华为EC1308IPTV机顶盒并机的可能

synge

通过TTL线取得以下的登录信息：
U-Boot 1.1.4 (Jul 16 2008 - 06:13:29)
U-Boot code: F0500000 -> F0521EA0  BSS: -> F052909C
HI_VERSION=U_BOOT_1_1_4-M02C0405B0205B0303 @Hi3560v100_OSDrv_1_0_0_2 2008-04-19 11:08:39
RAM Configuration:
Bank #0: f0000000 128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
MAC:   00-07-63-xx-xx-xx  (隐去)
----------sw_show_logo------------
sw_flashlogo_init return 0
buf=GIF
sw_gif_decode wieth:720 height:576
Press SPACE to abort autoboot in 1 seconds
hilinux #
按空格键，进入U-boot的loader状态，输入help得到如下信息：
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
bootf   - boot application image from memory
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
loadb   - load binary file over serial line (kermit mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sw_e2prom_test   - test e2prom through i2c
sw_reg_read16    - read 32 bits registers
sw_reg_read32    - read 32 bits registers
sw_reg_write16   - read 16 bits registers
sw_reg_write32   - read 16 bits registers
swupdate        - download or upload one partition (loader,app,boot) via network using TFTP protocol
swupdate_serial   - load binary file over serial way
tftp    - download or upload image via network using TFTP protocol
version - print monitor version
hilinux #
通过setenv修改为一个有登录权限的mac地址，但正常boot机后就变为标签纸的MAC地址了

