Broadcom路由DSL猫用的JTAG工具最新版

天涯

二位，请早点休息。我会一直测试我能想到的办法，无论结果是顺利搞定，还是有什么问题再发贴出来。

hugebird

我测试了一下，用Dlink 2740B ,2.73

1.准备TFE.bin和/128K 重组的固件
brfwmod -decomp -i EU_DSL-2740B_2.73b246CFE.bin
2. 改所有展开文件的名字，并备份一个CFE.bin
copy cfe.bin tfe.bin
3.ultraedit编辑tag.bin ,0x8a处改成ASC “1”
4，完成重组
brfwmod -comp /m:2 /128K -o new273.bin
5. 拷贝brjtag.exe到重组固件的存放目录
=======================================================
1.开电，brjtag -erase:wholeflash /unppb， 完成后关电
2. 开电， brjtag -flash:tfe  烧入刚才得到的TFE.BIN
3. 关电，上TTL线, 启动超级终端，电脑网线连在猫上，开电
4. 超级终端按空格进CFE> ,执行"e a" "y" 清楚整个flash
5. "e a" 完成后设备重启，终端上及时按空格进CFE>
6, IE访问CFE下载界面 htt://192.168.1.1
7, 下载new273.bin, 观察终端把固件烧在be020000
8. 在下载完成之后设备备重启，终端上及时按空格进CFE>
9. IE访问CFE下载界面 htt://192.168.1.1
10, 再次下载new273.bin, 观察终端把固件烧在be800000
11. 在下载完成之后设备备重启，恢复成功


终端的完整log

天涯

刚才打了一大半的消息,没有输入完,没有发出消息,有个朋友来了,离开了40分钟这样,结果消息发送失败.

谢谢你写的恢复步骤,我现在正在用最慢的办法做一次测试(直接写入WHOLEFLASH).估计要到下午4:00可以完成.

天涯

昨夜,我试过2.73 ,3.04,2.61,RG100A-AA的固件,全部都是用128K处理过了的.除2.61可以启动并引导外,其余的,都是在CFE启动后,初始化FLASH分区分配的时候死在那里了.

不过,我试刷第一分固件的时候是用0的标志,来不及用1的标志试(没有机会,因为0的标志都没有启动).我贴个图出来.

等到4点钟后,再按你92楼所讲的再做一遍.看看结果如何...这个就是前些天,我全部用128K 及 0 或1 重新打包的固件.
下面是昨夜一直在试刷的LOG记录文件.RG100A-AA CFE 到初始化分区的时候就停下,还没有能看得到提示按键终止.

[ 本帖最后由 天涯 于 2008-12-7 05:21 编辑 ]

天涯

C:\rg100av12\261>brfwmod -comp -o 2.61-cfe-128k-1.bin /M:2 /128K

===============================================================
Broadcom Chip ADSL FW Image De/Compress Utility v1.5-hugebird
===============================================================

Warning!...Source TAG Checksum not match, but build continue...
============decoding Tag information===================
    Tag Ver signature   = '6'
    SIG1(comany info)   = 'Broadcom Corporatio'
    SIG2(FW version)    = '3.10.02.EU'
    chip ID             = '6358'
    board ID            = '96358GW'
    FW endianess        = Big Endian
=======================================================

->Start packing a new image
  ->CFE will load at    0xBFC00000, length 0x0000FDBC Bytes.
  ->get CFE NVRAM Board_ID:     96358GW
  ->get CFE NVRAM MacAddress:   007404E4908F
  ->build CFE NVRAM block. Done!
  ->use cfe length 64956 to cal RootFS loading addr
  ->RootFS will load at 0xBFC20100, length 0x00322000 Bytes.
  ->Kernel will load at 0xBFF42100, length 0x0007E24C Bytes.
  ->get RootFS+Kernel checksum. CRC32 = 0x4A603558
  ->get image checksum.         CRC32 = 0x1570834E
  ->get tag checksum.           CRC32 = 0xF516B180
  ->write Tag to new image...
  ->write buffer to new image...
->Done


*** REQUESTED OPERATION IS COMPLETE, Bye! ***

刚才改为1后,出现一个警告提示,之前我做别的版本都没有发现这个提示, 为何故呢?

