Temat: Technicolor TC7200 i mod firmware'u
Witam wszystkich forumowiczów!
Ostatnio NETIA mnie trochę rozwścieczyła, ale oszczędzę szczegółów.
Jak w temacie. Chciałbym maksymalnie obciąć oprogramowanie routera (SNMP z wewnątrz (LAN) i zewnątrz (NETIA) i http, bo zazwyczaj tam znajduje się najwięcej błędów. Jeżeli się mylę, proszę mnie poprawić) i wycisnąć z niego wszystko co się da. Ma 5GHz, bez ac co prawda, ale lepsze to niż nic. O OpenWrt/LEDE nawet nie marzę, bo: 1. musiałbym wgrać custom bootloader (Nie chcę stracić kontroli nad Technicolorem. Jeżeli bootloader odmówi działania, jestem w kropce, bo jest na kości NAND, do której nie mam programatora). 2. Obecność modemu DOCSIS.
Moje obserwacje i wnioski:
Log ze startu (bootloader)
BCM3383A2
Sync: 0
MemSize: 128 M
Chip ID: BCM3383Z-B0
BootLoader Version: 2.4.0alpha18p1 Pre-release Gnu spiboot dual-flash reduced DDR drive linux
Build Date: Aug 14 2012
Build Time: 09:44:20
SPI flash ID 0xc22014, size 1MB, block size 64KB, write buffer 256, flags 0x0
NAND flash: Device size 64 MB, Block size 16 KB, Page size 512 B
Cust key size 128
parameter offset is 43872
Signature/PID: a822
Reading flash map at ff30, size 192
Successfully restored flash map from SPI flash!
NandFlashRead: Reading offset 0x19c0000, length 0x5c
Image 1 Program Header:
Signature: a822
Control: 0005
Major Rev: 0100
Minor Rev: 01ff
Build Time: 2016/10/20 07:27:02 Z
File Length: 4963401 bytes
Load Address: 80004000
Filename: TC7200-CF.01.42-161018-F-1c1.bin
HCS: c8e1
CRC: da75d3c7
Found image 1 at offset 1ac0000
NandFlashRead: Reading offset 0x2080000, length 0x5c
NandFlashRead: Reading offset 0x2740000, length 0x5c
Image 3 Program Header:
Signature: a822
Control: 0005
Major Rev: 0100
Minor Rev: 01ff
Build Time: 2016/10/20 07:28:24 Z
File Length: 1507236 bytes
Load Address: 84010000
Filename: LNXCF.01.42-kernel-20161020.bin
HCS: 1c27
CRC: a1cc5c2b
Found image 3 at offset 2840000
Enter '1', '2', or 'p' within 2 seconds or take default...
. .
NandFlashRead: Reading offset 0x2740000, length 0x200
NandFlashRead: Reading offset 0x2740200, length 0x16fe00
Performing CRC on Image 3...
CRC time = 33085112
Detected LZMA compressed image... decompressing...
Target Address: 0x84010000
decompressSpace is 0x8000000
Elapsed time 1350052790
Decompressed length: 5549921
Done Copying Root File System...
NandFlashRead: Reading offset 0x19c0000, length 0x200
NandFlashRead: Reading offset 0x19c0200, length 0x4bbaa5
Performing CRC on Image 1...
CRC time = 144930919
Detected LZMA compressed image... decompressing...
Target Address: 0x80004000
decompressSpace is 0x8000000
Elapsed time 3929749940
Decompressed length: 23743144
Copying partition table to 0x83fffc04 180
Copying partition table to 0x80000904 180
Executing Image 1...
eCos - hal_diag_init
Init device '/dev/BrcmTelnetIoDriver'
Init device '/dev/ttydiag'
Init tty channel: 816a84f8
Init device '/dev/tty0'
Init tty channel: 816a8518
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: b4e00500.2
Set output buffer - buf: 0x818403d0 len: 4096
Set input buffer - buf: 0x818413d0 len: 4096
BCM 33XX SERIAL config
Init device '/dev/ser1'
BCM 33XX SERIAL init - dev: b4e00520.3
Set output buffer - buf: 0x818423d0 len: 4096
Set input buffer - buf: 0x818433d0 len: 4096
BCM 33XX SERIAL config
Init device '/dev/ser2'
InitBoard: MIPS frequency 637200000
Function: SetHardcodeVendorProfile
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver...
