查看: 1435|回复: 6

[其他] HN8346X6 firmware dump R020

[复制链接]
发表于 2026-3-26 01:28:41 |巴拿马| 显示全部楼层 |阅读模式
本帖最后由 HN8145X6-tester 于 2026-3-26 22:36 编辑 5 y4 M  M. d) e' u7 w

* G' p/ B* W1 ~0 {4 cHN8345X6 COMMON Menu english firmware dump. z0 d9 v% m/ R  f: B  Z

2 G( V% g8 d- l: c6 n+ Y( j+ [
' ^; V3 Y5 R, k& ^# F; P; a; O. B$ G* e; r% p
- r& A% k  N. v+ R' f: D

; {' G, N1 G3 s& q1 l/ bflash Dump R020 shell telnet enabled  
, V2 h- ]# c  D  C8 L5 z: g! {. n  {: s5 \8 B1 S0 W0 {
; o0 K2 C8 @! F1 _: K, j/ O
5 a  _1 M  G2 P# z' \1 e" _
also attached hwmtd bin missing yesterday for write permissions on R021 firmware
9 X& A; l. ^8 Z' Z; ^

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有账号?注册

×
发表于 2026-3-26 12:27:43 |中国| 显示全部楼层
这个是编程固件还是可以用工具刷的刷机固件
发表于 2026-3-26 21:46:57 |安徽| 显示全部楼层
Several partition files are missing(缺少几个分区文件)+ [, f- {4 l& m+ z
mtd1、mtd10
 楼主| 发表于 2026-3-26 22:25:40 |巴拿马| 显示全部楼层
liufubiao2015 发表于 2026-3-26 12:27
7 H3 A9 B& J/ A- o$ t& N2 y这个是编程固件还是可以用工具刷的刷机固件
& y1 ~4 T. K& i, a1 j& ^
firmware can be flashe via TFTP, firmware dump made with TFPD via cat /proc/mtd " @) W* z3 w! G) {

6 o0 ~+ T" v  s: m6 D( ^) Y: s2 ]' ]
to flash firmware back to device,  can use similar cmds depending on firmware version& C5 C+ ~' c  S! i: w) J
0 n* B- g0 f# }' v4 \9 w
3 B  u) ]- ?/ T7 Z8 W3 j& s0 \
cd /dev/shm* q* z  E8 _5 A6 ]

: V/ N" ~# q6 h8 D' Ltftp -g -l hwmtd -r hwmtd 192.168.100.10 . U2 n3 f! n6 b
" Y/ @$ w; w* r
chmod 777 hwmtd ( G0 X0 w2 A( z2 z4 ]/ s" P

, H; ]& Q2 P) d/ A! T./hwmtd allsystemA
0 y- i4 k5 v7 W  @6 V  k./hwmtd allsystemB
. d3 e0 z2 v2 }./hwmtd apps
& G. r! E+ ]2 I; k./hwmtd file_system 5 d8 n7 |4 H: e' o/ E
./hwmtd flash_configA) h. E7 p2 q0 s6 d
./hwmtd flash_configB + m& M( C! y' Q' [- u& _
./hwmtd frameworkA
# |; T! E: c1 d! x  @& q0 [5 Q! e! {./hwmtd frameworkB   s6 S$ t% B# s0 M) G
./hwmtd keyfile1 q1 N; X( o/ `4 m- w9 z' a
./hwmtd slave_paramA
, A, ?0 M' ^! P1 G, G4 \% @7 @# r./hwmtd slave_paramB
( I  C7 ], I- U) ?7 _, F./hwmtd ubilayer_v5
: P! g0 D4 ]/ [4 o& [7 v0 i& T- t+ a# D./hwmtd wifi_paramA+ O3 h$ J, c8 X! N& H
./hwmtd wifi_paramB
" l' o' t' Q4 i, g3 ~& u/ A+ {# l3 t) h0 u
# m7 E, z" |: G1 z1 A6 Z& M
tftp -g -l mtd0.bin -r mtd0.bin 192.168.100.10 * Y: F* {: \$ G5 I" T) r3 M
tftp -g -l mtd1.bin -r mtd1.bin 192.168.100.10 4 `( ^0 C: V. _) s6 j1 Z
tftp -g -l mtd2.bin -r mtd2.bin 192.168.100.10
) t/ B7 u- r: ]. `& ]/ Rtftp -g -l mtd3.bin -r mtd3.bin 192.168.100.10 ( I/ i& t7 H# l1 {8 l
tftp -g -l mtd4.bin -r mtd4.bin 192.168.100.10 * t. t6 B  T% e5 Q: ~
tftp -g -l mtd5.bin -r mtd5.bin 192.168.100.10
8 O! a7 X- O' M) Q8 Gtftp -g -l mtd8.bin -r mtd8.bin 192.168.100.10 : ^  I0 V/ x( p) k/ H- ^
tftp -g -l mtd9.bin -r mtd9.bin 192.168.100.10 % D( Q6 s% j. @/ T. [
tftp -g -l mtd10.bin -r mtd10.bin 192.168.100.10
  Y/ H0 y) c5 K+ ptftp -g -l mtd11.bin -r mtd11.bin 192.168.100.10
! d; a3 l* y( b: m) n: Xtftp -g -l mtd12.bin -r mtd12.bin 192.168.100.10 1 Q2 i* ^% L* c" r
tftp -g -l mtd13.bin -r mtd13.bin 192.168.100.10
  s# H# C5 @; j  r( n! gtftp -g -l mtd14.bin -r mtd14.bin 192.168.100.10 # i) Z* ?. y: t* s; E