synge

正常boot机后的信息:
U-Boot 1.1.4 (Jul 16 2008 - 06:13:29)
U-Boot code: F0500000 -> F0521EA0  BSS: -> F052909C
HI_VERSION=U_BOOT_1_1_4-M02C0405B0205B0303 @Hi3560v100_OSDrv_1_0_0_2 2008-04-19 11:08:39
RAM Configuration:
Bank #0: f0000000 128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
MAC:   00-07-63-xx-xx-xx (隐去)
----------sw_show_logo------------
sw_flashlogo_init return 0
buf=GIF
sw_gif_decode wieth:720 height:576
Press SPACE to abort autoboot in 1 seconds
Hisilicon I2C Driver Init Start.
Read E2PROM ldrVersion = 1020007 ,ret=0
Read E2PROM loader information OK: version=1020007
Read E2PROM offset = 0,ret=0
Read E2PROM offset = 20,ret=0
Read E2PROM offset = 40,ret=0
Read E2PROM offset = 60,ret=0
Read E2PROM offset = 80,ret=0
Read E2PROM offset = a0,ret=0
Read E2PROM offset = c0,ret=0
Read E2PROM offset = e0,ret=0
Read E2PROM offset = 100,ret=0
Read E2PROM offset = 120,ret=0
Read E2PROM offset = 140,ret=0
Read E2PROM offset = 160,ret=0
Read E2PROM offset = 180,ret=0
Read E2PROM offset = 1a0,ret=0
Read E2PROM offset = 1c0,ret=0
Read E2PROM Partition information  OK epprom_init_flag = 1108040 , flag  = 1108040 , bInvalid=0
Boot flag : 0
## Booting image at f0008000 ...
AddMemSizeToOption tmem=128M
MAC Address:00:07:63:xx:xx:xx(隐去)
MAC Address2:01:08:64:xx:xx:xx(隐去)
Starting kernel ...
Linux version 2.6.14-hi3560v100-pilot-test-pa-release (ubuntu@ubuntu-desktop) (gcc version 3.4.3 (release) (CodeSourcery ARM Q3cvs 2004)) #16 Fri Jan 16 11:24:45 CST 2009
CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ)
Machine: Hi3560v100
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists
Kernel command line: mem=64M console=ttyAMA0,115200 root=/dev/mtdblock/2 rootfstype=cramfs rw mmz=ddr,2,0xF40M,64M  fes=128 partitions=v2&0:0:256&1:0:16&2:16:64&3:80:64&4:144:64&5:208:8&10:238:4&7:218:2&8:220:2&9:222:16&6:216:2&11:242:14 tmùþ=128M appstatus=1 macd
PID hash table entries: 512 (order: 9, 8192 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 80MB = 80MB total
Memory: 78976KB available (1679K code, 350K data, 84K init)
Mount-cache hash table entries: 512
HI_VERSION=LINUX_2_6_14-M04C0404B0202 @Hi3560v100_OSDrv_1_0_0_2 2008-07-22 16:23:20
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Hisilicon clock system V0.01
NetWinder Floating Point Emulator V0.97 (double precision)
yaffs Jan 13 2009 12:02:45 Installing.
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x0
JFFS2 version 2.2. (NAND) (C) 2001-2003 Red Hat, Inc.
Initializing Cryptographic API
Serial: AMBA PL011 UART driver
ttyAMA0 at MMIO 0x101f1000 (irq = 12) is a AMBA/PL011
ttyAMA1 at MMIO 0x101f2000 (irq = 13) is a AMBA/PL011
io scheduler noop registered
RAMDISK driver initialized: 4 RAM disks of 8192K size 1024 blocksize
physmap flash device: 1000000 at 34000000
phys_mapped_flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
phys_mapped_flash: CFI does not contain boot bank location. Assuming top.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
partition name: whole; partition offset: 0; partition size: 16777216
partition name: loader; partition offset: 0; partition size: 1048576
partition name: boot1; partition offset: 1048576; partition size: 4194304
partition name: boot2; partition offset: 5242880; partition size: 4194304
partition name: app; partition offset: 9437184; partition size: 4194304
partition name: setting; partition offset: 13631488; partition size: 524288
partition name: playlist; partition offset: 15597568; partition size: 262144
partition name: param1; partition offset: 14286848; partition size: 131072
partition name: param2; partition offset: 14417920; partition size: 131072
partition name: font; partition offset: 14548992; partition size: 1048576
