j5 ~
120.         rm -f $var_smartshowbssguide
     $ _. Q, F* F0 x2 k, H2 `8 j& Y4 V
121.         rm -rf $var_smartshowuserguide
     
122.         rm -fr $var_old_ctree
     
123.         rm -fr $var_ctree_bak
     
124.         rm -fr $var_cfgbackup
     
125.         rm -f $var_jffs2_hardversion_bak_file
     
126.         rm -rf $var_PrimaryDir
     
127.         rm -rf /mnt/jffs2/p2ploadcfgdone
     
128.         rm -rf /mnt/jffs2/dhcp6c
     ! I, G* b- C2 z' N5 m
129.     rm -rf /mnt/jffs2/dhcpc
     : \: U3 c( V4 w1 @; v
130.         rm -rf /mnt/jffs2/onlinecounter
     1 B  C5 P# F# J/ i6 r* L# C
131.         rm -rf $var_jffs2_specsn_file
     
132.         rm -rf /mnt/jffs2/reboot_bind_tag
     + Q* k# [# b$ I  Z6 K2 c! M: L! ~% R
133.         rm -rf $var_p2p_dhcp_file
     " J$ }5 y/ C" g  E6 Z) S
134.                
     
135.         rm  -rf /mnt/jffs2/app/osgi/*
     1 c# Y( o8 ?: \& t) P! {6 P/ R
136.         rm  -rf /mnt/jffs2/app/cplugin/*
     # E, C# c! w" K9 K' c$ Z  V' \: {! _
137.        
     
138.         rm -f /mnt/jffs2/smooth_finsh
     
139.         rm -f /mnt/jffs2/gdstbmac.bin
     
140.        
     
141.         rm -f $var_plat_root
     
142.         rm -f $var_plat_pub
     " L* Y& _7 U# f; r* E+ p$ t: j
143.         rm -f $var_plat_prvt
     7 R" v0 n* f3 x% |& r4 _- T
144. 
     - q5 e7 A( q: I7 Y  L$ l5 x% S
145.         HW_Script_RemovePluginFile
     3 _$ I- G$ j  t- s
146.         return
     0 P. Q4 R" q7 T$ C
147. }
     # l0 `( }) @" m* W  k
148. 
     5 Y6 N$ z1 G. p/ Z
149. #creat files
     ( e$ x  D8 J6 g: Q% U% k6 x) _
150. HW_Script_CreateFile()
     
151. {
     + [* Y) E3 M/ c: E0 u1 A: {
152.         var_telnet_flag=/mnt/jffs2/ProductLineMode
     4 A% \* w) g  U+ @( S3 Y
153. 
     " W, r; p  M1 y0 l
154.         echo "" > $var_telnet_flag
     
155.         if [ 0 -ne $? ]
     " H0 `! [9 L- C! q( M% {" v
156.         then
     ! f7 m, V+ D! @- F& A+ m1 u+ R
157.         {
     ' H0 T0 B, k/ H" a6 z
158.                 echo "ERROR::Failed to create telnet flag!"
     
159.         return 1
     
160.         }
     4 j* t( E0 r/ `) K7 b/ M" x
161.         fi
     ( S# Z1 J' B& ?# p$ _8 \
162. 
     
163.         return 0
     
164. }
     
165. 
     6 b8 o6 D* S8 |3 S/ x  U
166. # copy files
     
167. HW_Script_CopyFile()
     6 R, N( |! O1 l' ?* m
168. {
     ' e/ @$ z0 F) F" b- T/ S, B9 i
169.         var_etc_def=/etc/wap/hw_default_ctree.xml
     
170.        
     ( q1 v, M8 z' v4 f% c$ Y1 a$ L1 @
171.         #增加延时，确保DB不保存
     " Q+ h! z: z; _0 S7 J
172.         echo > /var/notsavedata
     $ ]( U$ D! o* @" l# C3 [  o
173.         sleep 1
     
174. 
     & r- \  f8 B3 l- C( c$ o" l
175.         cp -f $var_etc_def $var_ctree
     
176.         if [ 0 -ne $? ]
     4 C6 f4 D0 P$ w. p: M! Z0 N
177.         then
     $ m8 x% k+ @  R8 z; R5 k
178.                 rm -rf /var/notsavedata
     0 |, X, _* N' S7 u( ^' A! \
179.                 echo "ERROR::Failed to cp hw_default_ctree.xml to hw_ctree.xml!"
     ! i3 Q7 T6 N+ P. h) p# ?
180.                 return 1
     
181.         fi
     
182. 
     
183.         return
     4 R+ C0 E3 L2 O0 b$ D$ U1 X
184. }
     4 T. g8 ]$ @7 C+ ]3 _6 |5 \
185. 
     
