openwrt и JTAG

9 Август, 2017

здравейте опитвам се да флаш на едно рутер че с опенврт но за целта трябва да ми флаш на CFE-то но удрям на дъска някой да каже къде бъркам изписва ми това

			/fc:81 ............. Spansion S29GL032MR3 TopB  (4MB)
            /fc:82 ............. Spansion S29GL064MR4 BotB  (8MB)
            /fc:83 ............. Spansion S29GL064MR3 TopB  (8MB)
            /fc:84 ............. Spansion S29GL032MR1/2 Uni (4MB)
            /fc:85 ............. Spansion S29GL064MR6/7 Uni (8MB)
            /fc:86 ............. Spansion S29GL064MR1/2 Uni (8MB)
            /fc:87 ............. Spansion S29GL128M Uni    (16MB)
            /fc:88 ............. Spansion S29GL128N/P Uni  (16MB)
            /fc:89 ............. ST M29W640GB BotB          (8MB)
            /fc:90 ............. ST M29W640GT TopB          (8MB)
            /fc:91 ............. ST M29W640GL Uni           (8MB)
            /fc:92 ............. ST M29W640GH Uni           (8MB)
            /fc:93 ............. ST M29W128GL Uni          (16MB)
            /fc:94 ............. ST M29W128GH Uni          (16MB)
            /fc:95 ............. EON EN29LV320BB 2Mx16 BotB (4MB)
            /fc:96 ............. EON EN29LV320BT 2Mx16 TopB (4MB)
            /fc:97 ............. EON EN29LV640B  4Mx16 BotB (8MB)
            /fc:98 ............. EON EN29LV640T  4Mx16 TopB (8MB)
            /fc:99 ............. EON EN29LV640H/L Uni       (8MB)
            /fc:100 ............. EON EN29GL064B BotB        (8MB)
            /fc:101 ............. EON EN29GL064T TopB        (8MB)
            /fc:102 ............. EON EN29GL064H/L Uni       (8MB)
            /fc:103 ............. EON EN29GL128 Uni         (16MB)
            /fc:104 ............. MX29GL320EB/LV320MB BotB   (4MB)
            /fc:105 ............. MX29GL320ET/LV320MT TopB   (4MB)
            /fc:106 ............. MX29GL320EH/L Uni          (4MB)
            /fc:107 ............. MX29LV640EB/DB  BotB       (8MB)
            /fc:108 ............. MX29LV640ET/DT  TopB       (8MB)
            /fc:109 ............. MX29GL640EB/LV640MB  BotB  (8MB)
            /fc:110 ............. MX29GL640ET/LV640MT  TopB  (8MB)
            /fc:111 ............. MX29GL640EH/L Uni          (8MB)
            /fc:112 ............. MX29GL128E Uni            (16MB)
            /fc:113 ............. MX29LV128DB  8Mx16 BotB   (16MB)
            /fc:114 ............. MX29LV128DT  8Mx16 TopB   (16MB)


 NOTES: 1) 'backup:', 'flash:' and 'erase:' - the source filename must exist as
           follows: CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or CUSTOM.BIN

           BSP.BIN, TFE.BIN

        2) If you have difficulty auto-detecting a particular flash part
           you can manually specify your exact part using the /fc:XX option.

        3) If you have difficulty with the older bcm47xx chips or when no CFE
           is currently active/operational you may want to try both the
           /noreset and /nobreak command line options together.  Some bcm47xx
           chips *may* always require both these options to function properly.

        4) When using this utility, usually it is best to type the command line
           out, then plug in the router, and then hit <ENTER> quickly to avoid
           the CPUs watchdog interfering with the EJTAG operations.

        5) /bypass - enables Unlock bypass command for some AMD/Spansion type
           flashes, it also disables polling

        6) /initcpu allow load some code to initialize the CPU. This may help
           BCM6358 open all MPI address access.