partition name: logo; partition offset: 14155776; partition size: 131072
partition name: swfs; partition offset: 15859712; partition size: 917504
12 cmdlinepart partitions found on MTD device phys_mapped_flash
Creating 12 MTD partitions on "phys_mapped_flash":
0x00000000-0x01000000 : "whole"
0x00000000-0x00100000 : "loader"
0x00100000-0x00500000 : "boot1"
0x00500000-0x00900000 : "boot2"
0x00900000-0x00d00000 : "app"
0x00d00000-0x00d80000 : "setting"
0x00ee0000-0x00f20000 : "playlist"
0x00da0000-0x00dc0000 : "param1"
0x00dc0000-0x00de0000 : "param2"
0x00de0000-0x00ee0000 : "font"
0x00d80000-0x00da0000 : "logo"
0x00f20000-0x01000000 : "swfs"
HISI_NAND-MDC040003B040002 @Hi3560v100_OSDrv_1_0_0_2 2008-07-22 16:30:32
No NAND device found!!!
drivers/mtd/nand/hisilicon/hisilicon_nand.c,1069.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
TCP bic registered
VFS: Mounted root (cramfs filesystem) readonly.
Freeing init memory: 84K
init started:  BusyBox v1.1.2 (2008.05.17-09:17+0000) multi-call binary
vm.overcommit_memory = 2
vm.overcommit_ratio = 100
            _ _ _ _ _ _ _ _ _ _ _ _
            \  _  _   _  _ _ ___
            / /__/ \ |_/
           / __   /  -  _ ___
          / /  / /  / /
  _ _ _ _/ /  /  \_/  \_ ______
___________\___\__________________
Checking for boardip ...
app  is ok
app  is nor flash mount mtdblock
setting  is nor flash mount mtdblock
rmmod: hifb: No such file or directory
rmmod: fb: No such file or directory
rmmod: hi3560: No such file or directory
rmmod: tde: No such file or directory
rmmod: hiether: No such file or directory
rmmod: hidmac: No such file or directory
rmmod: mmz: No such file or directory
Hisilicon Media Memory Zone Manager
HISI_DMAC-MDC040003 @Hi3560v100_OSDrv_1_0_0_2 2008-10-17 16:22:16
NETDRV_ETHV100-M03C04DB0201 @Hi3560v100_OSDrv_1_0_0_2 2008-10-17 16:22:21
hiir: init ok. ver=Oct 17 2008, 16:33:02.
HISI_I2C-MDC040002 @Hi3560v100_OSDrv_1_0_0_2 2008-10-17 16:22:42
tde: module license 'Copyright(c)' taints kernel.
TDE_MAIN_VERSION[v1.0.0.1] Build Time[Oct 17 2008, 16:35:29]
TDE_ADP_VERSION[hi3560 adp v1.0.0.3] Build Time[Oct 17 2008, 16:35:29]
DRV356X_init
Hisilicon UMAP device driver interface: v1.00
The Vou Clk Freq is 270
DRV356X_init ok
hifb info: HIFB_MAIN_VERSION[HIFB_MAIN_VERSION] Build Time[Oct 17 2008, 16:35:31]
hifb info: video:vram0_size:13271040,vram1_size:10485760
hifb info: succeed in registering the fb0: ovl0 frame buffer device
hifb info: succeed in registering the fb1: ovl1 frame buffer device
NET: Registered protocol family 17
NET: Registered protocol family 1
CSLIP: code copyright 1989 Regents of the University of California
PPP generic driver version 2.4.2
NET: Registered protocol family 24
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
ctrlpipe_nak_limit=3, bulkpipe_nak_limit=3
hiusb-hcd hiusb-hcd.0: Hisilicon USB host controller
hiusb-hcd hiusb-hcd.0: new USB bus registered, assigned bus number 1
hiusb-hcd hiusb-hcd.0: irq 23, io base 0x80090000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
hiusb:hiusb_hcd_handle_status_intr:732: vbus error has detected.
hiusb:hiusb_hcd_hw_status_check:1641: hw abnormal, devctl=0x90
usbcore: registered new driver rt73
Get address=0x10120600, new value=0x18100800!
Get address=0x10120604, new value=0x38302820!
Get address=0x10120608, new value=0x58504840!
Get address=0x1012060c, new value=0x78706860!
Get address=0x10120610, new value=0x98918980!
Get address=0x10120614, new value=0xb8b0a8a0!
Get address=0x10120618, new value=0xd8d0c8c0!
Get address=0x1012061c, new value=0xf8f0e8e0!
Get address=0x10120620, new value=0xff!
Get address=0x10120700, new value=0x18100800!