186. # set spec data
     
187. HW_Script_SetData()
     
188. {
     
189.         cat $var_boardinfo_file | while read -r line;
     
190.         do
     2 _3 m: _1 n3 j# ?
191.                 obj_id_temp=`echo $line | sed 's/\(.*\)obj.value\(.*\)/\1/g'`
     
192.                 obj_id=`echo $obj_id_temp | sed 's/\(.*\)"\(.*\)"\(.*\)/\2/g'`
     
193. 
     
194.                 if [ "0x00000003" == $obj_id ];then
     . M. e! o5 ~* ~- P8 a; X
195.                         echo "obj.id = "0x00000003" ; obj.value = "";"
     
196.                 elif [ "0x00000004" == $obj_id ];then
     
197.                         echo "obj.id = "0x00000004" ; obj.value = "";"
     
198.                 elif [ "0x00000005" == $obj_id ];then
     
199.                         echo "obj.id = "0x00000005" ; obj.value = "";"
     
200.                 elif [ "0x00000006" == $obj_id ];then
     
201.                         echo "obj.id = "0x00000006" ; obj.value = "";"
     
202.                 elif [ "0x00000016" == $obj_id ];then
     / u% [1 O8 M' R- a
203.                         echo "obj.id = "0x00000016" ; obj.value = "";"
     
204.                 elif [ "0x0000001a" == $obj_id ];then
     
205.                         echo "obj.id = "0x0000001a" ; obj.value = "COMMON";"
     
206.                 elif [ "0x0000001b" == $obj_id ];then
     8 [4 P4 ?! M! [# X) ?9 C3 i5 I
207.                         echo "obj.id = "0x0000001b" ; obj.value = "COMMON";"
     
208.                 elif [ "0x00000019" == $obj_id ];then
     6 \: h) Y  {% o) S; W3 i* D
209.                         echo "obj.id = "0x00000019" ; obj.value = "";"
     ' _" G, O/ s, k' c  F2 w
210.                 elif [ "0x00000020" == $obj_id ];then
     
211.                         echo "obj.id = "0x00000020" ; obj.value = "";"
     + q& J2 A+ a6 X/ z! V
212.                 elif [ "0x00000031" == $obj_id ];then
     9 s4 s$ T4 r9 V8 q1 y- |8 f. @, t
213.                         echo "obj.id = "0x00000031" ; obj.value = "NOCHOOSE";"
     ) ^% [/ W& m! b/ l. O: l
214.                 elif [ "0x00000035" == $obj_id ];then
     0 m4 \/ y2 a% V* X' r! \" U9 i
215.                         echo "obj.id = "0x00000035" ; obj.value = "";"
     - _8 |6 k9 e/ {' y# W
216.                 elif [ "0x0000003a" == $obj_id ];then
     
217.                         echo "obj.id = "0x0000003a" ; obj.value = "";"
     & q7 Y6 t$ k" X
218.                 else
     
219.                         echo -E $line
     
220.                 fi
     
221.         done  > $var_boardinfo_temp
     ! T# [$ Y" J6 e/ Y! U5 }% _7 l
222. 
     * h; n% Z6 ~) P( K" D- B5 c2 N8 a# e
223.         mv -f $var_boardinfo_temp $var_boardinfo_file
     
224. 
     ! ^6 T. S, D" f
225.         return
     
226. }
     3 U/ b! V1 `8 v9 ?
227. 
     
228. # 刷新boardinfo文件的crc行
     + ?5 i% I8 i* |- z5 K- s& I: l
229. HW_Customize_ValidateBoardinfoCRC()
     2 J0 a: t7 w4 R; M
230. {
     
231.         if [ -z $1 ]; then
     " S: C" ^3 k/ ~/ D
232.                 return 0
     
233.         fi
     
234.         if [ -x /bin/factparam ]; then
     
235.                 /bin/factparam -v $1
     
236.                 if [ 0 -ne $? ]; then
     
237.                         echo "ERROR::Failed to validate boardinfo crc on $1!"
     3 F; b3 K) B. r: q% D
238.                         return 1
     
239.                 fi
     
240.         fi
       K8 l# y3 S: ~) ?& ]  o8 h
241. }
     
242. 
     2 ^" O8 ~8 G3 p9 C4 J
243. # 清除出厂参数备份
     & D3 A! q0 N: q3 p& ?& Q
244. HW_Customize_ClearFactoryParamsBackup()
     
245. {
     
246.         if [ -x /bin/factparam ]; then
     ! E8 O) U- q+ D9 k% X( [
247.                 /bin/factparam -e reserved
     ) P8 e0 H* s- W; a  ]. n3 x6 |
248.                 if [ 0 -ne $? ]; then
     ( B1 R. G1 Q! y% j
249.                         echo "ERROR::Failed to clear factory parameter backup area!"
     
