|
|
本帖最后由 dalingo 于 2024-4-7 15:26 编辑
( F" @8 q! q- j, o2 L- U/ {& [3 K' M7 Q- E
本人比较喜欢折腾电子产品，因为学的不是相关专业，技术有限，都是一边折腾一边摸索。( w8 n6 R" N2 Z# m) d# F
最近闲来无事看见咸鱼卖移动光猫F7610m比较便宜（30-50元之间），我猜想应该和联通光猫F7610u硬件（80元左右）是一样的，我这是联通宽带，就想着能不能买个F7610m，ttl刷联通固件改成F7610u。" i+ j& K- G* k8 B6 H/ s
花38元淘来一个，就开始折腾，结果发现碰见不少问题，想来请教各位大神帮忙。
/ I9 A* |" s) C7 |+ @" Y7 }/ Q0 v$ y/ K
9 \" }, n' ~ P( U: L' P# f+ N0 a5 X) ^& H
9 e" e( w0 o3 J0 g
1、拆机& z- x9 e+ e, r3 p
底部四个螺丝，用十字螺丝刀取下，背面右边有个缺口，用一字螺丝刀一撬就打开了
, D; S7 {: F0 w! h$ r
& S- n4 O* }: P4 ?内部图片，中间下面有一排四个孔就是TTL，从左到右分别是GND、TX、RX、VCC（3.3V）2 t2 }7 F5 A" R) v# ~# z3 y
下边有几个印刷字 73030F7610U_201900，从这个字推测这款光猫与联通F7610u是一样。. h A# A( b* X
& \! \( J' E# J8 H
$ y7 l& Z* j. Z3 d7 C3 w! G我焊接了4根插针，方便后面折腾的时候接线，没有焊接经验，第一次GND还虚焊了，折腾了好一会才发现。
7 [# g8 n; ~$ l* ]
/ x: G$ C- P, C8 W" c9 z' n' Y9 H. P4 q背面这个芯片应该是闪存! U( I, v% L' K8 I: `; q
% P. b6 S3 a" ^
, g6 F7 [2 G& H8 W; |& J, ]: w! J芯片屏蔽罩没有拆开，嫌麻烦，借用一下别人的拆机图看下3 C- }6 m1 m0 ~1 n8 B
7 k# N4 Q. d7 l! j7 x7 X* M# g0 Q) o( _
$ U( ~4 L# Y& O8 L* w: y* x4 S
" b q: e+ i$ `" H% }3 i8 M
& T1 r9 j. I, `, b4 p2、TTL进uboot很顺利，默认中断时间是1秒，输入任意键就可中断进入uboot：& R. o: Y. ?9 [
Boot SPI NAND
; N" d! [4 D/ ^1 Y9 oenter bootloader...
. X/ c5 {: P, c/ m( A- `secure uboot) q" `/ D- t) a
verify aes key OK!
- ?0 N* H* [. Dverify puk OK!
9 Z9 |% M I) mverify uboot OK!+ U, B! j. Q- ^# i6 |
verify pub_n OK!1 x8 \- C. H8 [0 E7 J4 _
Jump
# y5 l# k: K1 f; V7 Nddr init
+ _7 T8 h; I2 n8 Yok
) H4 _. ^5 C$ [0 i0 e* j2 ?& L$ G0 B5 Q
U-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)
" r/ Z( l9 q8 P) R: y
2 `( R, P Y& iCPU : ZX279131@A53,900MHZ- p( n" t$ W$ [* m& t
Board: ZTE zx279131evb/ R, F# e* q- Z( m* P- Q
DRAM: 512 MiB
+ a; C6 M2 e& e) ^3 X% v# Hproduct_vid = 130- w6 t; C) |* V. J v# Q
vid=130-F7610M
2 r. X* ?$ h$ ~6 Omtk reset,60- l0 G V6 `- V3 `
bootsel=38 x6 L4 P9 b0 p
NAND: bootsel=34 S% X i% b0 Y* D4 F
manuid=c9,52
( F7 Q( Z6 a( J0 u% f, QHY SPI NAND HYF2GQ4UAACAE 256MiB 3,3V
0 o$ M6 I1 E! D) h, v256 MiB, MLC, erase size: 128 KiB, page size: 2048, OOB size: 64
* N8 k" E, v6 ]256 MiB
" |9 [( W& J2 mIn: serial) D1 h1 b- H: B* {/ [0 O
Out: serial
& G: F6 a8 v! ~1 Q H5 IErr: serial
3 E3 i* q2 L$ A4 ^# O, A7 uusb3.0-reset6 u r) n6 B3 I& {
clk_pll env is not setted, core clk won't change
2 i5 @5 D- \. Q' fNet: mdio_miiphy_initialize
1 A: C4 _ I- w9 G2 t" waddr 0x10e1004c before value is ff9 r+ A- M) O) B) @* @! E9 h: t6 y
addr 0x10e1004c after value is ff80ff1 \8 t, v) z# @9 E) t9 K
after mdio_miiphy_initialize; x( r I% L0 W( J% z5 h
ref_clk_set success!
