FAQ o OpenWrt | Sprzedam różne routery | Oddam

slqa · 2024-07-03 07:27:13

slqa
Użytkownik
Nieaktywny

Zarejestrowany: 2024-06-30
Posty: 2

Odp: MC888 Pro

Hej,
Odgrzebuje temat, bo mam podobny w domu MC888. Znalazłem na sieci posty stich86 na różnych forach, że możnaby sie jakoś dobrać do adb i coś dodać od siebie, więc zacząłem grzebać.
Znalazłem na github sposób stich86 na wejście do download z linux'a, wysłanie sg_raw powoduje permamentne wejście do download, później AT+ZCDRUN=F, wraca go do domyślnego CDROM. Trzeba wyłaczyć usb_modeswitch jak ktoś ma, bo domyślnie on próbuje go przestawić w product 1402, co kończy się brakiem cdrom.
Będąc w download można łatwo wejść do edl, wysyłając "edl sahara" ale brakuje firehose pod sdx62 więc nie za bardzo da się coś zrobić. Kombinowałem jak mu wymusić adb, jest skrypcik "enableadb" w paczce edl, ale on niestety nie działa, próbowałem też przez web, ale też lipa.
Macie może jakieś pomysły jak odpalić adb będąc w download mode?
Musze jeszcze poszukać gdzie jest uart na płycie, ale mam podejrzenie że jest na dolnej warstwie pod dużym heatsink, dobierał się ktoś może do uart w MC888?

MiG25 · 2024-07-03 09:00:40

MiG25
Użytkownik
Nieaktywny

Zarejestrowany: 2014-07-23
Posty: 3,815

Odp: MC888 Pro

MC888 to jest coś innego niż MC888Pro. W MC888 nie będzie IPQ5018 , i uarta pewnie też nie....

slqa · 2024-07-03 17:14:56

slqa
Użytkownik
Nieaktywny

Zarejestrowany: 2024-06-30
Posty: 2

Odp: MC888 Pro

Tak nie ma, rozebrałem go już wcześniej, że zobaczyć co on tam ma. Muszę się przyjrzeć bliżej samej płytce sdx.

szczypior · 2025-05-11 23:31:49

szczypior
Użytkownik
Nieaktywny

Zarejestrowany: 2023-02-05
Posty: 4

Odp: MC888 Pro

Cześć,

mam pytanie o model ZTE MC888A Ultra od operatora 3 AT. Chciałbym doprowadzić do odpalenia n41 na tym routerze i w tym celu chciałem sprawdzić stronę debug mode routera; niestety jednak, standardową metodą nie daje się otworzyć tej strony, co jest prawdopodobnie znanym objawem w nowych firmware. Czy posiada ktoś może sposób na uruchomienie strony z debug mode na nowych modelach ZTE?

Wgłębiam się w temat od paru godzin, wyczytałem, że prawdopodobnie istnieje nowy super-użytkownik tcadmin, który potencjalnie mógłby dostęp do tej strony umożliwić, ale niestety, nie widzę, jak się do niego dobrać Podobno istnieje możliwość odszyfrowania pliku backupu konfiguracji i wgranie nowego z podmienionym hasłem, ale i do tej operacji potrzebne jest z kolei hasło odszyfrowania backupu...

Mam też dostęp do QPST i interfejsu AT w routerze, ale nie mam pojęcia, jak mógłbym przy ich pomocy zbadać/podmienić konfigurację oferowanych bandów.

Co ciekawe, 3 AT oferuje co prawda 5G na 2600TDD, niestety jednak pod bandem 38, w przeciwieństwie do Plusa.

Czy miałby ktoś jakieś pomysły?

zember · 2025-09-06 10:57:48

zember
Użytkownik
Nieaktywny

Zarejestrowany: 2014-02-18
Posty: 5

Odp: MC888 Pro

Cześć, mam podobną sztukę na której sieci się dioda power na biało oraz dioda network. Działa interfejs diagnostyczny da się zrobić backup itd.. poszukuje firmware-u do MC888 PRO ktoś może posiada?

frutis · 2025-10-11 11:12:32

frutis
Użytkownik
Nieaktywny

Zarejestrowany: 2009-11-10
Posty: 1,710

Odp: MC888 Pro

@smereka Jako, że IPQ5018 jest już obsługiwane i można portować to czy na tym routerze da się odpalić niepodpisany firmware?

smereka · 2025-10-11 14:57:36

smereka
Użytkownik
Nieaktywny

Zarejestrowany: 2014-07-09
Posty: 2,465

Odp: MC888 Pro

Nie wiem.Ja chyba swoj z tego co pamietam ubilem calkowicie lutujac bodajze.Nie zagladalem do konetnerka z nim ponad rok chyba.Na pewno tam chyba modem sprawny jest no ale nie umiemy go na owrt odpalic.

redblue-pkt · 2026-08-13 20:17:51

redblue-pkt
Użytkownik
Nieaktywny

Zarejestrowany: 2026-08-13
Posty: 1

Odp: MC888 Pro

Panowie
Czy możecie stuknąc w jedno z usb1 lub usb2 polecenia at?

at+zcdrun=8
at+zcdrun=f

To u mnie dało:

[ 1181.692062] usb 3-13: new high-speed USB device number 10 using xhci_hcd
[ 1181.822900] usb 3-13: New USB device found, idVendor=19d2, idProduct=0016, bcdDevice=56.47
[ 1181.822912] usb 3-13: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1181.822916] usb 3-13: Product: ZTE Mobile Broadband
[ 1181.822943] usb 3-13: Manufacturer: ZTE,Incorporated
[ 1181.830724] option 3-13:1.0: GSM modem (1-port) converter detected
[ 1181.831140] usb 3-13: GSM modem (1-port) converter now attached to ttyUSB0
[ 1181.831553] option 3-13:1.1: GSM modem (1-port) converter detected
[ 1181.831720] usb 3-13: GSM modem (1-port) converter now attached to ttyUSB1
[ 1181.832030] option 3-13:1.2: GSM modem (1-port) converter detected
[ 1181.832228] usb 3-13: GSM modem (1-port) converter now attached to ttyUSB2
[ 1286.268992] usb 3-13: USB disconnect, device number 10
[ 1286.269460] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0
[ 1286.269524] option 3-13:1.0: device disconnected
[ 1286.270413] option1 ttyUSB1: GSM modem (1-port) converter now disconnected from ttyUSB1
[ 1286.270450] option 3-13:1.1: device disconnected
[ 1286.271024] option1 ttyUSB2: GSM modem (1-port) converter now disconnected from ttyUSB2
[ 1286.271081] option 3-13:1.2: device disconnected
[ 1315.954244] usb 3-13: new high-speed USB device number 11 using xhci_hcd
[ 1316.083695] usb 3-13: New USB device found, idVendor=19d2, idProduct=1432, bcdDevice=56.47
[ 1316.083706] usb 3-13: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1316.083710] usb 3-13: Product: ZTE Mobile Broadband
[ 1316.083713] usb 3-13: Manufacturer: ZTE,Incorporated
[ 1316.083715] usb 3-13: SerialNumber: ZM9000ZTED000000
[ 1316.110201] option 3-13:1.0: GSM modem (1-port) converter detected
[ 1316.110438] usb 3-13: GSM modem (1-port) converter now attached to ttyUSB0
[ 1316.110753] option 3-13:1.1: GSM modem (1-port) converter detected
[ 1316.110912] usb 3-13: GSM modem (1-port) converter now attached to ttyUSB1
[ 1316.111164] option 3-13:1.2: GSM modem (1-port) converter detected
[ 1316.111417] usb 3-13: GSM modem (1-port) converter now attached to ttyUSB2
[ 1316.113266] qmi_wwan 3-13:1.3: cdc-wdm0: USB WDM device
[ 1316.113766] qmi_wwan 3-13:1.3 wwan0: register 'qmi_wwan' at usb-0000:00:14.0-13, WWAN/QMI device, 5e:15:f9:d2:96:94

Bus 003 Device 011: ID 19d2:1432 ZTE WCDMA Technologies MSM ZTE Mobile Broadband
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x19d2 ZTE WCDMA Technologies MSM
idProduct 0x1432
bcdDevice 56.47
iManufacturer 1 ZTE,Incorporated
iProduct 2 ZTE Mobile Broadband
iSerial 3 ZM9000ZTED000000
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x00b7
bNumInterfaces 5
bConfigurationValue 1
iConfiguration 4
bmAttributes 0x80
(Bus Powered)
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 48
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 64
iInterface 0
** UNRECOGNIZED: 05 24 00 10 01
** UNRECOGNIZED: 05 24 01 00 00
** UNRECOGNIZED: 04 24 02 02
** UNRECOGNIZED: 05 24 06 00 00
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x000a 1x 10 bytes
bInterval 9
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 2
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 64
iInterface 0
** UNRECOGNIZED: 05 24 00 10 01
** UNRECOGNIZED: 05 24 01 00 00
** UNRECOGNIZED: 04 24 02 02
** UNRECOGNIZED: 05 24 06 00 00
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x85 EP 5 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x000a 1x 10 bytes
bInterval 9
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x84 EP 4 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x03 EP 3 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 3
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 80
iInterface 6 RmNet
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x86 EP 6 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0008 1x 8 bytes
bInterval 9
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x8e EP 14 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x0f EP 15 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 4
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 66
bInterfaceProtocol 1
iInterface 7 ADB Interface
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x04 EP 4 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x87 EP 7 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Binary Object Store Descriptor:
bLength 5
bDescriptorType 15
wTotalLength 0x002a
bNumDeviceCaps 3
USB 2.0 Extension Device Capability:
bLength 7
bDescriptorType 16
bDevCapabilityType 2
bmAttributes 0x0000010e
BESL Link Power Management (LPM) Supported
BESL value 256 us
SuperSpeed USB Device Capability:
bLength 10
bDescriptorType 16
bDevCapabilityType 3
bmAttributes 0x00
wSpeedsSupported 0x000f
Device can operate at Low Speed (1Mbps)
Device can operate at Full Speed (12Mbps)
Device can operate at High Speed (480Mbps)
Device can operate at SuperSpeed (5Gbps)
bFunctionalitySupport 1
Lowest fully-functional device speed is Full Speed (12Mbps)
bU1DevExitLat 0 micro seconds
bU2DevExitLat 0 micro seconds
SuperSpeedPlus USB Device Capability:
bLength 20
bDescriptorType 16
bDevCapabilityType 10
bmAttributes 0x00000001
Sublink Speed Attribute count 1
Sublink Speed ID count 0
wFunctionalitySupport 0x1100
bmSublinkSpeedAttr[0] 0x000a4030
Speed Attribute ID: 0 10Gb/s Symmetric RX SuperSpeedPlus
bmSublinkSpeedAttr[1] 0x000a40b0
Speed Attribute ID: 0 10Gb/s Symmetric TX SuperSpeedPlus
Device Status: 0x0000
(Bus Powered)

at+zcdrun=8
at+zcdrun=e
daje 0016
at+zcdrun=8
at+zcdrun=f
daje 1432
at+zcdrun=9
at+zcdrun=e
daje 0016
at+zcdrun=9
at+zcdrun=f
daje 2004