250.                         return 1
     
251.                 fi
     
252.         fi
     
253. }
     
254. 
     ; F" D5 T: @/ S3 B) Q" E0 T
255. if [ 0 -ne $# ]; then
     
256.         echo "ERROR::input para is not right!";
     
257.         exit 1;
     
258. else
     ! N" l7 K- ]) p3 X; S8 G: E1 G
259. HW_Script_CreateFile
     
260. [ ! $? == 0 ] && exit 1
     , V" A7 V2 r+ S; X. |
261. 
     
262. HW_Script_RemoveFile
       y  f+ w+ ~$ _& ^' i" m- P* S7 W
263. [ ! $? == 0 ] && exit 1
     1 l6 \. _6 c. k3 v, O; z0 \8 R7 _
264. 
     
265. HW_Script_CopyFile
     
266. [ ! $? == 0 ] && exit 1
     
267. 
     * w- s8 W& K1 Q, `6 _
268. HW_Script_SetData
     
269. [ ! $? == 0 ] && exit 1
     # k" P& _! `! E, x7 s. s$ k
270. 
     
271. rm -rf $var_boardinfo_bakfile
     3 s! _& |6 v. e# X
272. 
     6 G2 U! S0 U: V  T0 M1 {* [
273. ctrg_support=`GetFeature HW_SSMP_FEATURE_CTRG`
     
274. if [ $ctrg_support = 1 ] ;then
     
275.         dbus-send --system --print-reply --dest=com.ctc.saf1 /com/ctc/saf1 com.ctc.saf1.framework.Restore > /dev/null
     % B% X% S8 B& b* G* b( U. b1 I2 o
276. fi
     
277. 
     
278. # 必须刷新boardinfo文件的crc行，并且清除reserved分区的出厂参数备份
     
279. HW_Customize_ValidateBoardinfoCRC $var_boardinfo_file
     
280. [ ! $? == 0 ] && exit 1
     2 Z/ R1 ?$ c# u" X' E! {# q  F
281. HW_Customize_ClearFactoryParamsBackup
     
282. [ ! $? == 0 ] && exit 1
     & d/ W0 @+ z- u, b: B+ u
283. 
     6 B% S. U5 {9 W/ J
284. echo "success!"
     - q" ^; r# T1 H+ Z4 D
285. 
     * J2 j. H: ^' F5 q
286. exit 0
     + R; R0 P  m" x+ A* f! u. `
287. fi
     ) Y6 y0 G- v4 C+ F! `2 T

复制代码

第一部分的etc/wap/hw_default_ctree.xml ，文件附后，

7 a3 P* C# A' t$ J+ bhw_default_ctree.xml这个文件也就是恢复命令后jffs2下的hw_ctree.xml文件，内容大家可以参考下
; R3 [& q+ ^/ _8 I

4 m# [% ~8 ^: n" _$ m中间部分的含义见https://www.chinadsl.net/thread-131336-1-2.html，也就是hw_boardinfo文件内容
, A& d# W1 G; I4 }  S) G( L
至于jffs2/app的内容，恢复命令后删除，直接删除app数据
% c) }+ ^: n* T7 I: o
这也就是为什么使用命令后，大家手机上使用天翼网关app不能连接光猫的原因

" K0 W& V  u) _
" m( [6 X; E; E$ E# {至于其他内容，欢迎各位继续探讨   
5 n! |, B! g8 O4 u! U- S
  U* L$ F! H# ?0 P' M' D: m- e; C

' [# s$ G  y% |' s  Y

happyhack

/ i# x' P7 \+ O  I! n2 ]7 k8 B
  l2 m3 I% [0 ^( \+ }, n* |+ P' _, |restorehwmode.sh打包附后，
1 R: l) o7 e9 {! l9 a5 S5 H
5 p8 p; r) [6 h" H3 g) _5 `" x
- m8 R, b+ E8 j( l4 [. B大家看下，个人猜测这个应该是跟手机app控制光猫的一些文件
! f( y" g- w  F1 c

ligang667

这个是不是要破解才能用的？

wzyf

技术贴，谢谢，学习了

pillhe

值得拥有。。。。

pillhe

技术学习了

mimmm

专门学习的，楼主辛苦！

hallos

谢谢，楼主无私的分享你宝贵的经验，顺便来赚个猫粮

zhanzuoson

专门学习的，楼主辛苦！

ahy1

感谢lz的分享