! |; S. X# U* I I& {0 X! \6 _5 Xeth0
# b, V# G& O3 E3 L- E7 I### main_loop entered: bootdelay=1
9 A2 N J) N/ ^: m4 G# D8 l+ {, X; f7 _ O# K" I- `
版本信息：
2 T" L& _6 @+ u=> version
& ^* u) X1 L" b) ]$ R9 T9 dU-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)
7 W' z y' c+ U+ v" A; N$ o. C! \# ?9 X# P7 t/ _
aarch64-linux-gcc.br_real (Buildroot 2017.05-svn2186) 5.3.1 20160412( V- F7 ?0 Z2 [/ @
GNU ld (GNU Binutils) 2.27- `( t2 ?: R# N* u- d
* X0 \) g% ^; i2 M8 E; W2 I主板信息：8 X' `8 h- D' y; i# M) }
=> bdinfo
( V! _- k V2 i3 d* tarch_number = 0x0004425B
- d! v/ ]2 Y, a% k' x; A- lboot_params = 0x80000100. }" h8 T1 T8 H: }- i
DRAM bank = 0x00000000
) `1 |/ L; k% `! U-> start = 0x800000009 u! x- H. S* e8 X
-> size = 0x20000000
& Z& }0 s2 l% b! n; m7 T$ F: ]eth0name = eth0
4 Y0 m5 ~ ]; X- Oethaddr = 00:41:71:00:00:50
% i/ Y, H9 W6 |* |7 i {% ucurrent eth = eth0
) ^- R. |1 S9 D; W4 Gip_addr = 192.168.1.1
d, z$ T9 q* ]& ]; I2 A- }baudrate = 115200 bps# r. X" E0 h( _- l: r4 x
TLB addr = 0x9FDF0000
/ W: t; t# o! V, drelocaddr = 0x9FD87000
4 e4 N- D6 @( x# c% ~reloc off = 0x17D87000
o6 ]; t7 q( S: y& pirq_sp = 0x9F346E309 F4 B0 W5 e0 v! F2 v: e" m
sp start = 0x9F346E30. Z; t3 Z& [) E; D6 w4 O' ~
6 ]9 `# u+ x, ^变量信息：6 X" s# j6 l- l% L
=> print2 d; H4 ~ X% I$ H% k9 m, i
baudrate=115200* l- ?0 f. Q3 N" r" a! h. F: S
bootcmd=setenv bootargs console=$(console) swiotlb=128 root=/dev/mtdblock12 ro rootfstype=jffs2 mem=$(memsize);bootm 0x88000000;
4 f" b. } D+ ^2 wbootdelay=1
/ u: Q" @, `, o8 _2 R3 x" B1 Rbootfile=uboot.bin
9 M' }2 R) w0 B) O! U# _3 A( B& hbootromfile=bootrom.bin! \5 e5 d, W, [: R- D; J: q+ N3 C
console=ttyAMA0,115200n8) _0 e4 E' V E; l4 R% e
env_na==@@;
# x4 u# a0 N# h1 |& m$ j3 @5 R: Fenv_pa==@@;* d0 o. L7 U5 E* U
ethact=eth0. s2 G; [5 L, \; }
ethaddr=00:41:71:00:00:50
0 }2 G j% f" {" \9 Ufilesize=43720f
& b( o1 e1 P2 G4 \/ M7 R/ {fullfile=upgrade.bin
+ t' @; H8 g8 b4 V7 j: ugatewayip=192.168.1.19 Y6 ~+ D% p, ^% N2 o! K$ u
hostname=unknown% X3 q& e4 E2 ^) h* F
ipaddr=192.168.1.1) i+ U2 K% v- z: _
linuzfile=vmlinuz.bin
7 {: c; X% O8 J3 nmemsize=512M4 A" }4 C8 [3 v* `3 E6 M
netmask=255.255.255.0 |$ e K" ]( I. J; f6 \& s5 F) H
netretry=5
' R: _8 D( U' T4 {( e9 d- }6 r* iserverip=192.168.1.100% J m+ Z9 U; A. E w% e/ K
stderr=serial% v6 [& Q: J2 V0 m: ?/ I
stdin=serial) A0 L! Z0 _) k5 g+ [5 {" m& T
stdout=serial
j! }) x' ~& B$ Aver=U-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)$ c: q j1 x5 z: v1 C# O. K
versioninfo=U-Boot V2.3.0P1N9 20220823211658 0x680000 0x0 0x8f 0x83
