|
|
本帖最后由 dalingo 于 2024-4-7 15:26 编辑 9 Y$ e0 Z' r4 l* s2 T
6 Q5 c6 x& t( Z. g! M. B
本人比较喜欢折腾电子产品，因为学的不是相关专业，技术有限，都是一边折腾一边摸索。' ?' i& J) S( ^1 R( H' }
最近闲来无事看见咸鱼卖移动光猫F7610m比较便宜（30-50元之间），我猜想应该和联通光猫F7610u硬件（80元左右）是一样的，我这是联通宽带，就想着能不能买个F7610m，ttl刷联通固件改成F7610u。/ v# V8 y( w& N5 M+ Y# V D
花38元淘来一个，就开始折腾，结果发现碰见不少问题，想来请教各位大神帮忙。3 e! A$ k7 b8 I
5 l9 [: i, P4 Y
1 X g4 }. s& I b. ]$ w
$ Z! D/ t% F, C. w" T; U7 I) B) ]7 x. J3 u% j E7 d
1、拆机
/ Y/ M: J% S P( z- F底部四个螺丝，用十字螺丝刀取下，背面右边有个缺口，用一字螺丝刀一撬就打开了
* E. z8 M- r% C' |! q. s8 B; L' \# ~: @) _) c. p( T. P
内部图片，中间下面有一排四个孔就是TTL，从左到右分别是GND、TX、RX、VCC（3.3V）) r0 E0 ^$ }( _6 Y8 Q& [0 i
下边有几个印刷字 73030F7610U_201900，从这个字推测这款光猫与联通F7610u是一样。
' b3 ^. n7 x& ` O
8 [$ R( S! n) V* G
% f5 y! L0 P% d1 q5 N我焊接了4根插针，方便后面折腾的时候接线，没有焊接经验，第一次GND还虚焊了，折腾了好一会才发现。# P2 P; F% j, V8 j: `* w
! i* K7 {! u$ {+ o' g0 s' j0 s背面这个芯片应该是闪存# Y5 x' J0 o. ^- `( u8 P: a! r0 O
?3 S/ L! ~" l, M% |
5 o& z/ i. S" N! d芯片屏蔽罩没有拆开，嫌麻烦，借用一下别人的拆机图看下" U: K/ ^; c; O. E5 g
" h+ N' h F4 W M4 u
0 A. B) g. P7 l- f }( F$ f- w! A
1 ]- }' U6 X# F
d. k- R+ X/ ?0 b4 U O
' i+ ]( N9 \6 C* E1 M2、TTL进uboot很顺利，默认中断时间是1秒，输入任意键就可中断进入uboot：
/ o f' c) {* V0 o8 y5 C2 y [Boot SPI NAND2 E2 q( d) d @# r
enter bootloader...9 f: f, g) M$ _0 `7 q: K
secure uboot! N8 a7 ?7 u! \, e" R0 [
verify aes key OK!7 l. a$ _, d5 {2 }; Q6 H# j. O
verify puk OK!
6 A$ y d+ ^4 D h7 R: W. }# y! zverify uboot OK!' ^& n1 c: y: d" X
verify pub_n OK!" | O+ c" X- X2 i" B$ j
Jump+ f9 G" l3 N8 t" _1 B: y( r3 _
ddr init
: F8 S& U" e+ I4 _2 H6 k( q' z& `ok
$ `. o) h: m4 G8 Q5 |9 u h6 w* P. _: m. o6 i }
U-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)' ^6 Y3 b) P* f" V t
) M8 X( @" J$ R
CPU : ZX279131@A53,900MHZ( J4 o8 a; V$ B/ ]; R% J; z) ?