        7) '-probeonly /window:xxxxxxxx /erasechip' allow choose a workable
           sector address to erase whole chip. This may help on a bricked box
           with bad CFE

        8) /forcealign - enable erase sectors if the operation window is not
           aligned with sector boundary. It's risky! but can help erase some
           box NVRAM area whose sector size is large than NVRAM definition

        9) /ejtag0 - enable 20ns delay behind each jtag shift cycle. This wish
           to increase LPT port compatiability for some high clcok PC

 ***************************************************************************
 * Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *
 * via this utility.  You are better off flashing the CFE & NVRAM files    *
 * & then using the normal TFTP method to flash the KERNEL via ethernet.   *
 ***************************************************************************

C:\Documents and Settings\Vasi>D:ruter\brjtag1.8a -probeonly

===============================================
 Broadcom EJTAG Debrick Utility v1.8a-hugebird
===============================================

Probing bus ... Done

Instruction Length set to 5

CPU running under BIG endian

CPU Chip ID: 00000110001101011000000101111111 (0635817F)
*** Found a Broadcom BCM6358 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Detecting Flash Base Address...
Read MPI register value : 00000000
MPI register show Flash Access Base Addr : 00000000

Probing Flash at Address: 0x00000000 ...
Detected Chip ID (VenID:DevID = 0000 : 0000)
*** Unknown or NO Flash Chip Detected ***


 *** REQUESTED OPERATION IS COMPLETE ***

C:\Documents and Settings\Vasi>D:ruter\brjtag1.8a -flash:CFE

===============================================
 Broadcom EJTAG Debrick Utility v1.8a-hugebird
===============================================

Probing bus ... Done

Instruction Length set to 5

CPU running under BIG endian

CPU Chip ID: 00000110001101011000000101111111 (0635817F)
*** Found a Broadcom BCM6358 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Detecting Flash Base Address...
Read MPI register value : 00000000
MPI register show Flash Access Base Addr : 00000000

Probing Flash at Address: 0x00000000 ...
Detected Chip ID (VenID:DevID = 0000 : 0000)
*** Unknown or NO Flash Chip Detected ***


 *** REQUESTED OPERATION IS COMPLETE ***

9 Август, 2017

** Unknown or NO Flash Chip Detected ***

с този Broadcom EJTAG Debrick Utility v1.8a-hugebird може ли да форснеш флаш модел и да скипнеш автоматичното откриване ? (ако спецификациите от производителите са идентични)

Можеш ли да трансплантираш флаш чип ?

Можеш ли да опиташ с някой друг jtag tool ?

Можеш ли да опиташ под Linux ?

Редактирано 9 Август, 2017 от NetworkPro

9 Август, 2017

Да разбирам ли, че си убил и boot loader-а?

Не съм се занимавал с broadcom чипове, но според Using web (http) server ако boot loader-а не е умрял, може да съдържа recovery инструмент. Процедурата е проста, излючваш рутера, натискаш ресет бутона и при натиснат ресет бутон включваш захранването, след 5-10 сек. пускаш ресет бутона. Свържи предварително рутера с комп. с лан кабел. Търси на IP-адреси: 192.168.1.1; 192.168.1.6 ... Наблюденията ми са, че в повечето рутери е заложен подобен инструмен за възтановяване, търси в интернет с точен модел.

Друг вариант е да се свържеш с USB to UART TTL rev.2, ако boot loader-а не е затрит.

Ако нищо не помогне, последния и най-сигурен метод е програматор. Проблема е, че могат да се затрият някои дялове, които съдържат важна информация.

9 Август, 2017

Аз въртях кристалната топка, ама не докарах до там да разбера какъв е рутера.

