查看: 1422|回复: 6

[其他] HN8346X6 firmware dump R020

[复制链接]
发表于 2026-3-26 01:28:41 |巴拿马| 显示全部楼层 |阅读模式
本帖最后由 HN8145X6-tester 于 2026-3-26 22:36 编辑 ; f( i: S) j( ^' B

: r# r8 f7 c- C( DHN8345X6 COMMON Menu english firmware dump
+ A/ _: e6 i5 {% g
9 q. ?  E' F/ r* m' M
4 A9 v, j  B) f* A1 M' |: N6 G3 m) @6 r* e3 H) E) u! S$ }

: L) m3 T; h7 i6 c) R7 M
2 w! K6 ?; c, ~* w& W9 Kflash Dump R020 shell telnet enabled  
4 O5 O0 v# a* K" `" o3 m6 Z: O
# ?' i9 A& w3 O: ]) u4 A
5 y: l% W' m( b
- f5 w6 v! G0 h* u+ O' s/ Salso attached hwmtd bin missing yesterday for write permissions on R021 firmware
# ^# }7 v9 {! ~' Z5 {; C: ?, ~

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有账号?注册

×
发表于 2026-3-26 12:27:43 |中国| 显示全部楼层
这个是编程固件还是可以用工具刷的刷机固件
发表于 2026-3-26 21:46:57 |安徽| 显示全部楼层
Several partition files are missing(缺少几个分区文件)
) |$ U( Z* u! i3 j; n7 B* f1 Gmtd1、mtd10
 楼主| 发表于 2026-3-26 22:25:40 |巴拿马| 显示全部楼层
liufubiao2015 发表于 2026-3-26 12:27# h$ z" o: x. q5 s" r" `/ n
这个是编程固件还是可以用工具刷的刷机固件

# p# `5 l8 n- g3 y0 `; Gfirmware can be flashe via TFTP, firmware dump made with TFPD via cat /proc/mtd
1 c5 Z5 }3 Y" i, ?9 u6 s, d4 n
8 `; I* ~. z  ]+ S
9 V: ?3 s; x9 @5 Z8 @to flash firmware back to device,  can use similar cmds depending on firmware version
2 M7 h. M% {; I$ N) e# L
3 h! T, Y, ]" M# V: U1 H( O
9 r8 g/ Y" @7 e2 Ocd /dev/shm$ ]( ^7 ]" c9 K
+ w5 M6 \4 {. A  \/ M! v! ]; l1 H4 @
tftp -g -l hwmtd -r hwmtd 192.168.100.10
" R8 O* z. v8 P$ y* k/ w* z* W) D4 @4 H# e9 I4 t
chmod 777 hwmtd 7 p+ ?2 O0 N+ w8 ?& h: c1 g
( ]# c; o2 i7 R4 x7 B. n6 x
./hwmtd allsystemA8 z: e7 |+ `* m) N) B7 e4 P
./hwmtd allsystemB 9 G$ I0 e1 M2 _1 V: A% B  W
./hwmtd apps
* ~+ q& J: w$ s/ p$ N./hwmtd file_system / \4 b: d+ T0 Q: J/ ?: z
./hwmtd flash_configA. N6 S, C+ _# G
./hwmtd flash_configB
* u& ^% H4 u) E) x0 p- V9 `! W1 Y./hwmtd frameworkA
3 J8 \5 N( A% f7 t./hwmtd frameworkB
) z" ^9 Y# l/ v# i$ W3 R2 h$ W./hwmtd keyfile
* n- ]6 J" H  d2 B./hwmtd slave_paramA
, @' i4 p% C) c& ]./hwmtd slave_paramB# K2 `# c) |: d
./hwmtd ubilayer_v5
& a( q$ W' p. ~0 s./hwmtd wifi_paramA
5 z: N2 |! m+ q% I- t( F  g4 p2 E./hwmtd wifi_paramB , l4 }' [+ ^4 S+ h: ~1 B+ n