* m% e3 g1 R6 [, FEnvironment size: 688/131068 bytes# @$ T2 z' ]$ r9 m1 l
7 d8 a: T9 z: z2 [: \; ^5 z
命令： n8 S O) i1 i' L+ P
=> help0 b* x( h4 V- I! y2 T
? - alias for 'help'/ I& F3 i# x5 }
bdinfo - print Board Info structure
' I) U7 u, G, I2 d# z9 }bootk - boot kernel- v4 J7 I. W2 i& Y' W' K2 E" J/ ]
bootm - boot application image from memory
. F; @, N0 ?, B }- mbootzpon- Boot zte pon img from flash device
3 r- [' Z( P% Z a# r$ fcmp - memory compare
6 O' c, m V) @0 n2 mcp - memory copy9 W: l# Q1 c: }3 H
downver - upgrade software downloaded from TFTP server
+ E. h. q2 E* l' d# [1 _: Z" Fenv - environment handling commands
8 q3 O8 b5 X3 {: b C+ Ffdt - flattened device tree utility commands
, P( u5 P* }* B8 ~fsinfo - print information about filesystems
& c& u* j W$ `- M+ u2 lfsload - load binary file from a filesystem image
& Z8 C" s: c3 C5 o3 g3 vgo - start application at address 'addr'4 `9 J1 _# I6 b, R: M
gpiotest- gpiotest dir [num] [in/out];gpiotest value [num] [1/0];gpiotest gvalue [num]$ b% ? Q& c! x9 D- g9 `
help - print command description/usage2 e# ?0 ^0 f+ G2 l7 S, I& S6 D7 ~& x
ls - list files in a directory (default /)
- i0 l3 i+ d4 J" r3 ~* O6 j! _md - memory display
6 L; y0 Z. J( i9 G6 b- C. q$ gmii - MII utility commands, h" s9 N6 |" v
mt - memory test
; L1 E2 \2 h0 Q3 W' s- z( }6 Pmw - memory write (fill)
& D. ?9 U7 s1 {$ v2 rnand - NAND sub-system
* D; U% f1 G$ B G# W9 Lnetdebug- set net debug count
q* F, c! D5 X6 N( l2 cphy_init- phy_init0 \! Z7 D% D- k# ^5 Y* y1 Q+ M
ping - send ICMP ECHO_REQUEST to network host
: d# r' N+ X+ c" b p. Y. c2 Aprintenv- print environment variables
: y+ p9 ?" o9 D/ n2 {+ z$ r# nreset - Perform RESET of the CPU
/ T9 r# I+ p' a2 E2 ?$ N% F5 p# N. grun - run commands in an environment variable
( y1 \9 O# o' N! t( Xsaveenv - save environment variables to persistent storage
+ b. W- M2 e. o" k8 Asetenv - set environment variables
; c7 R7 U$ |& ^, W+ C# ?. ltftp - boot image via network using TFTP protocol
/ S- g6 T" N0 ~( Etftpput - TFTP put command, for uploading files to a server
9 b1 ^8 G! l; P- N4 Eversion - print monitor, compiler and linker version
3 B1 V5 @8 U' U$ Wxmodem - xmodem
" |: Q) u+ O; G0 Y
# I+ _% G2 X$ n- U3、但是TTL进root就被屏蔽了，好像运行到启动内核时，TTL就中断显示输出了# n" S; K1 r4 g( G5 Y; [
8 o) [' F7 ?/ h9 x1 ^7 q$ E% y7 V% f3 y8 f7 E
Boot SPI NAND2 @% p$ I, a9 K5 ^8 W
enter bootloader...
5 m8 U x1 |2 @# E' s8 B, v' psecure uboot" e0 J/ _$ y- c: }$ l* J4 L7 @; t
verify aes key OK!/ K5 t$ d5 x0 E( J
verify puk OK!( Q, E- F" U+ b5 \6 i
verify uboot OK!* y) K+ F3 v5 Y* T( L
verify pub_n OK!