10 Август, 2017

рутера е BT home hub 2 type A.и друг път съм си играел с такъв рутер и се получи.включих рутера и започнах -probeonly ок.после -backup:CFE и си направих backup.после при качването на CFE-то -flash:CFE почна да се качва и спря ..помислих че е от моя компютъра и пробвам от друг компютър но се получава това .изглежда съм затрил бот лоадера.това ми показва с други толове

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Vasi>D:ruter\alice03

============================================
EJTAG Debrick Utility for Alice routers v0.3
============================================

 ABOUT: This program is a debrick utility for Alice routers.
        It's able to read/write flash memory on the routers distributed
        by Telecom Italia via EJTAG using either DMA Access routines
        or PrAcc routines (slower/more compatible).


 USAGE: D:ruter\alice03 PARAMETER [option]...

            Required Parameter
            ------------------
            -backup:<cfe|cfe_nvram|bootimg1|bootimg2|psi_nvram|scratch_pad|psi|w
holeflash|custom>
            -erase:<cfe|cfe_nvram|bootimg1|bootimg2|psi_nvram|scratch_pad|psi|wh
oleflash|custom>
            -flash:<cfe|cfe_nvram|bootimg1|bootimg2|psi_nvram|scratch_pad|psi|wh
oleflash|custom>
            -probeonly
            -show:fc

            Optional Switches
            -----------------
            /noreset ........... prevent Issuing EJTAG CPU reset
            /noemw ............. prevent Enabling Memory Writes
            /nocwd ............. prevent Clearing CPU Watchdog Timer
            /nobreak ........... prevent Issuing Debug Mode JTAGBRK
            /noerase ........... prevent Forced Erase before Flashing
            /notimestamp ....... prevent Timestamping of Backups
            /dma ............... force use of DMA routines
            /nodma ............. force use of PRACC routines (No DMA)
            /window:XXXXXXXX ... custom flash window base (in HEX)
            /start:XXXXXXXX .... custom start location (in HEX)
            /length:XXXXXXXX ... custom length (in HEX)
            /silent ............ prevent scrolling display of data
            /skipdetect ........ skip auto detection of CPU Chip ID
            /instrlen:XX ....... set instruction length manually
            /cable:XXXXXXXX .... set cable type (xilinx, jkeys, wiggler)

            /fc:XX = manual Flash Chip selection
                     Use the parameter -show:/fc to see the
                     complete chip list
            -----------------------------------------------


 NOTES: 1) If 'flashing' - the source filename must exist as follows:
           CFE.BIN, NVRAM.BIN, BOOTIMG<1|2>.BIN, PSI_NVRAM.BIN,
           SCRATCH_PAD.BIN, PSI.BIN, WHOLEFLASH.BIN or CUSTOM.BIN

        2) You have to make a power cicle before any operation.
 ******************************************************************************
 * Flashing the BOOTIMGes or WHOLEFLASH will take a very long time using JTAG *
 * via this utility.  You are better off flashing the CFE & NVRAM files       *
 * and then using the normal CFE, TFTP or Web method to flash the BOOTIMGes   *
 * via ethernet.                                                              *
 ******************************************************************************


C:\Documents and Settings\Vasi>D:ruter\alice03 -probeonly

============================================
EJTAG Debrick Utility for Alice routers v0.3
============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000110001101011000000101111111 (0635817F)
*** Found a Broadcom BCM6358 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1f000000) ...
Probing Flash at (Flash Window: 0x1f400000) ...
Probing Flash at (Flash Window: 0x1f800000) ...
Probing Flash at (Flash Window: 0x1fc00000) ...
Probing Flash at (Flash Window: 0x20000000) ... Done

*** Unknown or NO Flash Chip Detected ***

 *** REQUESTED OPERATION IS COMPLETE ***


C:\Documents and Settings\Vasi>D:ruter\alice03 -flash:CFE

============================================
EJTAG Debrick Utility for Alice routers v0.3
============================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000110001101011000000101111111 (0635817F)
*** Found a Broadcom BCM6358 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1f000000) ...
Probing Flash at (Flash Window: 0x1f400000) ...
Probing Flash at (Flash Window: 0x1f800000) ...
Probing Flash at (Flash Window: 0x1fc00000) ...
Probing Flash at (Flash Window: 0x20000000) ... Done

