Temat: Livebox 2.0 ZTE a OpenWrt
Witam.
Posiadam Livebox 2.0 ZTE (właściwa nazwa urządzenia: ZTE ZXV10 H202N)
procesor jaki jest w LIVEBOX 2.0 ZTE ma oznaczenia:
IKANOS IKE6836-A0
P81-C
WAP 1030
Pamięć RAM: 128MB
Pamięć FLASH 32MB
na płycie liveboxa znajduje się złącze przez które można wejść do konsoli.
niestety u mnie goldpinów nie było więc musiałem dolutować. Brakuje pinu GND ( jest zaraz za Rx ale nie ma dziury w płycie na pin).
po podłączeniu rs232ttl i ustawieniu portu na:
57600 8n1
wyświetla się:
ZTE Boot 1.3.6 for h202n_ika (Mar 24 2010 - 15:03:21)
CPU: IKANOS Fusiv 160 Family
DRAM: 128 MB
Flash: 32 MB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
Net: emac1
Type h for HELP. Have fun!
run csp boot cmd: boot_csp HO FT
Hit any key to stop autoboot: 0
Found image at 0xbf300000
Found image at 0xbe000000
Found rescue image at 0x01300000
Found normal image at 0x00000000
Try boot normal image at 0x00000000...
typ bootm 0xbe000128
## Booting image at be000128 ...
Image Name: adi_kernel_2.6
Created: 2010-10-21 17:18:34 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1239529 Bytes = 1.2 MB
Load Address: 80040000
Entry Point: 8041d000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
Linux version 2.6.18.8 (sah0096@sahwbld03) (gcc version 3.4.3) #1 Thu Oct 21 190
Try read csp boot para at 0x87eb7db0...
Boot 1'th image
boot image type = 1
board_memsize=128, total_mem_size=134217728
CPU revision is: 6836c400
Determined physical RAM map:
memory: 08000000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 32768
Kernel command line: root=/dev/mtdblock5 rootfstype=squashfs kernel_start=0xbe0
Primary instruction cache 16kB, linesize 32 bytes.
Primary data cache 8kB, linesize 32 bytes.
Fusiv LX4189 CACHES
Synthesized TLB refill handler (17 instructions).
Synthesized TLB load handler fastpath (31 instructions).
Synthesized TLB store handler fastpath (31 instructions).
Synthesized TLB modify handler fastpath (25 instructions).
PID hash table entries: 1024 (order: 10, 4096 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 124416k/131072k available (3410k kernel code, 6620k reserved, 541k data)
Mount-cache hash table entries: 512
Checking for 'wait' instruction... unavailable.
NET: Registered protocol family 16
Fusiv PCI: starting...
SCSI subsystem initialized
....
i dużo tego więcej
na początku wystarczy nacisnąć dowolny klawisz i jest dostęp do ZTE BOOT:
> h
? - alias for 'help'
bdinfo - print Board Info structure
boot - boot default, i.e., run default csp boot command
cspimls - list all CSP images found in flash
echo - echo args to console
exit - return to normal user
flinfo - print FLASH memory information
gbm - get boot mode
help - print online help
iminfo - print header information for application image
imls - list all images found in flash
lanresc - try loading LAN rescue image
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset - Perform RESET of the CPU
sleep - delay execution for some time
su - switch to super user
tag - set or get or list tag parmeters
upgrade_csp - upgrade CSP image
version - print monitor version
command help return 0> printenv
author=Leo@analog devices
bootdelay=1
baudrate=57600
ethaddr=00:00:00:01:02:03
ethact=emac1
ipaddr=192.168.1.254
serverip=192.168.1.66
preboot=echo;echo Type "h" for HELP. Have fun!;echo
netboot=dhcp;tftp;run netargs; bootm
nfsargs=setenv bootargs root=/dev/nfs ip=dhcp
localargs=setenv bootargs root=/dev/mtdblock2 ip=dhcp
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) read-only=readonly
netargs=run nfsargs addmisc
flash_nfs=run nfsargs addmisc;bootm $(kernel_addr)
flash_local=run localargs addmisc;bootm $(kernel_addr)