1 r" M+ c! L# j9 b# U' R% _
' e) ]7 X* C1 w1 v! w9 E3 P6 i9 c# E) Z0 v  O9 {/ \% C- s) t
dd if=/dev/shm/mtd0.bin of=/dev/mtdblock0  
0 D3 {# W# c1 ddd if=/dev/shm/mtd1.bin of=/dev/mtdblock1
+ I) k  Z+ I, i+ N  m3 ^1 J5 jdd if=/dev/shm/mtd2.bin of=/dev/mtdblock2  4 m- D/ H% W( r$ _+ t, Y% D. `
dd if=/dev/shm/mtd3.bin of=/dev/mtdblock3 ; Y* O1 W7 |/ g) K9 ]9 y3 b' P) \
dd if=/dev/shm/mtd4.bin of=/dev/mtdblock4  3 Y  p* Y0 b7 ~: z
dd if=/dev/shm/mtd5.bin of=/dev/mtdblock5
: M6 ]  y/ Y* Q' v9 J4 k5 ddd if=/dev/shm/mtd6.bin of=/dev/mtdblock6  7 g8 B6 y& q. s# U
dd if=/dev/shm/mtd7.bin of=/dev/mtdblock7
/ U( C, k1 h3 q) V7 ^% edd if=/dev/shm/mtd8.bin of=/dev/mtdblock8  $ U$ g4 \9 t' ?- `, d& w7 x
dd if=/dev/shm/mtd9.bin of=/dev/mtdblock9 7 Q5 q& g( h8 R8 w- Y3 Y! Y
dd if=/dev/shm/mtd10.bin of=/dev/mtdblock10  7 ]  h: c' s2 Y, [$ \
dd if=/dev/shm/mtd11.bin of=/dev/mtdblock11
$ L5 u; f# n* O1 A9 |  I9 d$ Tdd if=/dev/shm/mtd12.bin of=/dev/mtdblock12  . h4 b( F- K1 F, g( ?: Q
dd if=/dev/shm/mtd13.bin of=/dev/mtdblock13
" p$ T( \& t# Vdd if=/dev/shm/mtd14.bin of=/dev/mtdblock14
3 T7 p& p5 N3 s: H4 ~5 Q
' [# u& c3 x. i/ r6 P
" s. t: V0 w& \1 ], x( `3 O6 o7 ]2 x- Y# d6 w
1 h' o( h5 d( s% V7 X" x7 r
7 Q6 C5 _& [/ q
tftp -g -l hwmtd -r hwmtd 192.168.100.2+ G) }0 y+ b, t/ O/ ]
7 j& H2 `- P) \0 h. i
chmod 777 hwmtd
% ^& ~2 i; f# L8 G6 O% _2 M+ g" }. e4 Y  u
./hwmtd -u apps1 ?$ N% N8 _, j  Q! d. \0 N

; V' P% \$ l3 I  C0 F( a: ^./hwmtd -u allsystemB
2 R+ W- V* W' N & a1 v% d8 H+ |) ^& q
tftp -g -l mtd14.bin -r mtd14.bin 192.168.100.2
+ [( u. B( v8 y. @0 l; K+ _" C& ?, ~6 Q; b. w( h3 v! Q
dd if=/dev/shm/mtd14.bin of=/dev/mtdblock14 ' U! U& w9 Q' ~, `

* v5 e  B; u/ x5 Y4 Y8 i7 bdd if=/dev/shm/mtd6.bin of=/dev/mtdblock7 , o/ d2 u( T0 ~; ^2 j+ O7 H8 Q
3 O' H8 P, [% r7 c) v* w. O
4 `( O# k% y. J1 U" g' Q
/ Q) t$ a4 f, y# z
( e2 e9 c4 ^" F5 f& @5 ?