*** Unknown or NO Flash Chip Detected ***

 *** REQUESTED OPERATION IS COMPLETE ***



Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Vasi>D:ruter\brjtag2.04

        ===============================================
         Broadcom EJTAG Debrick Utility v2.0.4-hugebird
        ===============================================

 ABOUT: This program reads/writes flash memory on the Broadcom MIPS(LE)
        Chip and compatible routers via EJTAG using either DMA Access
        routines or PrAcc routines (slower/more compatible). Processor chips
        supported in this version include the following chips:

            Supported Chips
            ---------------
            Broadcom BCM4702
            Broadcom BCM4704
            Broadcom BCM4712
            Broadcom BCM4716
            Broadcom BCM4705|4785
            Broadcom BCM5350
            Broadcom BCM5352
            Broadcom BCM5354
            Broadcom BCM5356
            Broadcom BCM5365
            Broadcom HND Mips 74K(008C)
            Broadcom BCM6345
            Broadcom BCM6338
            Broadcom BCM6348
            Broadcom BCM6358
            Broadcom BCM6368
            Broadcom BCM6816
            Broadcom BCM7401
            PMC-Serria BRECIS MSP2007-CA-A1
            TI TNETD7300GDU(AR7WRD)
            TI TNETV1060GDW

            Supported Cable Types
            ---------------
            ID  Cable Name
            0    Parallel port type(DLC5/WIGGLER)
            1    FT2232C/D based USB cable(OpenMoko,JTAGkey,OpenJTAG)
            2    SEGGAR J-Link EMU(v5.0 or later)
            3    HID-BRJTAG v1.xx(USBASP M8)
            4    HID-BRJTAG v2.xx(STM32F10x/SAM7S)


 USAGE: Brjtag /showflashlist
 USAGE: Brjtag [parameter] </noreset> </noemw> </nocwd> </nobreak></LE|BE>
                      </notimestamp> </dma> </nodma> </noerase></initcpu>
                      </nompi> </ejslow></waitbrk></srst><wx8></resetcs>
                      </bypass></forcealign></showppb></clearppb></erasechip>
                      </nocfi></forcenoflip></forceflip></spirevert>
                      <window:XXXXXXXX><start:XXXXXXXX> </length:XXXXXXXX>
                      <port:XXX> </instrlen:XX> </fc:XX></skipdetect>
                      </wiggler></cable:X></io2></safemode>
                      </verbose></pause>

            Required Parameter
            ------------------
            -backup:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]
            -erase:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]
            -flash:[cfe|tfe|cfe128|nvram|wholeflash|custom|kernel|bsp]
            -probeonly