Board: ZTE zx279131evb* j& S9 e6 {( i. Z6 k1 E* c$ p7 v
DRAM: 512 MiB
) ]6 [, U6 m- `! j, I1 j3 C( V3 zproduct_vid = 130
$ G# R' x% N$ D% i" _9 _vid=130-F7610M& l% m* a8 s5 Z$ e) k% U# a T! M
mtk reset,60
* h4 r ^: M& B2 T h% fbootsel=3' s' w N+ ]) ?9 o; n0 c- K3 @9 d6 A
NAND: bootsel=3
- s3 W ]# {' A9 u( q5 Rmanuid=c9,526 ~! u" j- b S7 s
HY SPI NAND HYF2GQ4UAACAE 256MiB 3,3V. U- \) {! N: H/ N. @- a/ t5 E
256 MiB, MLC, erase size: 128 KiB, page size: 2048, OOB size: 64
1 r, Q. C! x: X" l256 MiB
) U5 l8 E. b. Y7 i3 ?: l) P5 TIn: serial
) i! G( v, U$ u; tOut: serial
2 L' S5 U: z2 s; o. U" [Err: serial1 a6 y0 }! z7 i3 w4 X5 ?
usb3.0-reset
# ?2 C$ O: h. e6 d$ d& d5 Pclk_pll env is not setted, core clk won't change& F7 l$ d, J+ e/ g {2 W- A
Net: mdio_miiphy_initialize
0 y0 x6 |- K6 P6 n) S3 q; naddr 0x10e1004c before value is ff
0 l5 X7 i6 \' ?! ]. Oaddr 0x10e1004c after value is ff80ff1 {! j+ W. g- j$ a) m% W4 X: Z( L' R7 H
after mdio_miiphy_initialize0 q% H. o8 [, P! K. c1 m
ref_clk_set success!
! a* q, Y `( d ~eth0
! w' g2 o; Y& l- b# ?### main_loop entered: bootdelay=12 K8 P# R+ x3 ^6 P
9 _# _1 m/ R- w+ u/ U8 ^$ k) ^
版本信息：
- A6 k/ }9 @- T=> version
- z, J4 ]( r! _" g5 l+ VU-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)
- p6 W5 J9 `2 C
4 N2 B* C& |! m$ Naarch64-linux-gcc.br_real (Buildroot 2017.05-svn2186) 5.3.1 20160412
. k7 I) I, n% N: M3 P) dGNU ld (GNU Binutils) 2.27
4 H& F9 u1 S8 q* U2 F- ^. C, `2 M# Z+ T6 {3 d! a
主板信息：
! t8 Y' P% @, S2 \5 n=> bdinfo, g; d' g; ]+ g3 |, i5 y3 \
arch_number = 0x0004425B/ K5 o% b1 B! l
boot_params = 0x80000100/ m0 V+ y! x; ~3 U: i) g/ J
DRAM bank = 0x00000000
% f) k: T. b# L1 D) \7 c-> start = 0x80000000
) I& E1 h3 w4 S; v-> size = 0x20000000
* Z( S8 D3 ~8 i+ U' Y' I7 ~eth0name = eth0
1 _3 I3 R; w% Z4 t& e/ Iethaddr = 00:41:71:00:00:50; n/ Z) q5 h j o
current eth = eth0
, ^& e% Y: ~' k' w9 c) N/ Rip_addr = 192.168.1.1- |: F" q9 P5 @% ^$ } A) K" }
baudrate = 115200 bps4 d m" Y9 w& P2 ?: a* d
TLB addr = 0x9FDF00006 W2 T- O5 x4 q. @
relocaddr = 0x9FD87000
; u7 m0 ~4 |+ Xreloc off = 0x17D870008 ~3 N+ R2 T2 c& p) n
irq_sp = 0x9F346E306 C# v3 A; `; E; `
sp start = 0x9F346E30
. n8 E% H2 c/ ]2 u$ q
* r- T9 `+ Q+ d- r- t$ c. z; @$ j变量信息：
8 q2 [7 s( i) G9 }8 ?=> print$ C" t F% w& p- |0 X$ V5 A
baudrate=115200: N" ^* H2 f ?2 h. v) {
bootcmd=setenv bootargs console=$(console) swiotlb=128 root=/dev/mtdblock12 ro rootfstype=jffs2 mem=$(memsize);bootm 0x88000000;# E+ R$ O: f; E
bootdelay=1, ~8 m$ k9 [) g+ c6 `
bootfile=uboot.bin
w) r1 f# n* e: K0 _bootromfile=bootrom.bin
0 E% a% P. I5 X7 X2 r u& n+ Vconsole=ttyAMA0,115200n89 ~1 Q8 t# I' D. O4 {, u+ P# |
env_na==@@;
* H, ?& C A( V* r4 Xenv_pa==@@;
+ T5 x# ?7 \2 G1 rethact=eth0
' g( H$ g# \+ M+ G$ C2 w, [+ Cethaddr=00:41:71:00:00:50) h. P% x8 `' `8 i. H* n( O, J
filesize=43720f* f& Q, W) m3 ^$ P% T5 v2 [+ |
fullfile=upgrade.bin+ t. [1 D' [7 B/ ^" L% p& O
gatewayip=192.168.1.1
9 L3 z5 a* n! T% }hostname=unknown, g" H1 k1 n0 W; D0 _2 {( r; O) |