Get address=0x10120704, new value=0x38302820!
Get address=0x10120708, new value=0x58504840!
Get address=0x1012070c, new value=0x78706860!
Get address=0x10120710, new value=0x98918980!
Get address=0x10120714, new value=0xb8b0a8a0!
Get address=0x10120718, new value=0xd8d0c8c0!
Get address=0x1012071c, new value=0xf8f0e8e0!
Get address=0x10120720, new value=0xff!
Get address=0x10120c00, new value=0x18100800!
Get address=0x10120c04, new value=0x38302820!
Get address=0x10120c08, new value=0x58504840!
Get address=0x10120c0c, new value=0x78706860!
Get address=0x10120c10, new value=0x98918980!
Get address=0x10120c14, new value=0xb8b0a8a0!
Get address=0x10120c18, new value=0xd8d0c8c0!
Get address=0x10120c1c, new value=0xf8f0e8e0!
Get address=0x10120c20, new value=0xff!
Get address=0x10120000, new value=0x8281e000!
[0]sw_mqmc_init listen_port=37001 server_ip=0 server_port=37000
OSD_WIDTH:720   OSD_HEIGHT:576  MEM_SIZE:26214400
Boot version: 8112016
Built at Sep_06_2009__21:21:13
UpdatePtTable 1000000
[0]Partition loader , 0 , 100000
[0]Partition boot1 , 100000 , 400000
[0]Partition boot2 , 500000 , 400000
[0]Partition app , 900000 , 400000
[0]Partition setting , d00000 , 80000
[0]Partition playlist , ee0000 , 40000
[0]Partition param1 , da0000 , 20000
[0]Partition param2 , dc0000 , 20000
[0]Partition font , de0000 , 100000
[0]Partition logo , d80000 , 20000
[0]Partition swfs , f20000 , e0000
Init GPIO OK!
boot_init: mute the audio gpio 27=1 .
Init screen ...
.. OK
Wrong standard ! using pal
AAAAA
sw_mem_alloc
GIF decode ok
sw_server_init open socket sucess 8 !
[1520]Thread-<tHttpServer : 0 : f0b88> opened
[1530]sw_mqmc_stb_client_init linkd=0
[1530]Thread-<tClientThread : 1 : f0c08> opened
[1530]Thread-<tMonitorThread : 2 : f0c88> opened
[1570]Thread-<tMonitorDevs : 3 : f0d08> opened
[1570]0  0x000f0b88 tHttpServer    proc=0xb744     pause=0 ppid=338 pid=341
[1570]1  0x000f0c08 tClientThread  proc=0xc910     pause=0 ppid=338 pid=342
[1570]2  0x000f0c88 tMonitorThread proc=0xae84     pause=0 ppid=338 pid=343
[1570]3  0x000f0d08 tMonitorDevs   proc=0xafcc     pause=0 ppid=338 pid=344
[1570]
ref = 4
[1630]Thread-<tMonitorThread> exit self
sw_mem_alloc
GIF decode ok
[sw_parameter_get_int] lValue=1
[value] value=8112016
sw_network_set_mac:ifconfig eth0 hw ether 00:07:63:0c:f8:fd
sw_ir_init->268
sw_ir_set_trans_callback->248
After bsettop_init gpio27:1
boot_init: unmute the audio gpio 27=0 .
ifconfig eth0 up still continue wait 1
Sunniwell shell,(c) 2007 sunniwell.
==================================
>ifconfig eth0 up still continue wait 2
ifconfig eth0 up still continue wait 3
ifconfig eth0 up still continue wait 4
ifconfig eth0 up still continue wait 5
ifconfig eth0 up still continue wait 6
ifconfig eth0 up still continue wait 7
ifconfig eth0 up still continue wait 8
ifconfig eth0 up still continue wait 9
ifconfig eth0 up still continue wait 10
ifconfig eth0 up still continue wait 11
ifconfig eth0 up still continue wait 12
ifconfig eth0 up still continue wait 13
ifconfig eth0 up still continue wait 14
ifconfig eth0 up still continue wait 15
ifconfig eth0 up still continue wait 16
ifconfig eth0 up still continue wait 17
ifconfig eth0 up still continue wait 18
ifconfig eth0 up still continue wait 19
ifconfig eth0 up still continue wait 20
ifconfig eth0 up still continue wait 21
ifconfig eth0 up still continue wait 22
ifconfig eth0 up still continue wait 23

synge

联网升级之前还可以使用sh命令进去那个shell，升级之后就不能进去，不过还是能telnet进去的，请高手们想想破解的办法。
另外据我观察，估计是还有一个身份识别是标签纸上的序列号码，估计也是识别身份的。

lq7115188

我们这是绑定MAC和MC ID两项

nov25

高人，学习了

glq888

楼主能否详细介绍进入和修改的方法，最近正为此事烦

synge

拆开机顶盒，有个ttl线的接口，然后连到终端窗口就可以看到上面的信息了！

xiaju

天数！！！！！

lrh_6215

烦请楼主能否介绍修改MAC的详细命令，诚谢！

陈本全

回复 1# synge