            Optional Switches
            -----------------
            /noreset ........... prevent Issuing EJTAG CPU reset
            /noemw ............. prevent Enabling Memory Writes
            /nocwd ............. prevent Clearing CPU Watchdog Timer
            /nobreak ........... prevent Issuing Debug Mode JTAGBRK
            /noerase ........... prevent Forced Erase before Flashing
            /notimestamp ....... prevent Timestamping of Backups
            /dma ............... force use of DMA routines
            /srst .............. force a TAP nSRST reset on starting
            /nodma ............. force use of PRACC routines (No DMA)
            /ejslow............. with low speed ejtag access
            /waitbrk............ wait until CPU enter debug mode
            /wx8 ............... with x8 mode program flash
            /resetcs ........... issue spi controller reset before any op
            /spirev............. reverse data endian on flashing a spi chip
            /initcpu............ load CPU configuration code
            /nompi.............. skip autodect flash base address with MPI Reg
            /LE ................ force operate as Little Endian chip
            /BE ................ force operate as Big Endian chip
            /window:XXXXXXXX ... custom flash window base&probe address(in HEX)
            /start:XXXXXXXX .... custom start location (in HEX)
            /length:XXXXXXXX ... custom length (in HEX)
            /verbose............ scrolling display of data
            /pause.............. pause while CPU is initialized
            /skipdetect ........ skip auto detection of CPU Chip ID
            /instrlen:XX ....... set CPU instruction length manually
            /wiggler ........... use wiggler cable
            /nocfi ............. disable CFI query flash geometry
            /forcenoflip ....... force not flipping CFI queried flash geometry
            /forceflip ......... force flipping CFI queried flash geometry
            /bypass ............ unlock Spansion bypass mode & disable polling
            /forcealign......... force erase address align with block boundary
            /erasechip.......... erase whole chip, only work with -probeonly
            /clearppb........... erase Spansion PPB,only work with -probeonly
            /showppb ........... show flash sector protection status
                                 only work with -probeonly
            /port:XXX........... customize parallel port(default XXX is 378)
                                 only work in Windows version
            /io2 ............... use alternative Parallel port access method
            /cable:x ........... select cable type, x = cable type ID
            /safemode .......... use parallel cable way operate USB, SLOW!
            /fc:XXX = Manual Flash Chip Selection,disable CFI and ID auto match
                      use 'brjtag /showflashlist' show build-in flash list



 NOTES: *) '-backup:', '-flash:' and '-erase:', the source filename must exist
           as follows: CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or
           CUSTOM.BIN, BSP.BIN, TFE.BIN(64KB or 1x bottom Sector length CFE)
           CFE128.BIN(128KB CFE)

        *) Brjtag defualt with x16 mode handle Parallel Flash chip. /wx8 switch
           to x8 mode.

        *) Brjtag uses CFI command set to automatically detect flash chip
           parameters. If you have difficulty auto-detecting flash with CFI,
           '/nocfi' convert to original flash detection method. brjtag then use
           detected flash ID query parameters from build-in flash list.
           particularly, you can use '/fc:XX' manually specify flash ID.
           'brjtag /showflashlist' can print build-in flash list

        *) '/forcenoflip' and '/forceflip' can help on some AMD type flash
           detecting sector structure correctly if CFI uses.
           'brjtag -probeonly /verbose' debug flash detection

        *) If you have difficulty with the older bcm47xx chips or when no CFE
           is currently active/operational you may want to try both the
           /noreset and /nobreak command line options together.  Some bcm47xx
           chips *may* always require both these options to function properly.

        *) When using this utility, usually it is best to type the command line
           out, then power up the router, about 0.5 second delay, hit <ENTER>
           quickly to avoid bad CFE code lead to <CPU NOT enter Debug mode>
           or the CPUs watchdog interfering with the EJTAG operations.

        *) /bypass - enables Unlock bypass command for some AMD/Spansion type
           flashes, it also disables polling

        *) /initcpu allow load config code to initialize the CPU. This may help
           BCM6358 prevent from some address non-accessible.

        *) '-probeonly /window:xxxxxxxx /erasechip' allow choose a workable
           sector address to erase whole chip. This may help on a bricked box
           with bad CFE

        *) /forcealign - enable erase sectors if the operation window is not
           aligned with sector boundary. It's risky! but can help erase some
           box NVRAM area whose sector size is larger than NVRAM definition

        *) /ejslow - limit parallel port clock out speed to 500KHz. This wish
           to increase LPT port compatibility for some high clock PC.
           For USB cable this switch can help hit higher clock

        *) /pause - pause while CPU being initialized.
           help handle <CPU NOT enter Debug Mode> via shorting pin method

 ***************************************************************************
 * Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *
 * via this utility.  You are better off flashing the CFE & NVRAM files    *
 * & then using the normal TFTP method to flash the KERNEL via ethernet.   *
 ***************************************************************************


C:\Documents and Settings\Vasi>D:ruter\brjtag2.04 -probeonly

        ===============================================
         Broadcom EJTAG Debrick Utility v2.0.4-hugebird
        ===============================================

Probing bus ... Done

Detected IR Length is 5

CPU assumed running under BIG endian

CPU Chip ID: 00000110001101011000000101111111 (0635817F)
*** Found a Broadcom manufactured BCM6358 REV 01 CPU ***

    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes
    - EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped
Detecting Flash Base Address...Address invalid!, Skipped.