[00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0xc22014
Waited 12 iterations after device ID read
NAND flash: Device size 64 MB, Block size 16 KB, Page size 512 B
[00:00:00 01/01/1970] [tStartup] BcmNandFlashDevice::DetectNandFlash: (NAND Flash Device Factory) WARNING - Detected NAND flash with JEDEC ID =0x20762076
Found bootloader flash map at 0x80000904.
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver...
ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully.
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
Detecting the next image number that we will store to by default...
Bootloader indicates we are running image 1
By default, we will dload to image number 2!
By default, we will dload to block number 0!
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully.
[Askey Debug]: No VP-24, use the default valus
BcmWiFi80211NonVolSettings::GetInstance(0): WARNING - the instance pointer is NULL, and someone is accessing it!
BcmWiFi80211NonVolSettings::GetInstance(0): WARNING - the instance pointer is NULL, and someone is accessing it!
BcmWiFi80211NonVolSettings::GetInstance(0): WARNING - the instance pointer is NULL, and someone is accessing it!
BcmWiFi80211NonVolSettings::GetInstance(0): WARNING - the instance pointer is NULL, and someone is accessing it!
BcmWiFi80211NonVolSettings::GetInstance(1): WARNING - the instance pointer is NULL, and someone is accessing it!
BcmWiFi80211NonVolSettings::GetInstance(1): WARNING - the instance pointer is NULL, and someone is accessing it!
BcmWiFi80211NonVolSettings::GetInstance(1): WARNING - the instance pointer is NULL, and someone is accessing it!
BcmWiFi80211NonVolSettings::GetInstance(1): WARNING - the instance pointer is NULL, and someone is accessing it!
[00:00:00 01/01/1970] [tStartup] BcmCmBpiNonVolSettings::BcmCmBpiNonVolSettings: (Euro-Docsis CM BPI NonVol Settings) WARNING - Singleton pointer is not NULL! There are multiple instances! Leaving the singleton pointer alone...
BcmPcpClientServiceAppIf::GetSingletonInstance: WARNING - the singleton is NULL, and someone is accessing it!
mtaNvCalcChecksum: checksum= 1273036263
Reading Permanent settings from non-vol...
Checksum for permanent settings: 0xe6cd4c3b
[00:00:00 01/01/1970] [tStartup] BcmHalIfNonVolSettings::ReadFromImpl: (HalIf NonVol Settings) WARNING - Read older version of the settings (0.21); they have been upgraded to version 0.23, preserving original settings.
[00:00:00 01/01/1970] [tStartup] BcmWiFi80211SromNonVolSettings::ReadFromImpl: (WiFi 802.11 Srom NonVol Settings) WARNING - Read older version of the settings (0.1); they have been upgraded to version 0.2, preserving original settings.
[00:00:00 01/01/1970] [tStartup] BcmWiFi80211SromNonVolSettings::ReadFromImpl: (WiFi 802.11 Srom NonVol Settings) WARNING - Read older version of the settings (0.1); they have been upgraded to version 0.2, preserving original settings.
[00:00:00 01/01/1970] [tStartup] BcmBfcTr69NonVolSettings::ReadFromImpl: (TR69 NonVol Settings) WARNING - Read older version of the settings (0.1); they have been upgraded to version 0.2, preserving original settings.
Setting downstream calibration signature to '5.5.8mp5'
[00:00:00 01/01/1970] [tStartup] ThomBfcNonVolSettings::ReadFromImpl: (Thomson BFC NonVol Settings) WARNING - Read older version of the settings (0.1); they have been upgraded to version 0.2, preserving original settings.
[00:00:00 01/01/1970] [tStartup] ThomWiFi80211NonVolSettings::ReadFromImpl: (Thomson WiFi 802.11 NonVol Settings) WARNING - Read older version of the settings (0.3); they have been upgraded to version 0.4, preserving original settings.
[00:00:00 01/01/1970] [tStartup] BcmEmtaSipNonVolSettings::ReadFromImpl: (EMTA Config NonVol Settings) ERROR - Read unsupported version (less than 1.0)! These settings are not valid!
[00:00:00 01/01/1970] [tStartup] BcmEmtaSipNonVolSettings::ReadFrom: (EMTA Config NonVol Settings) ERROR - EMTA Config NonVol Settings failed to read all of its settings from the buffer!
[00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: ERROR - A contained Settings object failed to parse the Group settings!
[00:00:00 01/01/1970] [tStartup] BcmSpectrumAnalyzerNonVolSettings::IsDefault: (Spectrum Analyzer NonVol Settings) Permanent settings are default!
[00:00:00 01/01/1970] [tStartup] BcmEmtaSipNonVolSettings::IsDefault: (EMTA Config NonVol Settings) Permanent settings are default!