ipaddr=192.168.1.1! S! h9 P$ z2 k
linuzfile=vmlinuz.bin8 t* P+ P# C9 Q1 Y% S3 E$ A
memsize=512M8 n( t C+ G4 n
netmask=255.255.255.05 e. C1 U: n# w$ Z
netretry=5; A% g% k. K% h0 H
serverip=192.168.1.100) G$ }# H7 i! f- J# _
stderr=serial. D, K: {/ H9 k+ g/ r, j' T
stdin=serial- z; M9 [9 ^8 ^5 Z) K/ `! |) m
stdout=serial
& F; d* `3 b& j/ M* |) ^3 yver=U-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)
4 l- q* r x7 }2 Z: yversioninfo=U-Boot V2.3.0P1N9 20220823211658 0x680000 0x0 0x8f 0x837 M" [) ~( s, z& H9 j- G" j
Environment size: 688/131068 bytes
7 n' U1 N* S# L5 _
4 |7 p( q8 F5 B. {. B ]3 {1 M命令：
) N R+ v% t& j7 _2 B=> help
5 p8 V7 Z% u2 w: _* v$ s? - alias for 'help'
8 D5 C# D1 _+ b) Bbdinfo - print Board Info structure5 K5 Y! Q8 y" _
bootk - boot kernel
! t' g% m9 s+ Fbootm - boot application image from memory8 H" t! K. [1 P5 z4 e
bootzpon- Boot zte pon img from flash device" l+ W1 C9 _/ P, C
cmp - memory compare& N5 _/ A! X/ o- O# u
cp - memory copy
3 F5 P; K0 c1 @( u4 j" i4 ndownver - upgrade software downloaded from TFTP server
+ y. q3 }7 W) \* P; ^( N0 B$ I; Kenv - environment handling commands' g- v0 S) j' p' n& a( L
fdt - flattened device tree utility commands
6 E, U: s9 c( s( c% f- }fsinfo - print information about filesystems; z- k+ B Z2 g
fsload - load binary file from a filesystem image
4 @; J, \$ w( `1 h) f$ J8 Ego - start application at address 'addr'
& q' q$ q, W. H+ \# @9 Egpiotest- gpiotest dir [num] [in/out];gpiotest value [num] [1/0];gpiotest gvalue [num]
1 H( J3 E# |5 xhelp - print command description/usage
8 ~( w3 i) ~. r: @ls - list files in a directory (default /)
3 @. P- o4 X N' t3 F( I( lmd - memory display
# v5 Y, K6 I8 Q0 x! B" omii - MII utility commands
: \ O8 _1 i" c, b7 K- i- V! Xmt - memory test
7 I+ Q: z. {3 o+ `( j$ \) B8 Z$ dmw - memory write (fill)3 q& h5 }' Y m( G! B a
nand - NAND sub-system. X! ]) {( Y( ?' J7 ?; @2 y
netdebug- set net debug count
) e8 e1 h" D8 \# c, P# aphy_init- phy_init' e; Q8 D1 ]! H; t \; y
ping - send ICMP ECHO_REQUEST to network host* @- K+ }& A8 N, G
printenv- print environment variables, H! m6 D; ?* ?
reset - Perform RESET of the CPU
; t1 g' L$ B5 b6 ~$ S5 h& X3 Frun - run commands in an environment variable! n; r2 O& Z$ L
saveenv - save environment variables to persistent storage& {; @ D1 D a. X$ n
setenv - set environment variables/ R7 v; M5 {9 x% o
tftp - boot image via network using TFTP protocol
6 H' l; P7 J4 y! x7 Ptftpput - TFTP put command, for uploading files to a server. h1 W4 J2 S2 e, x9 u0 X
version - print monitor, compiler and linker version
8 K2 s) A$ k! a( x4 x7 e2 y# Hxmodem - xmodem
7 f6 J7 e5 f4 M! e
0 L! z+ g- q5 g; `3、但是TTL进root就被屏蔽了，好像运行到启动内核时，TTL就中断显示输出了1 U, D4 O7 Y; h" M' d
5 ?1 A1 g1 v+ K6 d7 v+ v
' b$ W& j9 D, Y# o' R
Boot SPI NAND$ i) p! g, Z8 v
enter bootloader...
/ K. J" v. P' T+ C5 N; Y$ F, j msecure uboot; X4 }" j# S- c4 H
verify aes key OK!
. s% `; F& k# h" Jverify puk OK!