# d! p2 W5 V6 m# S9 G }Jump
( n" ?6 U, B" i% ]8 [' L% w7 Pddr init1 Q' ~ R: V) Y. k T1 i- K
ok( v) u- S; }' c6 X H1 Z
2 V q- }6 u6 R( v" ] Z
C! ]4 o; v! o" \: j- nU-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)+ S2 U4 L8 a* f( v
8 j; z! k/ u# l; C2 s: |CPU : ZX279131@A53,900MHZ b4 ^9 z7 i" A1 [% j0 E
Board: ZTE zx279131evb
8 W8 }7 w; Z$ CDRAM: 512 MiB% k% P" F ?% O! V/ ^
product_vid = 130; d' W F& K n
vid=130-F7610M
5 |! W/ x9 y! g ] ~mtk reset,60
6 n+ W+ d$ G2 b" j9 \bootsel=3
. L# r; X8 }" v: V5 {4 h5 oNAND: bootsel=3
6 |- d' |) p- x) u; V/ V( mmanuid=c9,52. g& L; C, d% r" F. L
HY SPI NAND HYF2GQ4UAACAE 256MiB 3,3V
# y& G8 v" p$ Y4 S) W256 MiB, MLC, erase size: 128 KiB, page size: 2048, OOB size: 64
2 ~3 D- d; b |: s2 `" x; z256 MiB0 f# W y% m1 Z! y6 D, V, p1 Q/ V
In: serial
; _# P, P: K, @: i4 |5 n" h, F( FOut: serial% R7 a4 A0 g0 D. P
Err: serial
$ t" |* o% X5 \" I" g- l# R7 L" eusb3.0-reset
+ q% R. W4 J' G) F! Q) J V6 z- c+ ^clk_pll env is not setted, core clk won't change
% J4 u6 s" u& G) W, p/ {) t2 G# pNet: mdio_miiphy_initialize+ I# ]! l+ v4 E
addr 0x10e1004c before value is ff" v' J- G7 C1 N
addr 0x10e1004c after value is ff80ff
( X3 o. v2 c6 b4 @1 R2 p2 eafter mdio_miiphy_initialize0 W2 r8 A( l# R' s; a( c
ref_clk_set success!
1 M0 ?1 ]- B. J. F/ H' ~8 v F+ n' Y* A7 zeth0
0 V( p9 u$ C9 `# e- j+ @9 a2 b### main_loop entered: bootdelay=1
# k9 `. X# {& Z4 ~, T6 ]! V0 E; U: L0 K7 O/ j/ O: e7 h0 _
Hit any key to stop autoboot: 0; s4 a( Z" P1 S( r, R) n( m5 w" X' X
zboot info init done!
J0 d# _0 x3 zskip bad block...addr=0x1000000
" y$ k0 D6 Q5 v- ^1 iselect=0x0
" Z' c, K0 N& e. w" q1 u0 x<nand_read_skip_bad_,1128>!mtdpart=0x6,offset=0x0,mtdpartoffset=0x100000,mtdPartsize=0x80000,length=0x1000
1 z/ k- I8 k6 V' p, x+ I0 b+ y1 J8 Ttmp=0x00000000, value=07 m' Z. n1 e/ z4 {
select=0x07 b5 m2 c4 @6 ^" h+ J# G
search=0x2
! a4 i6 P7 H# E/ A+ A8 }0 asearch->result[0].entry=680240,offset=240( I$ i2 Z6 x9 h! B- m. H
<nand_read_skip_bad_,1128>!mtdpart=0x2,offset=0x0,mtdpartoffset=0x680000,mtdPartsize=0x2300000,length=0x1ee0000
8 `5 G: x2 q: n" \/ l4 a. F; k/ d<nand_read_skip_bad_,1148>!Skipping bad block 0x1000000( p# W2 J- s2 d# v. w e5 J
RSA Verify OK
- Q4 k6 t8 R9 ?/ K: c3 E- {0 B: `# ^verify vmlinuz success!!