*
*
* One or more of the settings groups was missing, possibly as a result of a code upgrade.
*
*
*
*
* One or more of the settings groups was upgraded.
*
*
Settings were read and verified.
Reading Dynamic settings from non-vol...
Checksum for dynamic settings: 0x95702c98
Settings were read and verified.
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Setting FPM Buffer size to: 256 Base Address: 0x836d1a00
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: fFpmLargestBufferSize: 2048 fFpmSizeShiftBits: 0x8
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Pool index: 0 pool size: 2048
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Pool index: 1 pool size: 1024
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Pool index: 2 pool size: 512
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Pool index: 3 pool size: 256
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Lookup table index: 0 pool size: 3
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Lookup table index: 1 pool size: 2
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Lookup table index: 2 pool size: 1
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Lookup table index: 3 pool size: 1
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Lookup table index: 4 pool size: 0
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Lookup table index: 5 pool size: 0
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Lookup table index: 6 pool size: 0
[00:00:00 01/01/1970] [tStartup] BcmBfcFpmDriver::Init: Lookup table index: 7 pool size: 0
------------------------------------
Free Pool Manager Configuration
----------------------------------Creating a new host MSG PROC DQM manager. Instance: 83f65000, DQM_REGS = b8601800, CTRL_REGS = b8601000
Initializing main MSP DQM interrupts.
b8601000: 01800008
b8601004: 00000000
b8601008: 00000008
b860100c: 00000000
b8601010: 000c0000
b8601014: 00000000
b8601018: 00000000
b860101c: 00000000
--
Buffer size in Bytes......Creating a new host FAP DQM manager. Instance: 83f64f10
Initializing main FAP DQM interrupts.
b8401000: 00000008
b8401004: 00000000
b8401008: 00000008
b840100c: 00000000
b8401010: 00000000
b8401014: 00000000
b8401018: 00000000
b840101c: 00000000
......... 256
Number of Tokens................... 32768
Creating a new host PMC DQM manager. Instance: 83f683a4, DQM_REGS = b8801800, CTRL_REGS = b8801000
Initializing main PMC DQM interrupts.
b8801000: 00000000
b8801004: 00000000
b8801008: 00000008
b880100c: 00000000
b8801010: 00000000
b8801014: 00000004
b8801018: a1c9c380
b880101c: 00efe3b0
Creating a new host PMC DQM manager. Instance: 83f68324, DQM_REGS = b8801800, CTRL_REGS = b8801000
Single buffer tokens used count.... 32
Double buffer tokens used ocunt.... 32
Triple buffer tokens used count.... 32
Quadruple buffer tokens used count. 33
Base Address of FPM Memory ........ 0xb2200200
Base Address of FPM Mem in DDR2.... 0x836d1a00
Total Configured FPM Memory Size... 8388608
Free Fifo Full..................... 0
Free Fifo Empty.................... 1
Alloc Fifo Full.................... 1
Alloc Fifo Empty................... 0
Number of tokens available......... 32768
Number of not valid token frees.... 0
Number of not valid token multi.... 0
Overflow Count..................... 0
Underflow Count.................... 0
[00:00:00 01/01/1970] [tStartup] BcmBfcPacketAlloc::Init: Packet Alloc Header Buffer Start Addr: 0x82fd1910 Length: 0x700000 Max Buffer Size: 0xe0
PCI Core Init! instance = 0, pCoreRegs = b2800000
PCI Core PowerUp! instance = 0.
PCI ENUMERATE****************************************************************************
Checking bus #1
Checking device #0
In pcieEnumerateDevices(0) found a card: deviceNo = 0, funcNo = 0, busNo = 1, pcieAddr = 00000000
In pcieEnumerateDevices: vendor = 000014e4, device = 00004358
PCIELIB: Setting PCIE clk request mode to 1 for active power savings.
PCIELIB: Found Capability ID = 16
PCIELIB: ClkReq power mode set to 1.
PCIELIB: Setting PCIE ASPM L1 mode to 1 for active power savings.
PCIELIB: Found Capability ID = 16
PCIELIB: ASPM L1 power mode set to 1.
END PCIE ENUMERATE************************************************************************
PCI Core Init! instance = 1, pCoreRegs = b2a00000
PCI Core PowerUp! instance = 1.
PCI ENUMERATE****************************************************************************
Checking bus #1
Checking device #0
In pcieEnumerateDevices(1) found a card: deviceNo = 0, funcNo = 0, busNo = 1, pcieAddr = 83fbc1a0
In pcieEnumerateDevices: vendor = 000014e4, device = 00004359
PCIELIB: Setting PCIE clk request mode to 1 for active power savings.