; p. G, N; S" y. `  W8 P8 P5 s' {4 f+ d
tftp -g -l mtd0.bin -r mtd0.bin 192.168.100.10   R$ O9 v0 i7 ]% o$ G4 Q
tftp -g -l mtd1.bin -r mtd1.bin 192.168.100.10
1 p  u. t) }3 U, `, utftp -g -l mtd2.bin -r mtd2.bin 192.168.100.10
9 \: y6 {; h1 U2 }6 ytftp -g -l mtd3.bin -r mtd3.bin 192.168.100.10
7 U$ J' z( b8 C. M4 K, Qtftp -g -l mtd4.bin -r mtd4.bin 192.168.100.10 7 R' u4 e- S- K7 g
tftp -g -l mtd5.bin -r mtd5.bin 192.168.100.10
. Q  ?' j+ l3 c6 k: j, C6 T% L9 jtftp -g -l mtd8.bin -r mtd8.bin 192.168.100.10 4 b! S( @5 e9 p3 c# M5 T5 K
tftp -g -l mtd9.bin -r mtd9.bin 192.168.100.10
+ w" `  Z+ I$ }1 A5 B* p2 p: Ytftp -g -l mtd10.bin -r mtd10.bin 192.168.100.10 * s! J' Z3 j4 B* @
tftp -g -l mtd11.bin -r mtd11.bin 192.168.100.10
# y1 b7 o; Q3 O, f; b; _! _tftp -g -l mtd12.bin -r mtd12.bin 192.168.100.10
+ y, J. x' e% j" ktftp -g -l mtd13.bin -r mtd13.bin 192.168.100.10 7 B, A0 Y5 k% r( e  Y; q; O) h
tftp -g -l mtd14.bin -r mtd14.bin 192.168.100.10 % @$ L# M, I% G( N, R

$ J$ B1 [( ?1 P6 S8 C5 v0 \0 W- `3 o

* ~) K# @! r6 N/ ]dd if=/dev/shm/mtd0.bin of=/dev/mtdblock0  
7 j3 b6 ~  y3 {$ g3 u& `7 D( Jdd if=/dev/shm/mtd1.bin of=/dev/mtdblock1
0 Y! p, ?# s5 {* @! h4 Rdd if=/dev/shm/mtd2.bin of=/dev/mtdblock2  * \6 w: F6 Q0 W2 O
dd if=/dev/shm/mtd3.bin of=/dev/mtdblock3
5 ^' @  i* }) D* x4 y0 v0 gdd if=/dev/shm/mtd4.bin of=/dev/mtdblock4  
) u( G& Q9 p9 Z5 s3 ?dd if=/dev/shm/mtd5.bin of=/dev/mtdblock5 4 o" w, o) i4 V6 H* y: e$ n
dd if=/dev/shm/mtd6.bin of=/dev/mtdblock6  . ~. u7 n; M6 k' s# s- C4 q
dd if=/dev/shm/mtd7.bin of=/dev/mtdblock7 . A2 L) e7 g% ]
dd if=/dev/shm/mtd8.bin of=/dev/mtdblock8  6 i- c* L# u& b( X9 J. j6 h
dd if=/dev/shm/mtd9.bin of=/dev/mtdblock9
1 r" _  ?4 q9 Z4 G+ n: R, idd if=/dev/shm/mtd10.bin of=/dev/mtdblock10  , x+ T! t2 [' l5 g" H
dd if=/dev/shm/mtd11.bin of=/dev/mtdblock11 0 O) l8 j! @( Z5 }
dd if=/dev/shm/mtd12.bin of=/dev/mtdblock12  * D! r8 v5 h1 v9 V5 n
dd if=/dev/shm/mtd13.bin of=/dev/mtdblock13
/ u# M1 |' u1 O1 D' ]' f2 R4 Zdd if=/dev/shm/mtd14.bin of=/dev/mtdblock14* y! C' U1 o0 V3 q3 |
/ j+ J$ u( L; O2 k+ }# ?6 w
9 C4 E" M, a; M4 J: [$ Z2 k
' y! `' @  K, U. U6 g1 I: V% y" v

8 @# b$ l6 U( U6 j- k* e+ I/ o* N, n$ k) z) w& Z
tftp -g -l hwmtd -r hwmtd 192.168.100.29 s/ ~- C$ T5 ?& }! X, J0 o# p

. T3 k: H, L" Dchmod 777 hwmtd
# H3 e% A1 c* ^
! x0 ]2 n% c: e1 G4 T9 N' \./hwmtd -u apps
6 `0 I" ]9 Z* K & H# o  L0 Z( L( }  a1 t
./hwmtd -u allsystemB
: N7 m4 b8 Q4 x4 x2 h/ k ; L# a2 l2 D! r' M  x# c" I; R: \7 F
tftp -g -l mtd14.bin -r mtd14.bin 192.168.100.2
1 ^- n5 R- c1 V. S, D5 M3 E9 R7 d! ^7 d. M: ~% s
dd if=/dev/shm/mtd14.bin of=/dev/mtdblock14 - |" S) U$ Y7 B& ]% W

0 ]. }$ s/ p4 S$ c( _8 H1 A- ?% odd if=/dev/shm/mtd6.bin of=/dev/mtdblock7
- ?: D6 _, S& \" P8 a  a+ y/ o8 n8 Z4 t
. |* ^" L6 G3 E8 F5 ~& Z  M7 L