8 S4 k, }/ G V8 Z0 x! ~4 ?verify uboot OK!
0 ]9 m! V' _1 l% f" b' c7 \9 sverify pub_n OK!, ]; d' t2 V$ O n9 f& i
Jump2 L% e( F6 i2 X8 K9 U$ X+ w
ddr init
+ q3 E4 C8 j# f7 ]ok+ Q& K9 d) B, \. C# z
4 N, V9 `) Y% }1 ?1 ~. n, Q" {0 l/ g" x# F- h# Z8 V
U-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)! d M, l( z5 I/ p9 m
- E i8 J- D; i! k, N' @& p! v
CPU : ZX279131@A53,900MHZ
# s7 P& B3 u- [Board: ZTE zx279131evb
! x3 u6 a3 z2 l5 ^6 z. s* R% gDRAM: 512 MiB
7 Y/ F* D/ T- W7 B3 E$ |8 ~product_vid = 130
8 D' B" M' I d+ D2 O/ p; ^/ }* e: {vid=130-F7610M" d3 H# X M A3 _/ S
mtk reset,60
4 Q) Z( _; X2 f X A" P* g; gbootsel=39 G' l) j- E) e! m y* e
NAND: bootsel=3
9 ]8 Y7 S9 q5 ?manuid=c9,52
4 w! b+ E9 e1 Z) i% SHY SPI NAND HYF2GQ4UAACAE 256MiB 3,3V
: @* k. [& t. l/ P) |256 MiB, MLC, erase size: 128 KiB, page size: 2048, OOB size: 64' a% |% `- _# z
256 MiB
8 o6 n; V! a, f8 A2 rIn: serial
9 p. \6 E% r, L0 L. _Out: serial5 Z: [. Q' ~* i0 Z& q* ]
Err: serial+ o1 R% b$ L- p
usb3.0-reset; Z$ _, {8 V9 t! h
clk_pll env is not setted, core clk won't change3 f3 l) H. J. \% l' `
Net: mdio_miiphy_initialize
8 ^, T! w7 h iaddr 0x10e1004c before value is ff1 i5 `6 X" Z3 r1 ]3 T% y
addr 0x10e1004c after value is ff80ff$ L) n; q+ n! i; I' V4 d/ A
after mdio_miiphy_initialize8 T' a7 c' Y, @1 q2 g. Y# K/ J& L
ref_clk_set success!8 a8 O, a" |; W# ?
eth0
; v$ O% B* [) H### main_loop entered: bootdelay=15 |& I' ~1 F- P* P s* l" }
' ~6 W: H7 \# R" [ N# W
Hit any key to stop autoboot: 0- }* c& {3 K% }! ~ M
zboot info init done!
5 E4 n7 C* v: A& p: b; N: e2 Z6 hskip bad block...addr=0x1000000
* x9 {' |3 V- I2 ]; {select=0x0
) R1 P) c) ^; f( h3 o<nand_read_skip_bad_,1128>!mtdpart=0x6,offset=0x0,mtdpartoffset=0x100000,mtdPartsize=0x80000,length=0x1000 }5 n+ U, @. N+ t( V
tmp=0x00000000, value=0
- T7 f9 m# L, J; V+ E4 d: K1 Lselect=0x0
" M1 m) e+ V+ b j. Q. q8 n vsearch=0x29 a+ i1 \3 `" Q; M3 B5 ^$ A
search->result[0].entry=680240,offset=240, o1 p/ |! P9 k9 h# F/ u
<nand_read_skip_bad_,1128>!mtdpart=0x2,offset=0x0,mtdpartoffset=0x680000,mtdPartsize=0x2300000,length=0x1ee00006 x5 E H0 P+ m
<nand_read_skip_bad_,1148>!Skipping bad block 0x1000000( A1 e) J+ ? l! u
RSA Verify OK+ v/ ~: a$ y6 s5 Z4 S6 U
verify vmlinuz success!!7 `% C) p2 x$ g) L( L
! q& x% Z8 o" U0 o$ l7 ?) ?