PCIELIB: Found Capability ID = 16
PCIELIB: ClkReq power mode set to 1.
PCIELIB: Setting PCIE ASPM L1 mode to 1 for active power savings.
PCIELIB: Found Capability ID = 16
PCIELIB: ASPM L1 power mode set to 1.
END PCIE ENUMERATE************************************************************************
Booting Linux on TP1...
BootLinux() TP1
NandFlashRead: Detected out-of-order block @offset 0x28b0000, tagged offset 0xffffff00, expected offset 0x170000
NandFlashRead: Failed to find replacement block!
BootLinux: stopping the intermediate AVS code...
<<<<< rx_thread sent initial handshake >>>>>>
BootLinux: intermediate AVS code stopped normally (count = 1)
Powering on USB
Linux Boot Args: console=ttyS0,115200 ubi.mtd=linuxkfs ubi.mtd=linuxapps root=ubi0:rootfs ro noinitrd rootfstype=ubifs mem=67108864@67108864 mem=0@0
[00:00:01 01/01/1970] [Telnet Thread] BcmTelnetThread::ThreadMain: (Telnet Thread) Telnet server thread running...
Creating SNMP agent cablemodem agent
cablemodem agent disabling management.
cablemodem agent defering traps.
Creating BcmEmtaCommandTable
Creating BcmEmtaEndptCommandTable
If you pressed the 's' key before this point, we will skip driver initialization...
AVS Thread Constructor....
AVS Thread InitAVS: Bootloader AVS data was retrieved successfully.
xfer = 0x816fb158
disabled = 0
rmon ratio = 1073
sigma = -114
DacChange = -41
adc_margin = 150
madcperdac = 317
dac_margin = -428
flash margin = 150
marginOffset = 65534
deviceMap = 0x816fb170
thresholds = 0x816fb20c
K = 1.073, L = 2.92, BG_Code = 5
Creating TR-069 Thread...
Creating DOCSIS Control Thread...
Initializing main DTP DQM interrupts.
b8201000: 0000004c
b8201004: 00000000
b8201008: 00000008
b820100c: 00000000
b8201010: 00000000
b8201014: 00040000
b8201018: 00000000
b820101c: 00000000
Creating a new host FAP DQM manager. Instance: 82f4d948
Creating a new host FAP DQM manager. Instance: 82f4d860
Creating a new host UTP DQM manager. Instance: 82f49748
Initializing main UTP DQM interrupts.
b8001000: 00000049
b8001004: 00000000
b8001008: 00000008
b800100c: 00000000
b8001010: 00000001
b8001014: 00000000
b8001018: 00000000
b800101c: 00000000
Initalizing Gfap Hal..
LNA Detected = BCM3413
ADC Clocks aligned
Initializing all 8 downstreams - this takes a while. Patience, Grasshopper...
1 2 3 4 5 6 7 8
Creating a new host UTP DQM manager. Instance: 82f0ca7c
Creating a new host UTP DQM manager. Instance: 82efc68c
Creating a new host UTP DQM manager. Instance: 82efc5c4
Powering UP switch. PIN = 14
Creating a new host MSG PROC DQM manager. Instance: 82efbd60, DQM_REGS = b8601800, CTRL_REGS = b8601000
Creating a new host MSG PROC DQM manager. Instance: 82efbc98, DQM_REGS = b8601800, CTRL_REGS = b8601000
Creating a new host MSG PROC DQM manager. Instance: 82efbaf4, DQM_REGS = b8601800, CTRL_REGS = b8601000
Creating a new host MSG PROC DQM manager. Instance: 82efb8f4, DQM_REGS = b8601800, CTRL_REGS = b8601000
Creating a new host FAP DQM manager. Instance: 82efb6f4
Creating a new host FAP DQM manager. Instance: 82efb4ec
Creating a new host MPEG PROC DQM manager. Instance: 82efb2e4, DQM_REGS = b8a01800, CTRL_REGS = b8a01000
Initializing main MEP DQM interrupts.