Jednak na polecenie te odpowiada nie tak jak chcemy:

root@redblue-dell:~# sudo qmicli -d /dev/cdc-wdm0 --device-open-proxy --dms-get-model
error: couldn't create client for the 'dms' service: CID allocation failed in the CTL client: Transaction timed out

root@redblue-dell:~# adb devices
* daemon not running; starting now at tcp:5037
* daemon started successfully
List of devices attached
ZM9000ZTED000000 device
root@redblue-dell:~# adb shell
/ # ls
WEBSERVER data home overlay sdcard tmp
bin dev lib persist sys usr
boot etc logfs proc system var
build.prop etc_rw media run systemrw
cache firmware mnt sbin target
/ #

strings -a -n 5 /usr/bin/zte_topsw_atfwd |
> grep -oE 'AT\+[A-Za-z0-9_]+' |
> sort -u
AT+CBC
AT+CCLK
AT+QADC
AT+QPOWD
AT+QSCLK
AT+RESET
AT+ZADBPSWD
AT+ZIMSR
AT+ZIMSREGSTATUS
AT+ZLEDMSG
AT+ZLOCATE
AT+ZLOCKCELL
AT+ZNLOCKNRBAND
AT+ZRESET
AT+ZRTEMP
AT+ZRVOIPREGSTATUS
AT+ZSOFTRESET
AT+ZSUBT
AT+ZSYSTIME
AT+ZVOICECONNSTATE
AT+ZVOICEWORKTYPE