要如何修正这个TAG的CRC32校验值? 谢谢

hugebird

TAG修改一个数自然CRC32会有问题。每次重组，TAG的CRC都要重新计算，这个不用担心。


CFE里面试试用web界面刷fw，别用终端的f命令

[ 本帖最后由 hugebird 于 2008-12-7 06:00 编辑 ]

天涯

对的,昨晚一直都是用F命令加载的,我运行了那个3cdaemon 这个东东,这个使用上很方便,就用习惯了.等下午我用WEB页面加载,完全按照你写的步骤再来一次.看看能否顺利...

祝我好运 :)

天涯

我用BRJTAG 写入整个FLASH备份，在写到 26%的时候，再也写不下去了。

1. D:\brjtag15>wflash
   
2. 
   
3. D:\brjtag15>brjtag -flash:WHOLEFLASH /dma /fc:79
   
4. 
   
5. ==============================================
   
6. Broadcom EJTAG Debrick Utility v1.5-hugebird
   
7. ==============================================
   
8. 
   
9. Probing bus ... Done
   
10. 
    
11. Instruction Length set to 5
    
12. 
    
13. CPU running under BIG endian
    
14. 
    
15. CPU Chip ID: 00000110001101011000000101111111 (0635817F)
    
16. *** Found a Broadcom BCM6358 Rev 1 CPU chip ***
    
17. 
    
18.     - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
    
19.     - EJTAG Version ....... : 1 or 2.0
    
20.     - EJTAG DMA Support ... : Yes
    
21.     - EJTAG Implementation flags: R4k MIPS16 MIPS32
    
22.     *** DMA Mode Forced On ***
    
23. 
    
24. Issuing Processor / Peripheral Reset ... Done
    
25. Enabling Memory Writes ... Done
    
26. Halting Processor ... <Processor Entered Debug Mode!> ... Done
    
27. Clearing Watchdog ... Done
    
28. Initialize EBI ... Skipped
    
29. 
    
30. Manual Flash Selection ... Match Flash Chip (VenID:DevID = 017e : 2101)
    
31. *** Manually Selected a Spansion S29GL128N/P Uni  (16MB) Flash Chip ***
    
32. 
    
33.     - Flash Chip Window Start .... : 1f000000
    
34.     - Flash Chip Window Length ... : 01000000
    
35.     - Selected Area Start ........ : 1f000000
    
36.     - Selected Area Length ....... : 01000000
    
37. 
    
38. 
    
39. *** You Selected to Flash the WHOLEFLASH.BIN ***
    
40. 
    
41. =========================
    
42. Flashing Routine Started
    
43. =========================
    
44. Total Blocks to Erase: 128
    
45. 
    