---mtdparts_init--current_mtd_partnum=0-/ Z4 l7 J2 c. j0 {; T
dev id: type = 2, num = 0, size = 0xffffffff, mtd_id = single part9 x5 p; ^! R# s6 H* w# t
part : name = rootfs0, size = 0x1ec0000, offset = 0x6a0000
6 r# h1 n0 o' \& Q9 `! s* {5 M2 zpart : name = rootfs1, size = 0x1ec0000, offset = 0x29a0000' `! C' i2 Q" a/ d1 k5 ^
5 C3 Q, o. u, @) q2 z--- jffs2_part_info: partition number 0 for device nand0 (single part)
' f+ O+ O7 Y8 ?3 c2 O1 S! xjffs2_part_info:rootfs0,6a0000/ J: H; M a( r/ R0 Z3 r( ?2 P; y
### JFFS2 loading '0uImage' to 0x88000000
4 @ J% Q0 s/ ? s7 fScanning JFFS2 FS: .. fsload_skip_bad_offset=ll1000000 ............... done.0 l3 q+ ^8 L8 w/ `3 r0 b( h( ]
### JFFS2 load complete: 4420111 bytes loaded to 0x88000000
$ a% N' C4 I, D5 d, I9 z<nand_read_skip_bad_,1128>!mtdpart=0x0,offset=0x0,mtdpartoffset=0x20000,mtdPartsize=0xa0000,length=0x80000
0 H [( ?8 P9 O P5 Llseek=0x8c064800
& }5 z% y; f, w" ]6 Q- s& D- w! ]cmdline=U-Boot V2.3.0P1N9 202208232116589 u+ b( M, T8 H# P7 D% B9 f
kernel start step1..images->state:70f a/ q' j$ G1 s0 ~
==BOOTM_STATE_START:1
# e1 z: v9 I. A% p' C ==BOOTM_STATE_FINDOS:2, G" _, X7 s9 Q! h$ [+ K
## Loading kernel from FIT Image at 88000000 ...( {4 c; f8 C4 l$ I
Using 'conf@131G' configuration
% a) J+ T8 X# }8 b; l; x+ b Trying 'kernel@A53' kernel subimage3 Z$ O9 d5 S& q2 O! r& C2 s* N
Description: Unify(TODO) Linux kernel for project-131G7 h) `6 C. U' B. U) J2 Z# P+ n: M
Type: Kernel Image
# v* @4 c0 X4 t% S" `1 G! k/ _ Compression: gzip compressed
9 T6 d( R$ q/ l3 l- E Data Start: 0x880000f8
+ D- C* A# L4 ?' r( K E Data Size: 4410949 Bytes = 4.2 MiB8 ^, p# v' R% B* ]/ W2 H
Architecture: AArch64
1 s/ z: y+ [9 E B! C+ B h( w OS: Linux {6 p' W1 U; X3 ^! H
Load Address: 0x800800002 p; A% Z9 [6 j. ? r/ H
Entry Point: 0x80080000
/ e% [) o5 [: f Verifying Hash Integrity ... OK
q3 `+ ]. Z! u! O ==BOOTM_STATE_FINDOTHER:41 l$ S4 d( u5 H3 _" _% n
## Loading fdt from FIT Image at 88000000 ...
# Z/ W! Z- m; H6 s- w Using 'conf@131G' configuration$ r! ^: r" E% q9 s' ]" y8 g
Trying 'fdt@131G' fdt subimage% E( e/ c. ~7 {0 [$ i4 R
Description: Flattened Device Tree blob for project-131G
4 q+ ?/ _, ~% p6 M/ y1 K3 E Type: Flat Device Tree" ^, s8 x' h! T& ?; C5 n- |7 E
Compression: uncompressed
* J4 H8 D; j+ M# a$ a3 {$ S% ?; Z Data Start: 0x88435010( h% {# l5 }/ J# M) O8 u
Data Size: 7859 Bytes = 7.7 KiB2 g' q$ Q, w T5 t) S0 j" z
Architecture: AArch64
% |) d# q" Q) ?& ]6 u: j. b5 U8 m Verifying Hash Integrity ... OK7 c' N! T$ t, u0 c5 J1 d+ t1 b
Booting using the fdt blob at 0x88435010- p9 h8 d0 m E {4 g
==BOOTM_STATE_LOADOS:8
1 R8 O/ W) @0 c9 N/ P$ G$ B Uncompressing Kernel Image ... OK3 D: }- J w) S0 W0 @
kernel start step6..& V% J+ T! M( @2 X
Loading Device Tree to 0000000083ffb000, end 0000000083fffeb2 ... OK
& V6 I2 E! l. e8 z% C; B7 F3 Z! C0 l& s1 F) k
Starting kernel ...
) k+ @( ]( N; R* `; F1 t0 y3 r6 n
CPUID:0 try wake up secondary cpu from rom.
# r$ o n2 o: n" H# MCPUID:1 wake up from rom.- {, l' Q& @3 s5 P) e! o
init psci ok!!