strings -a -n 4 -t x /firmware/image/modem.b20 |
> grep -i -B30 -A60 'ZCDRUN'
1bcfe2 task id , taskname , current used memory , max used memory
1bd01e %u,%s ,%uKB ,%uKB
1bd030 ============Task wise modem internal heap allocation details ============
1bd07b task id ,taskname current used memory , max used memory
1bd0b5 ============Task wise amss heap allocation details ============
1bd0f7 ============DSM Memory Stats ============
1bd126 ==Super large pool stats ==
1bd143 alloc cnt --> %u ,free cnt --> %u , max alloc --> %u ,alloc_fail -->%u
1bd18e memory level--> %u , threshold --> %u ,cb_count --> %u
1bd1c5 ==Large pool stats ==
1bd1dc alloc cnt --> %u, free cnt --> %u , max alloc --> %u ,alloc_fail --> %u
1bd224 ==Small pool stats ==
1bd23b alloc cnt --> %u ,free cnt --> %u ,max alloc -->%u ,alloc_fail --> %u
1bd281 ==Dup pool stats ==
1bd296 alloc cnt --> %u , free cnt --> %u, max alloc --> %u, alloc_fail --> %u
1bd2de Failed to register CLADE2 bak error callback
1bd3d4 NODOWNLOAD.FLG
1bd3e3 AUTORUN.FLG
1bd3ef CPE.FLG
1bd3f7 exit cpe mode result(0:FAIL 1:SUCCESS):%d
1bd421 Enter cpe mode result(0:FAIL 1:SUCCESS):%d
1bd44c Inquiry cpe mode result(0:NO 1:YES):%d
1bd473 +ZCPE,OK
1bd47c exit download mode result(0:FAIL 1:SUCCESS):%d
1bd4ab Enter download mode result(0:FAIL 1:SUCCESS):%d
1bd4db Inquiry download mode result (while CFG is valid)(0:NO 1:YES):%d
1bd51c Inquiry download mode result (while CFG is invalid)(0:NO 1:YES):%d
1bd55f Inquiry autorun open state result(0:NO 1:YES):%d
1bd590 Close autorun state result(0:FAIL 1:SUCCESS):%d
1bd5c0 Open autorun state result(0:FAIL 1:SUCCESS):%d
1bd5ef +ZCDRUN,OK
1bd5fa +ZPCB
1bd600 %s: %d,%d
1bd60a +ZPINPUK
1bd613 invalid setting value
1bd629 %s: %d
1bd630 +ZCSPS
1bd637 Not support +ZCSPS cmd
1bd64e +ZNVR
1bd654 %s %d
1bd65a +CME ERROR:
1bd666 %s,%s,%s,%s
1bd672 +ZLEDCTRL: %s
1bd680 (0,1)
1bd686 +ZSMSD
1bd68d %s [%s %s]
1bd698 [AT ref%u PKT ref%u]
1bd6ae +ZDOGREF:disabled
1bd6c0 +ZDOGREF:enabled
1bd6d1 +ZDOGREF
1bd6da +ZDOGREF: fake_reset
1bd6f0 +ZSPD
1bd6f6 6 8 12
1bd6fd %d,%s%s;
1bd709 %d,%s;
1bd711 %d,%s;
1bd718 +ZRSPSET
1bd721 +ZUSIM
1bd728 +CQIUPD
1bd733 "ROAM_ON"
1bd73d "ROAM_OFF"
1bd748 +ZDON
1bd74e ZTE_cm_ph_event_in_use() failed, use AT+cpin? to check
1bd786 invalid setting arguments number!
1bd7a8 +ZSNT: Invalid setting value 1st argument
1bd7d2 invalid setting value 2nd argument
1bd7f5 Invalid param for +ZSNT :mode pref=%d
1bd81b %s: %d,%d,%d
1bd828 +ZSNT reading nv failed
1bd840 +ZSNT
1bd846 +ZSNT:(0-7,11-15),(0-2),(0-2)
1bd864 only one arguments allowed!
1bd881 invalid value
1bd891 +ZDSNT Putting nv failed
1bd8aa NV10's value incompatible with +ZDSNT parameters
1bd8db +ZDSNT getting nv failed
1bd8f4 +ZDSNT
1bd8fb +ZDSNT:0-3 for auto(GWL), GSM only, WCDMA only, LTE only
1bd934 Unknown Band
1bd941 %s: %d, %lu, %s
1bd951 +ZCELLINFO
1bd95c %dMHz
1bd962 %s: LTE:%lu, %d, %s, %d; nr5g:%d,%d,%u,%s
1bd98c %s: LTE:%lu, %d, %s, %d; nr5g:%d,N%d,%u,%s
1bd9b7 %s: nr5g_sa:%llu, %d, N%d, %d, %dMhz
1bd9dc %s:%s
1bd9e2 LTE:Global Cell ID,Physical Cell ID,Cell Band,DL Earfcn
1bda1a WCDMA:LAC,Cell ID,Cell Band
1bda36 GSM:LAC,Cell ID,Cell Band
1bda50 %.1f, %.1f,%.1f,%.1f,%d,%d;
1bda6c +ZLTECASIGINFO
--
1be869 +ZCFGINDPORT: %d
1be87b +ZCFGINDPORT: 0-1
1be88e ZVMAIL
1be895 %s:(%s)(%s)
1be8a1 +ZPINC
1be8a8 "SC"
1be8ad "P2"
1be8b2 %s:%s,%d,%d
1be8c0 %s:%s,%d,%d
1be8cc %s:(%s)
1be8d4 +ZINISTAT
1be8e2 +ZSIMDET
1be8eb (0,1)(0,1)
1be8f6 %s:%d,%d
1be8ff +ZSIMSTAT
1be909 +ZSCHLEL
1be912 +ZDSSCONFIG?:"%d"
1be928 %s: "%s",%s,%s,"%s",%s,%s,%s
1be948 %s: %s,%s,%s,"%s",%s,%s,%s
1be968 /nv/item_files/modem/lte/rrc/PC2_WHITELIST.xml
1be998 /nv/item_files/modem/lte/rrc/BAKWHITE.xml
1be9c8 /nv/item_files/modem/zte_usim
1bea48 zte_dsatsec.c
1bea56 +ZSECR
1bea5d +ZSEC
1bea63 +ZNCK
1bea69 F0AA
1bea6e %s:
1bea73 +ZLKLIST
1beacc +ZTFTEST
1bead5 +ZCDRUN
1beadd +ZCPE
1beae3 +ZUDISKW
1beaec +ZVN
1beaf1 +ZRST
1beaf7 +ZECC
1beafd +ZLACELLID
1beb08 +ZDFLOW
1beb10 +ZLEDCTRL
1beb1a +ZSTM
1beb20 +ZSELI
1beb27 +ZSELM
1beb2e +ZBK
1beb33 +ZINPR
1beb3a +ZINKR
1beb41 +ZDISTR
1beb49 +ZCPBW
1beb50 +ZCPBR
1beb57 +ZDSSCONFIG
1beb63 +ZLOCKBAND
1beb6e +ZNLOCKBAND
1beb7a +ZNLOCKLTEBAND
1beb89 +ZBANDI
1beb91 +ZDLFREQ
1beb9a +ZSBUDB
1beba2 +ZSBSAPN
1bebab +ZCNI
1bebb1 +ZRESTORE
1bebbb +ZCFGT
1bebc2 +ZSTART
1bebca +ZCQIUPD
1bebd3 +ZSSFLG
1bebdb +ZSSDES
1bebe3 +ZSSINF
1bebeb +ZSSCRC
1bebf3 +ZSSDIP
1bebfb +ZWINS
1bec02 +ZCIN
1bec08 +ZGINIT
1bec10 +ZGRUN
1bec17 +ZGMODE
1bec1f +ZGQOS
1bec26 +ZGFIXRATE
1bec31 +ZGIP
1bec37 +ZGURL
1bec3e +ZGCP
1bec44 +ZGTIME
1bec4c +ZGMEASURE
1bec57 +ZGPSR
1bec5e +ZGPSEVENT
1bec69 +ZGPSAPN
1bec72 +ZGRST
1bec79 +ZGPSCFG
1bec82 +ZGPSDEL
1bec8b +ZGPSSTART
1bec96 +ZGPSEND
1bec9f +ZBANDCUR
1beca9 +ZDBGUSB
1becb2 +ZUPDATE
1becbb +ZNVUPDATE
1becc6 +ZEFSBAK
/usr/bin #

Teraz ktoś musi przedzwonić te wszystkie komendy

Lekarstwo na przypadłości:
Używasz na własna odpowiedzialność, nie odpowiadam za szkody.