46. Erasing block: 1 (addr = 1f000000)...Done
    
47. Erasing block: 2 (addr = 1f020000)...Done
    
48. Erasing block: 3 (addr = 1f040000)...Done
    
49. Erasing block: 4 (addr = 1f060000)...Done
    
50. Erasing block: 5 (addr = 1f080000)...Done
    
51. Erasing block: 6 (addr = 1f0a0000)...Done
    
52. Erasing block: 7 (addr = 1f0c0000)...Done
    
53. Erasing block: 8 (addr = 1f0e0000)...Done
    
54. Erasing block: 9 (addr = 1f100000)...Done
    
55. Erasing block: 10 (addr = 1f120000)...Done
    
56. Erasing block: 11 (addr = 1f140000)...Done
    
57. Erasing block: 12 (addr = 1f160000)...Done
    
58. Erasing block: 13 (addr = 1f180000)...Done
    
59. Erasing block: 14 (addr = 1f1a0000)...Done
    
60. Erasing block: 15 (addr = 1f1c0000)...Done
    
61. Erasing block: 16 (addr = 1f1e0000)...Done
    
62. Erasing block: 17 (addr = 1f200000)...Done
    
63. Erasing block: 18 (addr = 1f220000)...Done
    
64. Erasing block: 19 (addr = 1f240000)...Done
    
65. Erasing block: 20 (addr = 1f260000)...Done
    
66. Erasing block: 21 (addr = 1f280000)...Done
    
67. Erasing block: 22 (addr = 1f2a0000)...Done
    
68. Erasing block: 23 (addr = 1f2c0000)...Done
    
69. Erasing block: 24 (addr = 1f2e0000)...Done
    
70. Erasing block: 25 (addr = 1f300000)...Done
    
71. Erasing block: 26 (addr = 1f320000)...Done
    
72. Erasing block: 27 (addr = 1f340000)...Done
    
73. Erasing block: 28 (addr = 1f360000)...Done
    
74. Erasing block: 29 (addr = 1f380000)...Done
    
75. Erasing block: 30 (addr = 1f3a0000)...Done
    
76. Erasing block: 31 (addr = 1f3c0000)...Done
    
77. Erasing block: 32 (addr = 1f3e0000)...Done
    
78. Erasing block: 33 (addr = 1f400000)...Done
    
79. Erasing block: 34 (addr = 1f420000)...Done
    
80. Erasing block: 35 (addr = 1f440000)...Done
    
81. Erasing block: 36 (addr = 1f460000)...Done
    
82. Erasing block: 37 (addr = 1f480000)...Done
    
83. Erasing block: 38 (addr = 1f4a0000)...Done
    
84. Erasing block: 39 (addr = 1f4c0000)...Done
    
85. Erasing block: 40 (addr = 1f4e0000)...Done
    
86. Erasing block: 41 (addr = 1f500000)...Done
    
87. Erasing block: 42 (addr = 1f520000)...Done
    
88. Erasing block: 43 (addr = 1f540000)...Done
    
89. Erasing block: 44 (addr = 1f560000)...Done
    
90. Erasing block: 45 (addr = 1f580000)...Done
    
91. Erasing block: 46 (addr = 1f5a0000)...Done
    
92. Erasing block: 47 (addr = 1f5c0000)...Done
    
93. Erasing block: 48 (addr = 1f5e0000)...Done
    
94. Erasing block: 49 (addr = 1f600000)...Done
    
95. Erasing block: 50 (addr = 1f620000)...Done
    
96. Erasing block: 51 (addr = 1f640000)...Done
    
97. Erasing block: 52 (addr = 1f660000)...Done
    
98. Erasing block: 53 (addr = 1f680000)...Done
    
99. Erasing block: 54 (addr = 1f6a0000)...Done
    
100. Erasing block: 55 (addr = 1f6c0000)...Done
     
101. Erasing block: 56 (addr = 1f6e0000)...Done
     
102. Erasing block: 57 (addr = 1f700000)...Done
     
103. Erasing block: 58 (addr = 1f720000)...Done
     
104. Erasing block: 59 (addr = 1f740000)...Done
     
105. Erasing block: 60 (addr = 1f760000)...Done
     
106. Erasing block: 61 (addr = 1f780000)...Done
     
107. Erasing block: 62 (addr = 1f7a0000)...Done
     
108. Erasing block: 63 (addr = 1f7c0000)...Done
     
109. Erasing block: 64 (addr = 1f7e0000)...Done
     
110. Erasing block: 65 (addr = 1f800000)...Done
     
111. Erasing block: 66 (addr = 1f820000)...Done
     
112. Erasing block: 67 (addr = 1f840000)...Done
     
113. Erasing block: 68 (addr = 1f860000)...Done
     
114. Erasing block: 69 (addr = 1f880000)...Done
     
115. Erasing block: 70 (addr = 1f8a0000)...Done
     
116. Erasing block: 71 (addr = 1f8c0000)...Done
     