Probing Flash at Address: 0x1FC00000 ...
Detected pFlash Chip ID (VenID:DevID = 0000 : 0000)
*** Unknown or NO Flash Chip Detected ***


 *** REQUESTED OPERATION IS COMPLETE ***



Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Vasi>D:ruter\stjtag

=======================================
  ST5xx EJTAG Debrick Utility v1.0b
This Utility was changed from WRT54G to
work correctly with Speedtouch Routers
=======================================

 ABOUT: This program reads/writes flash memory on the ST5xx and
        compatible routers via EJTAG using either DMA Access routines
        or PrAcc routines (slower/more compatible). Note that may not
        still be compatible with the WRT Routers.  Processor chips
        supported in this version include the following chips:

            Supported Chips
            ---------------
            Broadcom BCM4702 Rev 1 CPU
            Broadcom BCM4712 Rev 1 CPU
            Broadcom BCM4712 Rev 2 CPU
            Broadcom BCM5350 Rev 1 CPU
            Broadcom BCM5352 Rev 1 CPU
            Broadcom BCM5365 Rev 1 CPU
            Broadcom BCM6338 Rev 1 CPU
            Broadcom BCM6358 Rev 1 CPU
            Broadcom BCM6348 Rev 1 CPU
            Broadcom BCM6345 Rev 1 CPU
            TI AR7WRD TNETD7300GDU Rev 1 CPU
            Broadcom BCM4704 Rev 8 CPU
            BRECIS MSP2007-CA-A1 CPU


 USAGE: STJTAG [parameter] </noreset> </noemw> </nocwd> </nobreak> </noerase>
                      </notimestamp> </dma> </nodma>
                      <start:XXXXXXXX> </length:XXXXXXXX>
                      </silent> </skipdetect> </instrlen:XX> </fc:XX>

            Required Parameter
            ------------------
            -backup:cfe
            -backup:nvram
            -backup:kernel
            -backup:wholeflash
            -backup:custom
            -erase:cfe
            -erase:nvram
            -erase:kernel
            -erase:wholeflash
            -erase:custom
            -flash:cfe
            -flash:nvram
            -flash:kernel
            -flash:wholeflash
            -flash:custom
            -probeonly

            Optional Switches
            -----------------
            /noreset ........... prevent Issuing EJTAG CPU reset
            /noemw ............. prevent Enabling Memory Writes
            /nocwd ............. prevent Clearing CPU Watchdog Timer
            /nobreak ........... prevent Issuing Debug Mode JTAGBRK
            /noerase ........... prevent Forced Erase before Flashing
            /notimestamp ....... prevent Timestamping of Backups
            /dma ............... force use of DMA routines
            /nodma ............. force use of PRACC routines (No DMA)
            /window:XXXXXXXX ... custom flash window base (in HEX)
            /start:XXXXXXXX .... custom start location (in HEX)
            /length:XXXXXXXX ... custom length (in HEX)
            /silent ............ prevent scrolling display of data
            /skipdetect ........ skip auto detection of CPU Chip ID
            /instrlen:XX ....... set instruction length manually
            /wiggler ........... use wiggler cable