: |# S7 [! y5 `6 {$ g" p* ^$ a0 f
* | A( S. B/ n" R% n5 d, D# P8 F---mtdparts_init--current_mtd_partnum=0-" \# G1 W) v" W
dev id: type = 2, num = 0, size = 0xffffffff, mtd_id = single part
0 {8 G0 f, ^3 u$ {' Z# Ppart : name = rootfs0, size = 0x1ec0000, offset = 0x6a0000
2 R8 c) z# X5 I2 `, bpart : name = rootfs1, size = 0x1ec0000, offset = 0x29a0000
% F! G% ^- o& _7 ]/ V2 ]& Y% x9 f1 c# e
--- jffs2_part_info: partition number 0 for device nand0 (single part)
& a9 w7 R$ V8 w0 Z( m1 x6 Pjffs2_part_info:rootfs0,6a0000
( G2 S7 `4 o& p$ }% M: O1 D### JFFS2 loading '0uImage' to 0x88000000
/ O3 l" u2 E3 W. k- t) tScanning JFFS2 FS: .. fsload_skip_bad_offset=ll1000000 ............... done.( \ g# Q* g, i `& F6 y
### JFFS2 load complete: 4420111 bytes loaded to 0x880000007 e: A% p. Z; f" }# n
<nand_read_skip_bad_,1128>!mtdpart=0x0,offset=0x0,mtdpartoffset=0x20000,mtdPartsize=0xa0000,length=0x80000( E, d9 A$ x) P
lseek=0x8c064800
/ q' \; g% J4 } d% v6 @ C' Mcmdline=U-Boot V2.3.0P1N9 202208232116588 p9 @; ?) W; `4 c8 h
kernel start step1..images->state:70f
0 j' q6 ^- D- ^4 L+ C ==BOOTM_STATE_START:1- B3 W4 H. l7 f2 k; T
==BOOTM_STATE_FINDOS:2
0 C) }0 C; c% ~+ N. R( L- n$ w4 u V## Loading kernel from FIT Image at 88000000 ...
, I# p m& u9 } Using 'conf@131G' configuration
- ]6 C& ?3 n& z* v Trying 'kernel@A53' kernel subimage
/ H( c- d' h" X7 ^ Description: Unify(TODO) Linux kernel for project-131G0 X, ]& l6 V# N$ Y, h
Type: Kernel Image
5 ]9 b. l/ J2 u1 g# ^7 A& x# m Compression: gzip compressed
& U0 e( N8 |$ {" G6 l7 X* y: B Data Start: 0x880000f8
2 Z$ R5 z: N8 a+ O# d) J Data Size: 4410949 Bytes = 4.2 MiB2 k% p, {' l: s4 M$ v
Architecture: AArch64
/ E" L0 T- b4 W6 |) y, k OS: Linux" K" w# n( S- u, m( e( {$ R" g
Load Address: 0x80080000
( ^8 G; Q7 p9 v$ ~0 T Entry Point: 0x80080000
& w% ~% U& a5 [( `1 Z" G- }) r Verifying Hash Integrity ... OK
; N7 P/ c6 a7 `# o I% ?' U ==BOOTM_STATE_FINDOTHER:4
0 `3 B8 U' U% z: j9 a## Loading fdt from FIT Image at 88000000 ...( y! ~9 ]$ d3 _( D2 |
Using 'conf@131G' configuration
8 \% ~* m2 W: b- N; r4 w4 \ \- X& z Trying 'fdt@131G' fdt subimage
3 ~3 {' X6 G; N/ C; X' y Description: Flattened Device Tree blob for project-131G
6 D7 X- y* J. W3 O) ~1 U, n7 H9 G Type: Flat Device Tree
) Q" R+ @8 k$ m/ z, u1 f8 D Compression: uncompressed
! q+ V% C2 M: J6 C9 } Data Start: 0x88435010
4 I$ ]! X" p, M E8 X Data Size: 7859 Bytes = 7.7 KiB3 _8 A1 [$ J4 f
Architecture: AArch64) B5 r2 R7 U" r
Verifying Hash Integrity ... OK
6 Q$ S) f7 q+ A/ y; X Booting using the fdt blob at 0x88435010
4 Q5 C/ O' ?1 D! |' [ ==BOOTM_STATE_LOADOS:8
0 |$ d) A8 z" j* R Uncompressing Kernel Image ... OK
6 U3 C, E5 I" y' I/ Mkernel start step6..
5 E% x1 \! T$ G- }2 c$ `5 F$ g" D Loading Device Tree to 0000000083ffb000, end 0000000083fffeb2 ... OK( I8 b& p1 s! L* S9 Z3 T
$ G2 ]" a( {+ `3 U. v) b7 G% TStarting kernel ...' N% _0 q/ ~, X, S9 a2 B Z1 p' w0 ?