' M) E4 m" x9 G. J# A0 _
" t! J8 d' y9 {, V. \到这就没有任何输出了，也无法输入，TTL进入root开启telnet的路给堵死了，有知道的大神给个指点。
% C8 ^" y+ g4 R3 j k4 x5 \* a) b) h# H" u2 k7 k4 G2 ^
3、开启telnet. d% q b; Y' z5 k& t& T
那只能工具开启临时telnet，幸好在论坛找到了mayi5147大神的telnet工具可以开启，也顺利的固化了telnet。
$ K U0 S4 I* n/ n
3 f* Y0 N4 ]7 Z3 w/ # cat /proc/mtd
0 ]" d: |' D; `" F7 ]/ pdev: size erasesize name L5 S* V J& G! s
mtd0: 10000000 00020000 "whole flash"9 Q, u. L6 {+ r7 B: J! l
mtd1: 000e0000 00020000 "u-boot"
% b" S: t0 R- wmtd2: 00080000 00020000 "others"
" ^) ^: \1 K2 i( K# p1 ^- Gmtd3: 00100000 00020000 "parameter tags"
4 l$ R9 v- q; {, smtd4: 00100000 00020000 "wlan"
! `3 [. y! W( {! Z( _6 emtd5: 00200000 00020000 "usercfg"
+ B3 I9 ]7 v4 w* F7 z9 E5 Jmtd6: 00100000 00020000 "middle"& G. y, d# K5 r8 {1 r' j4 O
mtd7: 02300000 00020000 "kernel1", S4 \) _# o+ O: f' u/ x
mtd8: 02300000 00020000 "kernel2"! @3 j9 Z9 C1 n" H/ S1 M8 d
mtd9: 03900000 00020000 "osgi1"1 B! z# q3 r5 D- _
mtd10: 03900000 00020000 "osgi2"+ Q: Y+ C6 S) G" @5 k0 h
mtd11: 04180000 00020000 "plugin_data". f7 M. d+ o: ?& s2 Y
mtd12: 022e0000 00020000 "rootfs"
" c* L: b& C4 F1 O7 zmtd13: 00020000 00020000 "bootrom"6 t" J" B" n0 v. t+ w& e
; @) Y( F% p+ ]2 w, V$ h7 x
/ # cat /proc/csp/versionstates
- v; B0 `2 ~( v. e+ J* w( Vbaseaddress : 0x680000$ M5 r. W4 G& ~6 r$ O
current : 0
+ Q/ h# R8 l% M' ~+ B' p; t& z5 eversion1states : 0x8f3 Q/ t) ~2 q6 w5 q W
version2states : 0x83
6 k" b; k& E& p% M4 s$ G____________________________________________________! {, {' D( E+ ]% G
Index Running Latest CRC Integrality Type c9 e( `; D! K4 E
----------------------------------------------------3 P$ N. q# a% i( B1 J0 e6 @
0 Y Y Y Y Upg" a: _4 A% `/ g( u$ s' _5 M ?! C, L
1 N Y N Y Upg
8 `% N4 Y w1 b8 s5 k- z/ W----------------------------------------------------5 I% w8 F1 w3 i3 O0 L$ u/ g
4 H2 P3 y2 F0 m0 n
$ B; e4 t( O: T, a [" h* w/proc # cat cpuinfo
6 [) w. @3 U+ [- S" X. Aprocessor : 01 z: Y s; V7 } G- r- k
BogoMIPS : 50.00
3 l9 k3 m* W) w1 I4 x5 w/ qFeatures : fp asimd crc32
, X- S' i; ~3 e9 P; B) {/ Z _9 }CPU implementer : 0x41
' \! W" } U6 {* |+ \CPU architecture: 8
3 i5 C& q v) wCPU variant : 0x0
* z A+ B2 F+ B$ t5 I" E6 ZCPU part : 0xd03
0 G2 R& ]( V: U# r' o4 X8 P; FCPU revision : 4) q' s; F9 ` _
, a3 V+ K# J: T% ?
processor : 1
. G6 [5 b1 C0 j# C. H* kBogoMIPS : 50.00. s0 q8 n: M4 q7 \6 t
Features : fp asimd crc32
( G! O! w& ]: Z7 z. ECPU implementer : 0x41
& Q* W7 i1 ?5 rCPU architecture: 89 D4 h; r+ p, x$ e/ O
CPU variant : 0x06 K* A2 r1 v5 X# F) S( j
CPU part : 0xd03
9 k! e5 y v5 ~: F) s/ OCPU revision : 45 i/ z! x2 M3 C/ s
$ ]) S. B& d( K* O7 t6 K* ?