117. Erasing block: 72 (addr = 1f8e0000)...Done
     
118. Erasing block: 73 (addr = 1f900000)...Done
     
119. Erasing block: 74 (addr = 1f920000)...Done
     
120. Erasing block: 75 (addr = 1f940000)...Done
     
121. Erasing block: 76 (addr = 1f960000)...Done
     
122. Erasing block: 77 (addr = 1f980000)...Done
     
123. Erasing block: 78 (addr = 1f9a0000)...Done
     
124. Erasing block: 79 (addr = 1f9c0000)...Done
     
125. Erasing block: 80 (addr = 1f9e0000)...Done
     
126. Erasing block: 81 (addr = 1fa00000)...Done
     
127. Erasing block: 82 (addr = 1fa20000)...Done
     
128. Erasing block: 83 (addr = 1fa40000)...Done
     
129. Erasing block: 84 (addr = 1fa60000)...Done
     
130. Erasing block: 85 (addr = 1fa80000)...Done
     
131. Erasing block: 86 (addr = 1faa0000)...Done
     
132. Erasing block: 87 (addr = 1fac0000)...Done
     
133. Erasing block: 88 (addr = 1fae0000)...Done
     
134. Erasing block: 89 (addr = 1fb00000)...Done
     
135. Erasing block: 90 (addr = 1fb20000)...Done
     
136. Erasing block: 91 (addr = 1fb40000)...Done
     
137. Erasing block: 92 (addr = 1fb60000)...Done
     
138. Erasing block: 93 (addr = 1fb80000)...Done
     
139. Erasing block: 94 (addr = 1fba0000)...Done
     
140. Erasing block: 95 (addr = 1fbc0000)...Done
     
141. Erasing block: 96 (addr = 1fbe0000)...Done
     
142. Erasing block: 97 (addr = 1fc00000)...Done
     
143. Erasing block: 98 (addr = 1fc20000)...Done
     
144. Erasing block: 99 (addr = 1fc40000)...Done
     
145. Erasing block: 100 (addr = 1fc60000)...Done
     
146. Erasing block: 101 (addr = 1fc80000)...Done
     
147. Erasing block: 102 (addr = 1fca0000)...Done
     
148. Erasing block: 103 (addr = 1fcc0000)...Done
     
149. Erasing block: 104 (addr = 1fce0000)...Done
     
150. Erasing block: 105 (addr = 1fd00000)...Done
     
151. Erasing block: 106 (addr = 1fd20000)...Done
     
152. Erasing block: 107 (addr = 1fd40000)...Done
     
153. Erasing block: 108 (addr = 1fd60000)...Done
     
154. Erasing block: 109 (addr = 1fd80000)...Done
     
155. Erasing block: 110 (addr = 1fda0000)...Done
     
156. Erasing block: 111 (addr = 1fdc0000)...Done
     
157. Erasing block: 112 (addr = 1fde0000)...Done
     
158. Erasing block: 113 (addr = 1fe00000)...Done
     
159. Erasing block: 114 (addr = 1fe20000)...Done
     
160. Erasing block: 115 (addr = 1fe40000)...Done
     
161. Erasing block: 116 (addr = 1fe60000)...Done
     
162. Erasing block: 117 (addr = 1fe80000)...Done
     
163. Erasing block: 118 (addr = 1fea0000)...Done
     
164. Erasing block: 119 (addr = 1fec0000)...Done
     
165. Erasing block: 120 (addr = 1fee0000)...Done
     
166. Erasing block: 121 (addr = 1ff00000)...Done
     
167. Erasing block: 122 (addr = 1ff20000)...Done
     
168. Erasing block: 123 (addr = 1ff40000)...Done
     
169. Erasing block: 124 (addr = 1ff60000)...Done
     
170. Erasing block: 125 (addr = 1ff80000)...Done
     
171. Erasing block: 126 (addr = 1ffa0000)...Done
     
172. Erasing block: 127 (addr = 1ffc0000)...Done
     
173. Erasing block: 128 (addr = 1ffe0000)...Done
     
174. 
     
175. Loading WHOLEFLASH.BIN to Flash Memory...
     
176.   26%   bytes = 4468968

复制代码

天涯

Flash write error.  Verify failed
Error writing flash sector 127.Flash write error.  Verify failed
Error writing flash sector 127.Scratch pad is not initialized.
Scratch pad is not initialized.
No scratch pad found.  Initialize scratch pad...
Flash write error.  Verify failed

仍然是写 扇区 127 出错.

天涯

刚才把全部可以刷并可以启动的固件都试了一遍，RG100A，2.73，9113都试了，都无法保存配置。基本上都和这个类似的提示：Error writing flash sector 127.Flash write error.  Verify failed

我恨死这个127，固件也直是固执，那个地方写不进去，怎么就不知道哪能写得进去的地方写呢？ ：）

只有等HUGEBIRD大大来指点了。