6 ~* k/ W3 j+ h A: p0 P
CPUID:0 try wake up secondary cpu from rom.7 @+ T; }9 v- n1 ]- N/ x
CPUID:1 wake up from rom.3 t7 H8 q* z- s( C: `+ D! U. ^
init psci ok!!, W) q ?0 c0 T8 `4 W3 X
) K6 A- N! h8 c2 Q0 b; l到这就没有任何输出了，也无法输入，TTL进入root开启telnet的路给堵死了，有知道的大神给个指点。1 }' s i$ P+ [' P4 @, P& K
3 S" y, X2 {4 I3 Z" \3、开启telnet* A: Z- Z' z0 ?9 F2 Z( k6 `9 G
那只能工具开启临时telnet，幸好在论坛找到了mayi5147大神的telnet工具可以开启，也顺利的固化了telnet。
$ {7 ~ a9 s# ~( p; O1 w: r( v7 _" K- \: W. g! [0 i
/ # cat /proc/mtd8 q3 T' s# [ J/ ^
dev: size erasesize name) X9 g! [& N& ]
mtd0: 10000000 00020000 "whole flash"9 B2 O& h* q; s' F* `/ u
mtd1: 000e0000 00020000 "u-boot"9 y+ R4 F3 e$ ]% Q/ r n# ?+ y
mtd2: 00080000 00020000 "others"5 d* H6 k3 O% {4 s' L( I
mtd3: 00100000 00020000 "parameter tags", s8 z$ T- A8 \" T4 M8 M
mtd4: 00100000 00020000 "wlan"9 u! B7 ]$ ^( h) t- H! P8 }
mtd5: 00200000 00020000 "usercfg"
- e6 ]! X; t6 Z/ m/ nmtd6: 00100000 00020000 "middle"
& {! I- ~# z0 `1 R6 r5 Tmtd7: 02300000 00020000 "kernel1"
+ b8 _- ^5 f- F3 D+ zmtd8: 02300000 00020000 "kernel2"
$ Y1 b- t4 e3 l! ], T! u- c* h/ K9 kmtd9: 03900000 00020000 "osgi1"
0 c" \$ m- I: y- \! q% ]4 c5 }" Omtd10: 03900000 00020000 "osgi2". U( j8 a& V, B0 y) C$ q( s0 _
mtd11: 04180000 00020000 "plugin_data"
}! C5 b9 t7 l( j1 h7 ^. U) Vmtd12: 022e0000 00020000 "rootfs"
6 `+ P( f: j; u9 O# S( J" Jmtd13: 00020000 00020000 "bootrom"! @) m8 I* f6 p
8 q. S1 T7 Y4 K M/ # cat /proc/csp/versionstates
2 |( M% A3 m3 Q! x' Y2 x. e- Lbaseaddress : 0x680000# ]& B# w( W6 G i" ~
current : 0
' _3 }* |5 n) iversion1states : 0x8f! n9 B5 E' ?, _; L
version2states : 0x839 k2 q7 w1 J0 H/ ]- i3 S
____________________________________________________
% v: S# S% j1 M D% tIndex Running Latest CRC Integrality Type* K/ \. P3 c! R j- |
----------------------------------------------------
9 a5 S$ c, {' z5 X0 B$ \0 Y Y Y Y Upg
& `* t9 e2 Z, T9 W: F1 N Y N Y Upg8 o' O7 ?" [" x; O" ~
----------------------------------------------------
0 q& O5 x1 ^: i
( m+ N: d; k) A! n+ p; d/ _2 }! R
7 g9 [9 i7 J9 R+ |6 N" n& O. L/proc # cat cpuinfo
: o$ u$ w8 o9 X) `6 e' \* Q* M# y% W. e7 Zprocessor : 0
: \$ w# Y6 d: j* T. F0 nBogoMIPS : 50.00
: j b6 z% i' `* S& e$ OFeatures : fp asimd crc32& A7 c% r e* x" A( D% \
CPU implementer : 0x41- d5 }! t7 J$ s1 D; r2 x5 ?4 e# K0 f! f6 P
CPU architecture: 8+ ]- w% |4 O9 b5 y
CPU variant : 0x0