7 t0 U5 M. `) @' w4、使用dd备份分区：
. {$ u0 q4 ~4 d+ Xdd if=/dev/mtd1 of=/mnt/usb1_1/mtd1.bin
3 D' K8 M" t; h2 x8 C. o/ zdd if=/dev/mtd2 of=/mnt/usb1_1/mtd2.bin
8 b# U9 q' K6 G8 W5 o$ V* c3 Edd if=/dev/mtd3 of=/mnt/usb1_1/mtd3.bin! M* I- X2 T) R! w% H. F
dd if=/dev/mtd4 of=/mnt/usb1_1/mtd4.bin
) W1 D1 ~; ^5 n+ _+ I) I/ H& Vdd if=/dev/mtd5 of=/mnt/usb1_1/mtd5.bin' X( s" j" c5 d! l% y9 T
dd if=/dev/mtd6 of=/mnt/usb1_1/mtd6.bin. L* R% O8 S) t' F' S% W
dd if=/dev/mtd7 of=/mnt/usb1_1/mtd7.bin
8 w" V# q- d+ B& w1 J- cdd if=/dev/mtd8 of=/mnt/usb1_1/mtd8.bin" d1 {7 b1 D9 s$ ~* @+ N" L1 u
dd if=/dev/mtd9 of=/mnt/usb1_1/mtd9.bin- M) v# n/ q2 w
dd if=/dev/mtd10 of=/mnt/usb1_1/mtd10.bin
* ]5 A" v2 V1 M1 ydd if=/dev/mtd11 of=/mnt/usb1_1/mtd11.bin9 v2 Z& ^: S" J4 t) ^! G3 t
dd if=/dev/mtd12 of=/mnt/usb1_1/mtd12.bin
& h( X* E8 j- m. ~$ e0 K6 a% I- }
, g9 S; b7 s* v' _以上备份都能正常执行，但是mtd0全区备份，mtd13备份出错，具体原因不知。
7 j' J2 g' X+ T' u6 |6 m2 x) ~/proc # dd if=/dev/mtd0 of=/mnt/usb1_1/mtd0.bin
% L/ n) G% b \' x6 xdd: /dev/mtd0: Invalid argument
: t$ d) I' E; L5 `, Q/ v0 O/proc # dd if=/dev/mtd13 of=/mnt/usb1_1/mtd13.bin& F& }+ N: B3 X, Z4 m( f0 g
dd: /dev/mtd13: Invalid argument
* O, P9 q7 P& [: B, T- n9 H: o
3 [8 `0 L/ A+ b, q! a) V软件版本号V2.3.0P1T10% M# }. | ^% m+ J3 Q
备份的分区：链接：https://pan.baidu.com/s/1JW22fVaciXBW6F_gj98_7A?pwd=vx9q 提取码：vx9q
% h) a/ ^, D$ B7 X3 q1 n; S2 z; V& |& D! j4 `3 D) a
5、TTL刷联通固件
6 D* u& {: a# W* [3 b' S/ }我的想法是，mtd1"u-boot"分区不动，其他分区全部刷成联通的分区，不知道这个想法可行，但是也没有F7610U的分区，只能到此了。3 m% H5 I0 A w. c9 g
2 U/ d* u% t+ G8 T; ^) @% Y500猫粮悬赏
( m: E8 \, k8 j求中兴F7610u光猫分区备份
* }- I3 z! R. g Khttps://www.chinadsl.net/forum.php?mod=viewthread&tid=176942
0 R0 k/ ?( U, N, w- t8 U& {4 Y
3 T A% N+ r4 J$ S+ j补充：9 {4 `2 P# ]& o8 h" c0 H; X
6、提取编程器固件8 |& ^5 \7 F5 C
F7610m的闪存芯片是HYF2GQ4UAACAE，封装类型是wson8，芯片大小是8mm*6mm，于是我就买了一个wson8转dip8的探针，用编译器ch341a提取了固件，已经分享在百度云网盘中。探针要用手扶着，提取花了45分钟，手都快残废了，于是自己利用家里能找到的材料做了一个简易的夹子，终于解放了双手。
* b: b: k) }' O/ i* C6 \* N/ n* R) N8 Q0 M; o
- T5 X: O) m! }3 B% V2 u6 o$ `8 ]
{ T/ E- U& f& X1 [/ o
* g- [4 _ f/ m2024.4.7 uboot下刷写分区( K- K2 e* J; @5 \. y
网友分享了F7610u的kernel、framework分区备份文件，为了保险起见，我在u-boot下刷写了备用分区mtd8、mtd10分区。1 L8 s& N [: S% J. Q
3 ^7 A# U1 b+ e! X3 K: A
3 [- i9 y# N. z. ~; y H- f2 Vtftp 0x88000000 kernel.bin4 S* c+ C2 _) ^7 z8 R
擦除mtd8：nand erase 0x02980000 0x023000004 Z- {3 ]6 c# x- x+ E @6 l& w/ U6 s
从内存写入mtd8：nand write 0x88000000 0x02980000 0x02300000/ Q- {% E5 e& l6 I# g