- `  d3 {4 L5 F8 o- n/ z, \5 q6 M/ i8 _! W( j

' I: J7 z5 ?; h' M: e/ i' t" J5 S2 X3 g8 I
, \' a$ s& {* H: o; k
 楼主| 发表于 2026-3-26 22:32:17 |巴拿马| 显示全部楼层
本帖最后由 HN8145X6-tester 于 2026-3-26 22:37 编辑
7 w/ g( _9 W, W( n/ T& b
liufubiao2015 发表于 2026-3-26 12:27
% [7 I  H4 }! o% w. C0 |6 F这个是编程固件还是可以用工具刷的刷机固件

" A6 L2 o$ G; }3 U) e- ~+ Xhi yes looks like update missing some files yesterday will update now.
, g5 d; u, O3 _5 O' h. B7 G5 d' F( E8 X) `4 u

  T% w  B) B! N' d. |$ B) a3 f7 A. M% I
i have uploaded missing ones on first post to keep clean1 [2 a& K2 @8 \2 L
发表于 2026-3-28 12:39:59 |北京| 显示全部楼层
Friend, could you please provide the partition table obtained by running the command `cat /proc/mtd`5 v+ I' N0 g$ d$ w) d: P
朋友,能提供一下cat /proc/mtd命令得到的分区表单吗
发表于 2026-10-28 13:21:38 |湖南| 显示全部楼层
Hi, thanks for sharing this — very useful reference./ U- U6 k( O+ f6 s  d- t, J2 {

. u5 o; O. q# M; sI have a HN8346X6-C (China Unicom, V5R022C00SPC310B017, board 2AD0.A,
) i2 X' s7 h( z9 PSD5182H + 256MB SPI NAND). It is stuck on R022: telnet works but the shell1 S. ]' Z& U/ K( z& j
only accepts `ls`, so tftp/chmod/dd are all unavailable and I cannot write
) B0 y% t* n+ Jany mtd partition.0 |0 X) {7 C5 O8 W. w

# u: c5 u- P0 H5 R+ \2 V' RBefore I try anything with your files, a few questions:
6 `9 h5 h# Q: f# [+ j0 V$ S& ]
; @8 K- y' b' A1 I0 l' [5 B1. The title says HN8346X6 but the post says HN8345X6 — which model is the
) H- a/ L. q' h! R9 [6 Q   dump actually from?2 C) n5 S- Z9 `9 q$ `

) u$ V$ _; n. E2 K% l; W2. What is the hardware version of that board? (2AD0.A / 1CF0.E / other)
. k& B# ^, m: V, ]8 s   And could you post `display version` and `display chipinfo`?3 `" G: F4 s5 U# a8 f( O

6 I# q7 d# N9 c7 s6 {" M4 H' }3. Could you post the output of `cat /proc/mtd`? I need the exact partition
4 j9 Q5 T3 y2 ?: V, _( `   names and sizes so I can map your mtd0–mtd14 to the partition names you
! |$ ]5 q' N+ \! X0 t6 S, ]' K* L) d   used with hwmtd.; y* P3 x8 ?- M6 b9 F7 ^1 J: y

' L5 x( C, X2 ]6 t# Y: s/ C4. Was the dump taken from a China Unicom unit converted to COMMON, or from: W/ H4 a5 U( H1 [& E4 B+ S% B
   an original COMMON/export unit?
2 V0 O+ s- J+ s) }
+ l- H& }4 ]/ P$ r& b; H: w; w5. In your layout, is the KMC key store (KMC_STORE_A / KMC_STORE_B) located
7 H2 f9 N* n) H5 o9 q  Y   inside the `keyfile` partition? I would like to decrypt hw_ctree.xml/ L: j' @- q* r- {4 ?* \
   offline from my own dump instead of flashing anything.
2 z& c! w, ^# }7 Z% T$ F6 |9 R& A, v9 V2 S% n9 T" _; \
One more thing — do you have anything for R022 on this platform?
5 Q; B. p( K/ C/ h4 z" ZA full dump of an R022 unit with shell/telnet enabled, or the signed8 E. T6 x% ?8 }
equipment plugin (with sign/cms) for V500R022C00SPC310. The R020 images
( O3 t  [9 |2 e, C  ?0 U9 D$ vcannot be loaded on an R022 unit through the web or multicast tool, so an
: A0 u; m& p) z% [" J3 p# \0 BR022-based dump would be the only thing that helps me. I can share my own, }' y2 r% E% N1 M1 L1 q3 F
R022 dump back once I can read the chip.
) l8 u( Q3 f( _- {  ?1 }$ [; x+ w8 S1 s9 X, f
Thanks.7 O1 q" ^* x* k% l
您需要登录后才可以回帖 登录 | 注册

本版积分规则

关闭

站长推荐上一条 /1 下一条

相关侵权、举报、投诉及建议等,请发 E-mail:yesdong@qq.com

Powered by Discuz! X5.0 Licensed © 2001-2026 Discuz! Team.44152102000001

在本版发帖返回顶部