b8a01000: 00000008
b8a01004: 00000000
b8a01008: 00000008
b8a0100c: 00000000
b8a01010: 00000000
b8a01014: 00000000
b8a01018: 00000000
b8a0101c: 00000000
Creating a new host MPEG PROC DQM manager. Instance: 82efb0ec, DQM_REGS = b8a01800, CTRL_REGS = b8a01000
Creating a new host MSG PROC DQM manager. Instance: 82ee2ad0, DQM_REGS = b8601800, CTRL_REGS = b8601000
Creating a new host MSG PROC DQM manager. Instance: 82ee28c8, DQM_REGS = b8601800, CTRL_REGS = b8601000
Creating a new host MSG PROC DQM manager. Instance: 82ee2970, DQM_REGS = b8601800, CTRL_REGS = b8601000
Creating a new host MSG PROC DQM manager. Instance: 82ee06a4, DQM_REGS = b8601800, CTRL_REGS = b8601000
Creating a new host MSG PROC DQM manager. Instance: 82ee0618, DQM_REGS = b8601800, CTRL_REGS = b8601000
Register Int Handler: busNo = 1, device = 0
Register Int Handler: busNo = 1, device = 0
Creating a new host MPEG PROC DQM manager. Instance: 826cac8c, DQM_REGS = b8a01800, CTRL_REGS = b8a01000
Creating a new host MPEG PROC DQM manager. Instance: 8256a370, DQM_REGS = b8a01800, CTRL_REGS = b8a01000
Creating a new host MPEG PROC DQM manager. Instance: 82569930, DQM_REGS = b8a01800, CTRL_REGS = b8a01000
Creating a new host MPEG PROC DQM manager. Instance: 82569878, DQM_REGS = b8a01800, CTRL_REGS = b8a01000
Creating a new host MSG PROC DQM manager. Instance: 824ec504, DQM_REGS = b8601800, CTRL_REGS = b8601000
Zauważyłem, że w routerze o dziwo znajdują się 2 flashe:
...
SPI flash ID 0xc22014, size 1MB, block size 64KB, write buffer 256, flags 0x0
NAND flash: Device size 64 MB, Block size 16 KB, Page size 512 B
Cust key size 128
parameter offset is 43872
Signature/PID: a822
Reading flash map at ff30, size 192
Successfully restored flash map from SPI flash!
...
Po dalszej inspekcji okazało się, że może być więcej połączeń RS232 (interesuje mnie tty0):
...
Init device '/dev/tty0'
Init tty channel: 816a8518
...
Rzeczywiście na płycie znajdują się 2 seriale: 1 jest do kontroli bootloadera, a 2 zostało schowane pod radiatorem. Po podpięciu się do niego 2 igłami i GND od bootloadera, ujrzałem log ze startu kernela (czyli jest to /dev/tty0). Po starcie systemu odpala się /bin/login.
Mam następujące pytania:
Pytanie 1: Czy ktoś potrafi określić do czego dokładnie flash SPI służy? Tylko do przechowywania mapy partycji z NANDu, czy może do czegoś jeszcze?
Pytanie 2: Niestety, nie znam hasła root'a. Chciałem zdumpować NAND przez bootloader, ale ten nie daje możliwości czytania niczego z adresem mniejszym niż 0x8000000. Natomiast z logów wynika, że firmware jak i kernel są rozpakowywane na adresach dostępnych do odczytania. Czy możliwa jest operacja, w której czekam aż obydwa obrazy się rozpakują, restart, i dump adresów z rozpakowanymi obrazami?
Pytanie 3: Jak mogę wykonać dump'a aktualnego firmware? Mogę to oczywiście zrobić z poziomu konsoli (po odnalezieniu hasła root'a), ale chciałbym mieć pewność, że do kości nic nie pisze. Bootloader daje możliwość zgrania obrazu przez TFTP do RAM i odpalenie go (jak to każdy normalny bootloader). Może ktoś ma jakiś initram współpracujący z tym SoCem?
Pytanie 4: W przypadku braku możliwości zgrania danych z NAND, czy mogę zmusić modem DOCSIS do wykonania DOCSIS-TFTP i pobrania aktualnego firmware NETII na ich serwerze TFTP w sieci CMTS, czy może jednak na tym serwerze są tylko pliki konfiguracyjne dla modemu (typu ilość kanałów, modulacja...)?
Temat nie jest związany z LEDE, więc nie umieściłem go w sekcji "Oprogramowanie", jest natomiast związany z modyfikacją oprogramowania. Jeśli Administroator uważa, że post powinien znaleźć się w innej sekcji, proszę o przeniesienie.
Z góry dziękuję wszystkim za pomoc.
PS: Testów dokonuję na własnym TC7200, kupionym na OLX. NIE MODYFIKUJĘ ROUTERU NETII. Po udanej modyfikacji, zajmę się spoofowaniem (lub może permamentą zmianą) adersu MAC modemu, abym mógł podłączyć własny TC7200.