z3 J- v0 t0 J# {% P% ICPU part : 0xd039 d l I/ X. f u* k9 ]
CPU revision : 4
$ x9 H. Z' N' H8 s8 A7 ^: r. e: V" ~0 t6 T5 A2 F( ]3 k% F
processor : 1
! q! w; y2 j6 _' M. P% HBogoMIPS : 50.00& G0 z; X4 ]+ W( @
Features : fp asimd crc32: z7 n8 S- \( o- z
CPU implementer : 0x41
) z8 c4 z/ e' BCPU architecture: 8, u1 y5 B: i6 ^) W
CPU variant : 0x0
# k3 A5 [* b WCPU part : 0xd03
' t* O( S1 H! }; a- CCPU revision : 4$ m7 Q$ |# s4 O F4 D, ^& e% H
1 S4 p/ e' i8 v" n+ v6 j
% x+ r9 L: m2 c: J9 ]" w9 n
4、使用dd备份分区：# H7 w3 f; i' h- {; M1 A
dd if=/dev/mtd1 of=/mnt/usb1_1/mtd1.bin7 f: H6 B. F7 r$ ]4 p
dd if=/dev/mtd2 of=/mnt/usb1_1/mtd2.bin2 j3 \8 V+ z/ a6 M1 w8 S, G6 F9 [
dd if=/dev/mtd3 of=/mnt/usb1_1/mtd3.bin5 V! J: s& \0 S3 j% U, G
dd if=/dev/mtd4 of=/mnt/usb1_1/mtd4.bin" G0 }' C6 m2 T# Q Z
dd if=/dev/mtd5 of=/mnt/usb1_1/mtd5.bin" n1 z. ]2 E, }
dd if=/dev/mtd6 of=/mnt/usb1_1/mtd6.bin
. J# Q& }' S: ^. [, kdd if=/dev/mtd7 of=/mnt/usb1_1/mtd7.bin
: u, U l8 k) q0 S; ~: o# w- Edd if=/dev/mtd8 of=/mnt/usb1_1/mtd8.bin C' E& O' ]9 ?& C6 j
dd if=/dev/mtd9 of=/mnt/usb1_1/mtd9.bin% b8 [2 a2 T8 [/ B2 z& M
dd if=/dev/mtd10 of=/mnt/usb1_1/mtd10.bin
6 r2 K& W2 y' i. ?5 B8 ]dd if=/dev/mtd11 of=/mnt/usb1_1/mtd11.bin
+ P+ p6 h8 A6 ?, n% `dd if=/dev/mtd12 of=/mnt/usb1_1/mtd12.bin V7 \, U% @6 f/ N( w
$ w* r9 ^8 t( m
以上备份都能正常执行，但是mtd0全区备份，mtd13备份出错，具体原因不知。
) x3 Z) v/ c# J# D( `/proc # dd if=/dev/mtd0 of=/mnt/usb1_1/mtd0.bin
$ o* x* q) a' N3 J+ Odd: /dev/mtd0: Invalid argument
6 Z$ k0 Q" l9 k4 }4 k& f) g/proc # dd if=/dev/mtd13 of=/mnt/usb1_1/mtd13.bin
1 I& W% ]5 B: F8 v) T8 fdd: /dev/mtd13: Invalid argument, _) ]: I2 H& y; D8 r
$ e) A1 w$ o5 Y6 K5 C8 c软件版本号V2.3.0P1T10/ y5 R n* s' M2 @
备份的分区：链接：https://pan.baidu.com/s/1JW22fVaciXBW6F_gj98_7A?pwd=vx9q 提取码：vx9q
2 W1 G$ H K7 C Y. l& c& r# _# k ~- } P
5、TTL刷联通固件2 B# c- ?% V* K# l S
我的想法是，mtd1"u-boot"分区不动，其他分区全部刷成联通的分区，不知道这个想法可行，但是也没有F7610U的分区，只能到此了。
8 d' d/ [& \4 H& d
5 T3 v) S; `: p5 _5 t500猫粮悬赏 K, r* B7 c9 |, q
求中兴F7610u光猫分区备份
9 d, c( w# v! H6 E yhttps://www.chinadsl.net/forum.php?mod=viewthread&tid=1769425 z0 z, I, V$ X# C
/ t. R$ Y( E S- x e: P$ Z7 ?补充：3 N0 m) S+ Y4 W
6、提取编程器固件9 v' P u* n2 Y/ o/ L
F7610m的闪存芯片是HYF2GQ4UAACAE，封装类型是wson8，芯片大小是8mm*6mm，于是我就买了一个wson8转dip8的探针，用编译器ch341a提取了固件，已经分享在百度云网盘中。探针要用手扶着，提取花了45分钟，手都快残废了，于是自己利用家里能找到的材料做了一个简易的夹子，终于解放了双手。, u4 `$ N# i* i' k3 n& H6 w
2 q2 O& V; m G+ D ~/ H
: r0 H; X. U8 E0 ?