#!/bin/sh
#
# ZTE MC888 Pro QTI USB/MHI datapath patch installer
#
# Author: Redblue
#
# This installer:
#   1. Verifies the known stock /usr/bin/qti binary.
#   2. Copies it to /data/qti-patched.
#   3. Applies the tested USB/MHI datapath selector patch.
#   4. Installs a persistent boot helper in /etc_rw/qti-patch/boot.sh.
#   5. Hooks that helper into the persistent backing copy of
#      /etc/data/sw_ip_channel_setup_script.sh located under /systemrw.
#   6. Creates /run/systemd/system/qtid.service at boot so systemd starts
#      /data/qti-patched instead of /usr/bin/qti.
#
# The vendor files /usr/bin/qti and /lib/systemd/system/qtid.service are
# NEVER modified.
#
# ---------------------------------------------------------------------------
# Why the QTI binary needs patching
# ---------------------------------------------------------------------------
#
# On the affected MC888 Pro firmware, QTI sees MHI channels connected very
# early. Stock QTI can therefore select MHI/PCIe before the USB RMNET path.
#
# That causes DPM to open the MHI/PCIe data endpoint even when QMI is being
# used from the USB host side.
#
# Working USB mode is visible in QTI logs as:
#
#     USB enable:1 MHI enable:0
#     Peripheral type 2
#
# The patch replaces the unconditional MHI-enable instruction at 0xBED6 with
# a call to a small Thumb helper injected at 0x1F580.
#
# The helper uses FRMNET_CTRL_GET_LINE_STATE on the USB RMNET control fd:
#
#     USB line_state == 1:
#         USB.ph_enabled = 1
#         MHI.ph_enabled = 0
#
#     otherwise:
#         USB.ph_enabled = 0
#         MHI.ph_enabled = 1
#
# Result:
#
#     USB active     -> USB / HSUSB datapath
#     USB not active -> MHI / PCIe fallback
#
# ---------------------------------------------------------------------------
# Persistent boot hook
# ---------------------------------------------------------------------------
#
# QCMAP executes:
#
#     /etc/data/sw_ip_channel_setup_script.sh
#
# The persistent backing file lives under /systemrw. This installer locates
# the backing copy by comparing the known /systemrw candidates with the live
# /etc/data script.
#
# The following block is inserted immediately before INTERFACE_PATH=:
#
#     # BEGIN MC888 QTI PATCH
#     /etc_rw/qti-patch/boot.sh &
#     # END MC888 QTI PATCH
#
# The helper is deliberately launched in the background so normal interface
# setup is not blocked.
#
# At boot the helper creates:
#
#     /run/systemd/system/qtid.service
#
# by copying the vendor unit and changing only:
#
#     ExecStart=/usr/bin/qti
#
# to:
#
#     ExecStart=/data/qti-patched
#
# /run is volatile, therefore this runtime unit is recreated on every boot.
#
# Tested stock QTI SHA256:
#   c92c649d695e0a177f7aafb2faeaf9fc66b96e2f7befe6edb466d0b73848e2b5
#
# Expected patched QTI SHA256:
#   72f12d340c2d97ed20f9c6c837ba39d894a6700fb171abc8451a2b57971faae5
#

set -eu

SRC=/usr/bin/qti
DST=/data/qti-patched

LIVE_HOOK=/etc/data/sw_ip_channel_setup_script.sh
PATCH_DIR=/etc_rw/qti-patch
BOOT_HELPER="$PATCH_DIR/boot.sh"
HOOK_BACKUP="$PATCH_DIR/sw_ip_channel_setup_script.sh.before-qti-patch"

UNIT_SRC=/lib/systemd/system/qtid.service
UNIT_RUNTIME=/run/systemd/system/qtid.service

STOCK_SHA="c92c649d695e0a177f7aafb2faeaf9fc66b96e2f7befe6edb466d0b73848e2b5"
PATCH_SHA="72f12d340c2d97ed20f9c6c837ba39d894a6700fb171abc8451a2b57971faae5"

echo "============================================================"
echo " MC888 QTI USB/MHI datapath patch"
echo " Author: Redblue"
echo "============================================================"

# ---------------------------------------------------------------------------
# Locate the persistent /systemrw backing file for the live QCMAP script.
# ---------------------------------------------------------------------------

[ -f "$LIVE_HOOK" ] || {
    echo "[ERROR] Missing live QCMAP hook script: $LIVE_HOOK"
    exit 1
}

PERSIST_HOOK=""

for CANDIDATE in \
    /systemrw/data/sw_ip_channel_setup_script.sh \
    /systemrw/etc/data/sw_ip_channel_setup_script.sh
do
    [ -f "$CANDIDATE" ] || continue

    # Prefer a candidate whose current content is identical to the live script.
    if cmp -s "$CANDIDATE" "$LIVE_HOOK"; then
        PERSIST_HOOK="$CANDIDATE"
        break
    fi
done

# If the live script already contains our hook, its content may differ only
# because the persistent copy was patched earlier. In that case accept the
# known /systemrw path if it exists.
if [ -z "$PERSIST_HOOK" ]; then
    for CANDIDATE in \
        /systemrw/data/sw_ip_channel_setup_script.sh \
        /systemrw/etc/data/sw_ip_channel_setup_script.sh
    do
        if [ -f "$CANDIDATE" ]; then
            PERSIST_HOOK="$CANDIDATE"
            break
        fi
    done
fi

[ -n "$PERSIST_HOOK" ] || {
    echo "[ERROR] Could not locate persistent sw_ip_channel_setup_script.sh under /systemrw."
    exit 1
}

echo "[*] Live QCMAP script:       $LIVE_HOOK"
echo "[*] Persistent backing file: $PERSIST_HOOK"

# ---------------------------------------------------------------------------
# Stop QTI and clean only previous QTI-patch runtime/test integration.
# ---------------------------------------------------------------------------

echo "[*] Stopping currently running QTI..."
systemctl stop qtid.service 2>/dev/null || true
killall qti 2>/dev/null || true
killall qti-patched 2>/dev/null || true
sleep 1

echo "[*] Removing obsolete runtime overrides..."
rm -rf /run/systemd/system/qtid.service.d
rm -f "$UNIT_RUNTIME"

echo "[*] Removing obsolete /data boot-hook experiments..."
rm -f /data/qti-patch-boot.sh

# Remove /data/start.sh only if it is one of the QTI hook files created by the
# previous experimental installer. Do not delete an unrelated user script.
if [ -f /data/start.sh ] && \
   grep -qE 'qti-patch-boot\.sh|MC888 QTI USB/MHI datapath patch boot hook' \
       /data/start.sh 2>/dev/null
then
    echo "    removing obsolete QTI /data/start.sh"
    rm -f /data/start.sh
fi

# ---------------------------------------------------------------------------
# Build /data/qti-patched from the untouched vendor binary.
# ---------------------------------------------------------------------------

echo "[*] Rebuilding patched QTI from clean vendor binary..."