% D# _2 ~# t L7 B
tftp 0x88000000 framework.bin% T/ i: {2 I1 M- l; e+ I4 N
擦除mtd10：nand erase 0x09180000 0x03900000
, }% t2 ^+ u4 x6 C5 [6 o6 F( O从内存写入mtd10：nand write 0x88000000 0x09180000 0x03900000, r* @" X6 A0 V' ]
% w% b4 R# ], Y1 S
重启光猫后，使用upgradetest switchver 1 切换成备用分区启动，但是启动失败，仅仅替换kernel、framework分区不可行！
5 G2 q1 J* {, `+ @5 G7 D$ s也许必须用编程器刷写F7610U的编程器固件才行。# X* \& G% e" r0 C
- N$ f, ]# o8 t% ~0 i
另外：+ F$ W) F9 Z0 A& Z& n! v) R6 R6 L2 B+ K
F7610m在TTL下屏蔽了kernel启动信息，看不到各分区的地址信息，我根据编程器提取的固件，推算了各个分区的地址，如下：
+ `2 P) N: z- H! b5 z6 G7 \+ D$ V8 c
) f' [2 ?: y7 I L
dev: size erasesize name8 ?! O! V P+ t
mtd0: 10000000 00020000 "whole flash"
* Y3 Y! g6 P2 Z( |) T% _0 }2 imtd1: 000e0000 00020000 "u-boot" 0x00020000-0x00100000 ok
/ W; c$ _5 n# d# Y4 [mtd2: 00080000 00020000 "others" 0x00100000-0x00180000 ok3 ^+ [$ X Y' q3 |6 ]5 `2 v" A
mtd3: 00100000 00020000 "parameter tags" 0x00180000-0x00280000 ok6 f( X! Y% l2 E4 b, _: y" r4 p
mtd4: 00100000 00020000 "wlan" 0x00280000-0x00380000 ok5 M4 z& Y8 n& k% E
mtd5: 00200000 00020000 "usercfg" 0x00380000-0x00580000 ok
/ a; j! @7 ?- _+ T; Amtd6: 00100000 00020000 "middle" 0x00580000-0x00680000 ok
a @1 z: m' E: o1 A6 F- Rmtd7: 02300000 00020000 "kernel1" 0x00680000-0x02980000 ok, u6 n+ T! M- X
mtd8: 02300000 00020000 "kernel2" 0x02980000-0x05280000 ok
( Y! `0 p: l8 E1 H7 S7 d% N$ smtd9: 03900000 00020000 "osgi1" 0x05280000-0x09180000 ok
7 U* l9 \9 J8 ~6 R( }2 pmtd10: 03900000 00020000 "osgi2" 0x09180000-0x0ca80000 ok
9 y, [1 T$ R; pmtd11: 04180000 00020000 "plugin_data" 0x0ca80000-0x10c00000 mtd0大小只有10000000，地址是我推算出来的，超出了10000000不知道为什么？
2 O! j/ _) z7 v7 v$ u! R! emtd12: 022e0000 00020000 "rootfs" 0x10c00000-0x12ee0000 mtd0大小只有10000000，地址是我推算出来的，超出了10000000不知道为什么？' j# ^6 U+ m1 i
mtd13: 00020000 00020000 "bootrom" 0x00000000-0x00020000 ok
: ~3 O. v) S* @2 s! H3 @% ~6 a8 Z! F3 ]5 N" e# \7 H# L) D
5 N2 \1 M! T. c# [$ k
3 ^' ]' e6 B5 [, R9 | N
9 p# ^. k0 B% V& Q: B/ x
1 ?; j% n- x& g7 f H$ _4 u3 c. v7 H+ i5 i4 V9 N
5 P" w: R# F' _1 [( O
5 ]/ p& K" M z2 w' u \2 L* e7 L2 h8 J6 R O/ y- M; y: U
( Q+ r2 v6 b4 D( b3 Y
* p! U& I. H: h' C0 n2 t8 ^' `. q6 t' P( Y, t9 U! t' P
% n, @; N1 r* Q. t( L& T+ L% v: {5 l# {+ I7 x1 `! m
) R; Z' c" P' p$ G9 y3 h% T! w! g& t
, b" q- M: W4 f& I. O0 N2 s9 y7 J& Z6 N1 k5 o0 m6 I
|
本帖子中包含更多资源
您需要 登录 才可以下载或查看，没有账号？注册
×
|
粤公网安备44152102000001号 
发表于 2024-4-2 12:21:55