0 W: L' k% R( ?- n) h; m7 K$ L5 h$ S8 n
2024.4.7 uboot下刷写分区
1 n9 A2 `( J" r& q9 \网友分享了F7610u的kernel、framework分区备份文件，为了保险起见，我在u-boot下刷写了备用分区mtd8、mtd10分区。; s+ f* \- [- p* m
- h( R# w+ }% l6 }; y4 j% z7 S! u s
- H! R5 {% W2 w
tftp 0x88000000 kernel.bin
* k; L1 U' D4 q2 {) M擦除mtd8：nand erase 0x02980000 0x023000000 N1 G( E' K2 b% `
从内存写入mtd8：nand write 0x88000000 0x02980000 0x023000009 e9 w- ~1 V- G6 @0 j1 R
2 ]& M2 B) m/ |$ o" Mtftp 0x88000000 framework.bin
' I2 f4 M, {8 D, M& }1 S擦除mtd10：nand erase 0x09180000 0x03900000! _ e, u/ n: t `3 b
从内存写入mtd10：nand write 0x88000000 0x09180000 0x039000004 S. a* X. A3 E7 v/ A
& H/ q& S# b$ O7 E, H6 o
重启光猫后，使用upgradetest switchver 1 切换成备用分区启动，但是启动失败，仅仅替换kernel、framework分区不可行！) |) v% z: C& [9 q+ M4 @, I- A c
也许必须用编程器刷写F7610U的编程器固件才行。
/ _7 `' q8 g! [
! ~5 r, m7 x7 h% J" ?; }0 p8 ]另外： y+ D" L* f4 }2 A3 X
F7610m在TTL下屏蔽了kernel启动信息，看不到各分区的地址信息，我根据编程器提取的固件，推算了各个分区的地址，如下：
6 U' r8 O' e* s5 z, S# I
" x; v9 \ i5 _# _. `. y6 z. g( g- |4 a% d8 a
dev: size erasesize name9 y5 A- {; p9 p, H/ G! A2 u
mtd0: 10000000 00020000 "whole flash"" h+ v/ E. t' d& i, }, m
mtd1: 000e0000 00020000 "u-boot" 0x00020000-0x00100000 ok+ c7 W+ b B5 C: T
mtd2: 00080000 00020000 "others" 0x00100000-0x00180000 ok4 R% [# b& Y# U0 p# k
mtd3: 00100000 00020000 "parameter tags" 0x00180000-0x00280000 ok
7 }% }' M1 G% T6 E) o; Nmtd4: 00100000 00020000 "wlan" 0x00280000-0x00380000 ok
3 h/ ]# b4 L0 |( |2 C) j! Mmtd5: 00200000 00020000 "usercfg" 0x00380000-0x00580000 ok
1 q3 W z8 R T" }8 {; U) emtd6: 00100000 00020000 "middle" 0x00580000-0x00680000 ok8 U$ g! q) H0 C$ W) y
mtd7: 02300000 00020000 "kernel1" 0x00680000-0x02980000 ok
, [1 Z2 [. l; k- M2 A* h! ?mtd8: 02300000 00020000 "kernel2" 0x02980000-0x05280000 ok
9 B' ^) |! u2 j4 } @8 dmtd9: 03900000 00020000 "osgi1" 0x05280000-0x09180000 ok6 I* v3 ~& t9 l" x) @" U
mtd10: 03900000 00020000 "osgi2" 0x09180000-0x0ca80000 ok9 ^: I6 @: q% ~) r1 N2 A9 w
mtd11: 04180000 00020000 "plugin_data" 0x0ca80000-0x10c00000 mtd0大小只有10000000，地址是我推算出来的，超出了10000000不知道为什么？
. Z s( @5 @, K' qmtd12: 022e0000 00020000 "rootfs" 0x10c00000-0x12ee0000 mtd0大小只有10000000，地址是我推算出来的，超出了10000000不知道为什么？/ {- n! N: v% Q/ H% O
mtd13: 00020000 00020000 "bootrom" 0x00000000-0x00020000 ok5 D: o4 K6 I( z* W2 q* [
( ]' P" D" `+ L: U `
5 b8 X( n! U3 D( g' u# Q
# q5 \1 Z- M' E, ~
: P! G! x7 S2 o
$ s8 ?; E9 b- t+ m, r; m7 o* g
) Q( d" ? A1 S& o% f: O% _+ f" B. K7 k$ }, \2 j% d
/ s8 ?2 \& o5 t2 _* t
5 B$ l9 Y. j: R. F
& U- @7 i4 L- v+ r# Z2 R+ B! w) |* c0 m# a5 @. B+ M& a
6 \, I) \9 m, _3 N+ ]
: ]5 w! [. k; T1 u, D4 l# M8 X7 Q7 q) W. `3 G' H
' I+ c( | {' Y4 n, E; d4 X
r1 Y/ A; ^6 S+ m \
6 }1 n7 n {0 z$ ?+ p- s
|
本帖子中包含更多资源
您需要 登录 才可以下载或查看，没有账号？注册
×
|
|Archiver|小黑屋|宽带技术网
|网站地图
发表于 2024-4-2 12:21:55