[ -f "$SRC" ] || {
    echo "[ERROR] Missing $SRC"
    exit 1
}

rm -f "$DST"
cp "$SRC" "$DST"
chmod 755 "$DST"

SHA="$(sha256sum "$DST" | awk '{print $1}')"
echo "    stock SHA256: $SHA"

if [ "$SHA" != "$STOCK_SHA" ]; then
    echo "[ERROR] Unsupported /usr/bin/qti binary."
    echo "        Expected: $STOCK_SHA"
    echo "        Found:    $SHA"
    rm -f "$DST"
    exit 1
fi

echo "[*] Verifying original instruction at 0xBED6..."
ORIG="$(od -An -tx1 -j $((0xBED6)) -N4 "$DST" | tr -d ' \n')"
echo "    0xBED6: $ORIG"

if [ "$ORIG" != "81f8d460" ]; then
    echo "[ERROR] Unexpected bytes at 0xBED6; refusing to patch."
    rm -f "$DST"
    exit 1
fi

echo "[*] Verifying executable ELF LOAD segment..."
HDR="$(od -An -tx1 -j $((0xA4)) -N8 "$DST" | tr -d ' \n')"
echo "    ELF bytes @0xA4: $HDR"

if [ "$HDR" != "7cf501007cf50100" ]; then
    echo "[ERROR] Unexpected ELF LOAD header; refusing to patch."
    rm -f "$DST"
    exit 1
fi

echo "[*] Extending executable LOAD segment for injected helper..."
#
# ELF program header:
#     p_filesz: 0x0001f57c -> 0x0001f5d4
#     p_memsz : 0x0001f57c -> 0x0001f5d4
#
printf '\324\365\001\000' \
    | dd of="$DST" bs=1 seek=$((0xA4)) conv=notrunc 2>/dev/null

printf '\324\365\001\000' \
    | dd of="$DST" bs=1 seek=$((0xA8)) conv=notrunc 2>/dev/null

echo "[*] Injecting USB/MHI selector helper at 0x1F580..."
#
# Thumb helper:
#     ioctl(USB_fd, FRMNET_CTRL_GET_LINE_STATE, &line_state)
#
#     line_state == 1 -> USB=1, MHI=0
#     otherwise       -> USB=0, MHI=1
#
printf '\037\265\357\363\000\203\010\264\203\260\315\370\004\300\014\106\040\150\107\362\002\041\310\362\004\001\152\106\345\367\200\353\000\050\011\321\000\230\001\050\006\321\000\040\204\370\324\000\001\040\204\370\150\000\005\340\000\040\204\370\150\000\001\040\204\370\324\000\335\370\004\300\003\260\010\274\203\363\000\210\037\275' \
    | dd of="$DST" bs=1 seek=$((0x1F580)) conv=notrunc 2>/dev/null

echo "[*] Replacing unconditional MHI enable at 0xBED6..."
#
# Stock:
#     strb.w r6,[r1,#0xd4]       ; MHI.ph_enabled = 1
#
# Patched:
#     bl 0x1f580                 ; select USB or MHI
#
printf '\023\360\123\373' \
    | dd of="$DST" bs=1 seek=$((0xBED6)) conv=notrunc 2>/dev/null

chmod 755 "$DST"
sync

SHA="$(sha256sum "$DST" | awk '{print $1}')"
echo "    patched SHA256: $SHA"

if [ "$SHA" != "$PATCH_SHA" ]; then
    echo "[ERROR] Patched binary SHA256 mismatch."
    rm -f "$DST"
    exit 1
fi

# ---------------------------------------------------------------------------
# Install the persistent boot helper.
# ---------------------------------------------------------------------------

echo "[*] Installing persistent boot helper in $PATCH_DIR..."
mkdir -p "$PATCH_DIR"

cat >"$BOOT_HELPER" <<'BOOTEOF'
#!/bin/sh
#
# MC888 QTI runtime systemd setup
# Installed by QTI USB/MHI patch installer.
#
# This script may be called more than once because QCMAP may execute
# sw_ip_channel_setup_script.sh multiple times. It is therefore idempotent.
#

set -eu

PATCHED=/data/qti-patched
UNIT_SRC=/lib/systemd/system/qtid.service
UNIT_RUNTIME=/run/systemd/system/qtid.service

PATCH_SHA="72f12d340c2d97ed20f9c6c837ba39d894a6700fb171abc8451a2b57971faae5"

LOCK=/run/mc888-qti-patch.lock

# Avoid concurrent invocations from multiple QCMAP interface setup calls.
if ! mkdir "$LOCK" 2>/dev/null; then
    exit 0
fi

trap 'rmdir "$LOCK" 2>/dev/null || true' EXIT INT TERM

[ -x "$PATCHED" ] || {
    echo "[qti-patch] Missing $PATCHED"
    exit 1
}

SHA="$(sha256sum "$PATCHED" | awk '{print $1}')"
[ "$SHA" = "$PATCH_SHA" ] || {
    echo "[qti-patch] Bad patched QTI SHA256: $SHA"
    exit 1
}