            /fc:XX = Optional (Manual) Flash Chip Selection
            -----------------------------------------------
            /fc:01 ............. AMD 29lv160DB 1Mx16 BotB   (2MB)
            /fc:02 ............. AMD 29lv160DT 1Mx16 TopB   (2MB)
            /fc:03 ............. AMD 29lv320DB 2Mx16 BotB   (4MB)
            /fc:04 ............. AMD 29lv320DT 2Mx16 TopB   (4MB)
            /fc:05 ............. AMD 29lv320MB 2Mx16 BotB   (4MB)
            /fc:06 ............. AMD 29lv320MT 2Mx16 TopB   (4MB)
            /fc:07 ............. Spansion S29GL032M 2Mx16 BotB (4MB)
            /fc:08 ............. AMD 29lv320MT 2Mx16 TopB   (4MB)
            /fc:09 ............. Intel 28F128J3 8Mx16       (16MB)
            /fc:10 ............. Intel 28F160B3 1Mx16 BotB  (2MB)
            /fc:11 ............. Intel 28F160B3 1Mx16 TopB  (2MB)
            /fc:12 ............. Intel 28F160C3 1Mx16 BotB  (2MB)
            /fc:13 ............. Intel 28F160C3 1Mx16 TopB  (2MB)
            /fc:14 ............. Intel 28F160S3/5 1Mx16     (2MB)
            /fc:15 ............. Intel 28F320B3 2Mx16 BotB  (4MB)
            /fc:16 ............. Intel 28F320B3 2Mx16 TopB  (4MB)
            /fc:17 ............. Intel 28F320C3 2Mx16 BotB  (4MB)
            /fc:18 ............. Intel 28F320C3 2Mx16 TopB  (4MB)
            /fc:19 ............. Intel 28F320J3 2Mx16       (4MB)
            /fc:20 ............. Intel 28F320J5 2Mx16       (4MB)
            /fc:21 ............. Intel 28F320S3/5 2Mx16     (4MB)
            /fc:22 ............. Intel 28F640B3 4Mx16 BotB  (8MB)
            /fc:23 ............. Intel 28F640B3 4Mx16 TopB  (8MB)
            /fc:24 ............. Intel 28F640C3 4Mx16 BotB  (8MB)
            /fc:25 ............. Intel 28F640C3 4Mx16 TopB  (8MB)
            /fc:26 ............. Intel 28F640J3 4Mx16       (8MB)
            /fc:27 ............. Intel 28F640J5 4Mx16       (8MB)
            /fc:28 ............. MBM29LV320BE 2Mx16 BotB    (4MB)
            /fc:29 ............. MBM29LV320TE 2Mx16 TopB    (4MB)
            /fc:30 ............. MX29LV320B 2Mx16 BotB      (4MB)
            /fc:31 ............. MX29LV320B 2Mx16 BotB      (4MB)
            /fc:32 ............. MX29LV320T 2Mx16 TopB      (4MB)
            /fc:33 ............. MX29LV320T 2Mx16 TopB      (4MB)
            /fc:34 ............. SST39VF320 2Mx16           (4MB)
            /fc:35 ............. ST 29w320DB 2Mx16 BotB     (4MB)
            /fc:36 ............. ST 29w320DT 2Mx16 TopB     (4MB)
            /fc:37 ............. Sharp 28F320BJE 2Mx16 BotB (4MB)
            /fc:38 ............. TC58FVB321 2Mx16 BotB      (4MB)
            /fc:39 ............. TC58FVT321 2Mx16 TopB      (4MB)
            /fc:40 ............. AT49BV/LV16X 2Mx16 BotB    (4MB)
            /fc:41 ............. AT49BV/LV16XT 2Mx16 TopB   (4MB)
            /fc:42 ............. MBM29LV160B 1Mx16 BotB     (2MB)
            /fc:43 ............. MBM29LV160T 1Mx16 TopB     (2MB)
            /fc:44 ............. MX29LV161B 1Mx16 BotB      (2MB)
            /fc:45 ............. MX29LV161T 1Mx16 TopB      (2MB)
            /fc:46 ............. ST M29W160EB 1Mx16 BotB    (2MB)
            /fc:47 ............. ST M29W160ET 1Mx16 TopB    (2MB)
            /fc:48 ............. SST39VF1601 1Mx16 BotB     (2MB)
            /fc:49 ............. SST39VF1602 1Mx16 TopB     (2MB)
            /fc:50 ............. SST39VF3201 2Mx16 BotB     (4MB)
            /fc:51 ............. SST39VF3202 2Mx16 TopB     (4MB)
            /fc:52 ............. SST39VF6401 4Mx16 BotB     (8MB)
            /fc:53 ............. SST39VF6402 4Mx16 TopB     (8MB)
            /fc:54 ............. K8D1716UTC  1Mx16 TopB     (2MB)
            /fc:55 ............. K8D1716UBC  1Mx16 BotB     (2MB)
            /fc:56 ............. MX29LV800BTC 512kx16 TopB  (1MB)
            /fc:57 ............. MX29LV800BTC 512kx16 BotB  (1MB)
            /fc:58 ............. K8D3216UTC  2Mx16 TopB     (4MB)
            /fc:59 ............. K8D3216UBC  2Mx16 BotB     (4MB)
            /fc:60 ............. SST39VF6401B 4Mx16 BotB    (8MB)
            /fc:61 ............. SST39VF6402B 4Mx16 TopB    (8MB)