netboot_initrd=dhcp;tftp;tftp 80600000 initrd;setenv bootargs root=/dev/ram ramdisk_size=8192 ip=dhcp;run addmisc;bootm 80400000 80600000
rootpath=/export/miniroot-mipsel
autoload=no
myfs_start=0xbfd40000
kernel_addr=BFC60000
ramdisk_addr=B0100000
u-boot=u-boot.bin
bootfile=kernel.img
load=dhcp;tftp 80400000 $(u-boot)
load_kernel=dhcp;tftp 80400000 $(bootfile)
update_uboot=run load;protect off BFC00000 BFC3FFFF;erase BFC00000 BFC3FFFF;cp.b 80400000 BFC00000 $(filesize)
update_kernel=run load_kernel;erase BFC60000 BFD5FFFF;cp.b 80400000 BFC60000 $(filesize)
initenv=erase bfc40000 bfc5ffff
stdin=serial
stdout=serial
stderr=serialEnvironment size: 1176/65532 bytes
command printenv return 0
niestety nie znam hasła do super user
na francuzkim forum znalazłem jeszcze komendy dla superuser
> su
Enter superuser password: ********
command su return 0$ h
? - alias for 'help'
askenv - get environment variables from stdin
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run default csp boot command
boot_csp- search and boot CSP Image in flash
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
button - test button
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
cspimls - list all CSP images found in flash
echo - echo args to console
erase - erase FLASH memory
erase2 - erase memory or flash
exit - return to normal user
flinfo - print FLASH memory information
gbm - get boot mode
go - start application at address 'addr'
gpio - test GPIO
help - print online help
iminfo - print header information for application image
imls - list all images found in flash
lanresc - try loading LAN rescue image
led - test LED
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
phy - read or write eth phy reg
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
read - read memory or flash or register
reg - read or write a reg
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
sbm - set boot mode
setenv - set environment variables
sleep - delay execution for some time
su - switch to super user
tag - set or get or list tag parmeters
tftpboot- boot image via network using TFTP protocol
upgrade_boot - Upgrade the Boot-Loader
upgrade_csp - upgrade CSP image
version - print monitor version
write - write memory or flash or register
command help return 0
$
po załadowaniu systemu i naciśnięciu klawisza ENTER wyświetla się:
starting pid 262, tty '': '-/bin/login'
LIVEBOX login:
domyślne hasło admin/admin pasuje ale jakby nic się nie dzieje. przy wpisywaniu innych loginów i haseł wyskakuje złe hasło.
we flashu sa 2 obrazy:
Found rescue image at 0x01300000
Found normal image at 0x00000000
Try boot normal image at 0x00000000...
gdy router uruchamia się normalnie startuje "normal image" jeśli najpierw naciśniemy reset w liveboxie i z naciśniętym uruchomi się liveboxa to on szuka najpierw:
Lan RESCUE
a później już uruchamia rescue
w ZTE BOOT komendą lanresc można bootować urządzenie przez BOOTP
skonfigurowałem to u siebie i podałem mu różne image ale do LIVEBOX Sagem i niestety każde po pobraniu jest odrzucone
> lanresc
Halt 88E6061 switch
Init 88E6061 switch
BOOTP broadcast 1
Using emac1 device
TFTP from server 192.168.1.66; our IP address is 192.168.1.254
Filename '/tftpboot/kernel.img'.
Load address: 0x80400000
Loading: *#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
################
done
Bytes transferred = 3407872 (340000 hex)
Halt 88E6061 switch
Boot LAN resc image failed! ret=-1
command lanresc return -1
dodaje jeszcze log uruchomienia:
http://wklej.to/r106b
pliki img znalazłem na hiszpańskim forum http://foro.seguridadwireless.net/livebox-2/ tylko to co tam jest głównie tyczy sie livebox 2.0 Sagem a on ma innego uboota