[ -f "$UNIT_SRC" ] || {
    echo "[qti-patch] Missing $UNIT_SRC"
    exit 1
}

NEED_UNIT=1

if [ -f "$UNIT_RUNTIME" ] && \
   grep -q '^ExecStart=/data/qti-patched$' "$UNIT_RUNTIME" 2>/dev/null
then
    NEED_UNIT=0
fi

if [ "$NEED_UNIT" -eq 1 ]; then
    rm -rf /run/systemd/system/qtid.service.d
    mkdir -p /run/systemd/system

    awk '
        /^ExecStart=\/usr\/bin\/qti$/ {
            print "ExecStart=/data/qti-patched"
            next
        }
        { print }
    ' "$UNIT_SRC" > "${UNIT_RUNTIME}.tmp"

    grep -q '^ExecStart=/data/qti-patched$' "${UNIT_RUNTIME}.tmp" || {
        rm -f "${UNIT_RUNTIME}.tmp"
        echo "[qti-patch] Failed to replace qtid ExecStart"
        exit 1
    }

    chmod 644 "${UNIT_RUNTIME}.tmp"
    mv "${UNIT_RUNTIME}.tmp" "$UNIT_RUNTIME"

    systemctl daemon-reload
fi

#
# During normal boot this hook normally runs from QCMAP before qtid.service
# starts, because qtid.service is ordered After=QCMAP_ConnectionManagerd.
# In that case we only install the runtime unit and let systemd start qtid
# normally.
#
# If qtid is already running (for example when installing/testing on a live
# router), restart it only if it is not already running /data/qti-patched.
#
if systemctl is-active --quiet qtid.service 2>/dev/null; then
    PID="$(systemctl show qtid.service -p MainPID 2>/dev/null | sed 's/^MainPID=//')"

    EXE=""
    if [ -n "$PID" ] && [ "$PID" != "0" ]; then
        EXE="$(readlink "/proc/$PID/exe" 2>/dev/null || true)"
    fi

    if [ "$EXE" != "/data/qti-patched" ]; then
        systemctl restart qtid.service
    fi
fi

exit 0
BOOTEOF

chmod 755 "$BOOT_HELPER"

# ---------------------------------------------------------------------------
# Patch the persistent QCMAP sw_ip_channel_setup_script.sh.
# ---------------------------------------------------------------------------

echo "[*] Installing QCMAP boot hook..."

MODE="$(stat -c '%a' "$PERSIST_HOOK" 2>/dev/null || echo 755)"
OWNER="$(stat -c '%u:%g' "$PERSIST_HOOK" 2>/dev/null || echo 0:0)"

CLEAN_TMP=/tmp/sw_ip_channel_setup_script.clean.$$
PATCH_TMP=/tmp/sw_ip_channel_setup_script.qti.$$

#
# First build a CLEAN copy by removing any previous copy of our marked block
# and the exact old unmarked helper invocation. This clean copy is what gets
# saved as the rollback backup on the first install.
#
awk '
    /^# BEGIN MC888 QTI PATCH$/ { skip=1; next }
    /^# END MC888 QTI PATCH$/   { skip=0; next }

    skip { next }

    /^[[:space:]]*\/etc_rw\/qti-patch\/boot\.sh[[:space:]]*&[[:space:]]*$/ {
        next
    }

    { print }
' "$PERSIST_HOOK" > "$CLEAN_TMP" || {
    rm -f "$CLEAN_TMP" "$PATCH_TMP"
    echo "[ERROR] Failed to build clean QCMAP script."
    exit 1
}

#
# Save the clean original only once. Existing rollback backups are preserved.
#
if [ ! -f "$HOOK_BACKUP" ]; then
    echo "    saving clean original: $HOOK_BACKUP"
    cp "$CLEAN_TMP" "$HOOK_BACKUP"
    chmod "$MODE" "$HOOK_BACKUP" 2>/dev/null || true
    chown "$OWNER" "$HOOK_BACKUP" 2>/dev/null || true
fi

#
# Now insert the persistent boot hook immediately before INTERFACE_PATH=.
#
awk '
    {
        if (!inserted && $0 ~ /^INTERFACE_PATH=/) {
            print "# BEGIN MC888 QTI PATCH"
            print "/etc_rw/qti-patch/boot.sh &"
            print "# END MC888 QTI PATCH"
            print ""
            inserted=1
        }

        print
    }

    END {
        if (!inserted)
            exit 42
    }
' "$CLEAN_TMP" > "$PATCH_TMP" || {
    RC=$?
    rm -f "$CLEAN_TMP" "$PATCH_TMP"

    if [ "$RC" -eq 42 ]; then
        echo "[ERROR] Could not find INTERFACE_PATH= in $PERSIST_HOOK"
    else
        echo "[ERROR] Failed to build patched QCMAP script."
    fi

    exit 1
}

#
# Write IN PLACE instead of mv/rename. This preserves the inode, which matters
# when /etc/data exposes the persistent /systemrw file through a bind mount.
#
cat "$PATCH_TMP" > "$PERSIST_HOOK"
rm -f "$CLEAN_TMP" "$PATCH_TMP"

chmod "$MODE" "$PERSIST_HOOK" 2>/dev/null || true
chown "$OWNER" "$PERSIST_HOOK" 2>/dev/null || true
sync

echo "[*] Verifying persistent hook..."
grep -A4 -B2 'BEGIN MC888 QTI PATCH' "$PERSIST_HOOK" || {
    echo "[ERROR] Hook was not written to $PERSIST_HOOK"
    exit 1
}

echo "[*] Verifying live /etc/data view..."