! `1 S; S+ b4 y& F7 |+ k; X2 j+ r- f) f& l( ]- z- f4 R

4 |0 O, g  R: ^* U  C
 楼主| 发表于 2026-3-26 22:32:17 |巴拿马| 显示全部楼层
本帖最后由 HN8145X6-tester 于 2026-3-26 22:37 编辑
. k- L+ r2 ?  e7 d7 a
liufubiao2015 发表于 2026-3-26 12:27
; [2 _' L7 \4 |: u/ G这个是编程固件还是可以用工具刷的刷机固件

+ Z; M3 K7 r; K$ f9 ]hi yes looks like update missing some files yesterday will update now.1 o8 b3 B5 ]) D# k+ {. J/ t3 @
. o7 n( j- f' k5 H5 B) B6 I

7 G* M; Q  r2 @% U/ t7 ~; \! N, N' s  f7 P- v
i have uploaded missing ones on first post to keep clean
% \2 b/ Q- R0 L( y5 h# k
发表于 2026-3-28 12:39:59 |北京| 显示全部楼层
Friend, could you please provide the partition table obtained by running the command `cat /proc/mtd`, b- w6 U/ ^5 X0 T9 s
朋友,能提供一下cat /proc/mtd命令得到的分区表单吗
发表于 2026-10-28 13:21:38 |湖南| 显示全部楼层
Hi, thanks for sharing this — very useful reference.
* z6 V$ W. G5 B; k& `
1 @4 O; V, y1 w+ b# bI have a HN8346X6-C (China Unicom, V5R022C00SPC310B017, board 2AD0.A,
$ H; J) A! u" l1 f: fSD5182H + 256MB SPI NAND). It is stuck on R022: telnet works but the shell& _, b; g% t% Y: F. i
only accepts `ls`, so tftp/chmod/dd are all unavailable and I cannot write2 i+ }2 R7 ~" R9 T  \
any mtd partition.
. o" s6 j- z1 t3 H* p! [9 H' E
8 T: J2 [3 q# g, U9 ~2 q3 KBefore I try anything with your files, a few questions:, E0 g% V: \$ p, @
+ }6 P/ i% S$ s6 R+ C# k
1. The title says HN8346X6 but the post says HN8345X6 — which model is the% K9 T' C; f& N& L7 x( ~
   dump actually from?- V) ~1 ]/ D; T0 t7 K, o- c" ?) I

9 l5 O; c8 [* J9 f2. What is the hardware version of that board? (2AD0.A / 1CF0.E / other), ]; C* N8 M$ q2 V# t9 w# \
   And could you post `display version` and `display chipinfo`?
) [" `- G! _. ]1 x/ b- T& ^/ Y! H* o. Q) B3 e$ M$ `1 i* o
3. Could you post the output of `cat /proc/mtd`? I need the exact partition
( H# Z9 Q2 V. z* D   names and sizes so I can map your mtd0–mtd14 to the partition names you! k# R, K! l. R& |5 M6 I1 ?  |
   used with hwmtd.
! r9 t! c+ V% S- l$ x
/ Z, v% v* w0 @( }2 l; ]4. Was the dump taken from a China Unicom unit converted to COMMON, or from
; ~2 P" ?+ r" U- [- U9 p   an original COMMON/export unit?
+ Z( s- x) P. [9 G$ T1 e& K
- p$ {3 o+ Y2 _/ f5. In your layout, is the KMC key store (KMC_STORE_A / KMC_STORE_B) located2 R" C  o' L# R( r3 I4 v
   inside the `keyfile` partition? I would like to decrypt hw_ctree.xml# `! p, B# X3 z
   offline from my own dump instead of flashing anything.. _" R* F% C- ]" ], a/ J

1 L+ i% s7 B, v( S% v( u$ H7 f/ E; c, V! HOne more thing — do you have anything for R022 on this platform?
1 _+ h3 y! h/ u* O6 V9 UA full dump of an R022 unit with shell/telnet enabled, or the signed
0 ~  p; K. j/ K+ u6 hequipment plugin (with sign/cms) for V500R022C00SPC310. The R020 images3 ]% T: Y9 b2 u2 ]5 V1 E( X
cannot be loaded on an R022 unit through the web or multicast tool, so an# I( k0 h# e* N: N/ _0 o/ T' I
R022-based dump would be the only thing that helps me. I can share my own& y6 u6 [' m! K
R022 dump back once I can read the chip.: l5 l1 S: C  w. r

+ s+ V2 X6 Y; ~! A5 ~Thanks.& [; F8 x1 F% O4 e
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关闭

站长推荐上一条 /1 下一条

相关侵权、举报、投诉及建议等,请发 E-mail:yesdong@qq.com

Powered by Discuz! X5.0 Licensed © 2001-2026 Discuz! Team.44152102000001

在本版发帖返回顶部