 NOTES: 1) If 'flashing' - the source filename must exist as follows:
           CFE.BIN, NVRAM.BIN, KERNEL.BIN, WHOLEFLASH.BIN or CUSTOM.BIN

        2) If you have difficulty auto-detecting a particular flash part
           you can manually specify your exact part using the /fc:XX option.

        3) If you have difficulty with the older bcm47xx chips or when no CFE
           is currently active/operational you may want to try both the
           /noreset and /nobreak command line options together.  Some bcm47xx
           chips *may* always require both these options to function properly.

        4) When using this utility, usually it is best to type the command line
           out, then plug in the router, and then hit <ENTER> quickly to avoid
           the CPUs watchdog interfering with the EJTAG operations.

 ***************************************************************************
 * Flashing the KERNEL or WHOLEFLASH will take a very long time using JTAG *
 * via this utility.  You are better off flashing the CFE & NVRAM files    *
 * & then using the normal TFTP method to flash the KERNEL via ethernet.   *
 ***************************************************************************


C:\Documents and Settings\Vasi>D:ruter\stjtag -probeonly

=======================================
  ST5xx EJTAG Debrick Utility v1.0b
This Utility was changed from WRT54G to
work correctly with Speedtouch Routers
=======================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000110001101011000000101111111 (0635817F)
*** Found a Broadcom BCM6358 Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (00818904)
    - EJTAG Version ....... : 1 or 2.0
    - EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1fc00000) ... Done

*** Unknown or NO Flash Chip Detected ***

 *** REQUESTED OPERATION IS COMPLETE ***

изглежда ще отива в коша

10 Август, 2017

По скоро нещо друго си объркал
https://lede-project.org/toh/hwdata/bt/bt_homehub_2a

bootloader needs replacing

10 Август, 2017

по скоро проблема е да съм прегорил някоя писта въпреки че работих с 30 W поялник.остава друга възможност чрез сериал но не знам как става и го оставям настрани за друг път.благодаря на всички

Вход

openwrt и JTAG

Recommended Posts

lino_st

Адрес на коментара

Сподели в други сайтове

NetworkPro

Адрес на коментара

Сподели в други сайтове

mysticall

Адрес на коментара

Сподели в други сайтове

111111

Адрес на коментара

Сподели в други сайтове

lino_st

Адрес на коментара

Сподели в други сайтове

111111

Адрес на коментара

Сподели в други сайтове

lino_st

Адрес на коментара

Сподели в други сайтове

Създайте нов акаунт или се впишете, за да коментирате

Създайте акаунт

Вход

Потребители разглеждащи страницата 0 потребители

Форум

Активност

Important Information