if grep -q '^/etc_rw/qti-patch/boot.sh &$' "$LIVE_HOOK" 2>/dev/null; then
    echo "    live view already sees the persistent hook"
else
    echo "    live view does not yet show the changed backing file"
    echo "    (this can happen if the firmware exposes it through a boot-time bind)"
    echo "    persistent /systemrw file is patched and will be used after reboot"
fi

# ---------------------------------------------------------------------------
# Activate the runtime unit and patched QTI now for immediate testing.
# ---------------------------------------------------------------------------

echo "[*] Creating runtime qtid.service now..."
"$BOOT_HELPER"

#
# The router is fully booted while the installer is being run, so explicitly
# start/restart qtid now. During an actual boot boot.sh does not force an early
# start if qtid is still inactive.
#
systemctl restart qtid.service
sleep 2

echo
echo "==================== EFFECTIVE QTID UNIT ===================="
systemctl cat qtid.service

echo
echo "==================== SYSTEMD DETAILS ========================"
systemctl show qtid.service -p FragmentPath -p MainPID -p ExecStart

echo
echo "==================== RUNNING EXECUTABLE ====================="
PID="$(systemctl show qtid.service -p MainPID 2>/dev/null | sed 's/^MainPID=//')"

if [ -n "$PID" ] && [ "$PID" != "0" ]; then
    echo "PID: $PID"
    printf "exe: "
    readlink "/proc/$PID/exe" 2>/dev/null || true
else
    echo "No qtid MainPID found."
fi

echo
echo "==================== PERSISTENT HOOK ========================"
echo "$PERSIST_HOOK"
grep -A4 -B2 'BEGIN MC888 QTI PATCH' "$PERSIST_HOOK" || true

echo
echo "============================================================"
echo "[OK] Installation complete."
echo
echo "Patched QTI:"
echo "  $DST"
echo
echo "Persistent QCMAP hook:"
echo "  $PERSIST_HOOK"
echo
echo "Original QCMAP script backup:"
echo "  $HOOK_BACKUP"
echo
echo "Boot helper:"
echo "  $BOOT_HELPER"
echo
echo "Runtime systemd unit:"
echo "  $UNIT_RUNTIME"
echo
echo "Expected:"
echo "  FragmentPath=/run/systemd/system/qtid.service"
echo "  ExecStart contains /data/qti-patched"
echo "  /proc/MainPID/exe -> /data/qti-patched"
echo "============================================================"

Działa co ma działać:

root@redblue-dell:~# qmicli -d /dev/cdc-wdm0 --dms-get-revision
[/dev/cdc-wdm0] Device revision retrieved:
Revision: 'MPSS.DE.2.0-01044-OLYMPIC_GENALL_PACK-1.97602.2.98856.7 1 [Aug 17 2025 23:55:40]'
root@redblue-dell:~# qmicli -d /dev/cdc-wdm0 --dms-get-revision
[/dev/cdc-wdm0] Device revision retrieved:
Revision: 'MPSS.DE.2.0-01044-OLYMPIC_GENALL_PACK-1.97602.2.98856.7 1 [Aug 17 2025 23:55:40]'
root@redblue-dell:~# qmicli -d /dev/cdc-wdm0 --dms-get-operating-mode
[/dev/cdc-wdm0] Operating mode retrieved:
Mode: 'low-power'
HW restricted: 'no'
root@redblue-dell:~# qmicli -d /dev/cdc-wdm0 --dms-get-ids
[/dev/cdc-wdm0] Device IDs retrieved:
   ESN: '0'
   IMEI: '8658110XXXXXXXX'
   MEID: 'unknown'
IMEI SV: '13'
root@redblue-dell:~# qmicli -d /dev/cdc-wdm0 --dms-get-manufacturer
[/dev/cdc-wdm0] Device manufacturer retrieved:
Manufacturer: 'QUALCOMM INCORPORATED'
root@redblue-dell:~# qmicli -d /dev/cdc-wdm0 --dms-get-model
[/dev/cdc-wdm0] Device model retrieved:
Model: '0'
root@redblue-dell:~# qmicli -d /dev/cdc-wdm0 --wda-get-data-format
[/dev/cdc-wdm0] Successfully got data format
QoS flow header: no
Link layer protocol: 'raw-ip'
Uplink data aggregation protocol: 'disabled'
Downlink data aggregation protocol: 'disabled'
NDP signature: '0'
Downlink data aggregation max datagrams: '0'
Downlink data aggregation max size: '0'

I internet też

FAQ o OpenWrt | Sprzedam różne routery | Oddam

MC888 Pro (Strona 3 z 3)

Posty: 51 do 58 z 58

51 Odpowiedź przez slqa 2024-07-03 07:27:13

Odp: MC888 Pro

52 Odpowiedź przez MiG25 2024-07-03 09:00:40

Odp: MC888 Pro

53 Odpowiedź przez slqa 2024-07-03 17:14:56

Odp: MC888 Pro

54 Odpowiedź przez szczypior 2025-05-11 23:31:49

Odp: MC888 Pro

55 Odpowiedź przez zember 2025-09-06 10:57:48

Odp: MC888 Pro

56 Odpowiedź przez frutis 2025-10-11 11:12:32 (edytowany przez frutis 2025-10-11 11:12:48)

Odp: MC888 Pro

57 Odpowiedź przez smereka 2025-10-11 14:57:36 (edytowany przez smereka 2025-10-11 14:59:18)

Odp: MC888 Pro

58 Odpowiedź przez redblue-pkt 2026-08-13 20:17:51 (edytowany przez redblue-pkt 2026-08-14 23:25:14)

Odp: MC888 Pro

Posty: 51 do 58 z 58