Speedport W303V A ( Arcadyan ) Info's

byteeater · 10 Jan 2010

moin,

hab mal wieder bischen langeweile, den hier rumliegenden w303v rev a mal ein wenig unter die lupe genommen.
ist nen arcadyan arv7526PW laut label auf dem print, auf dem flash steht arv7526pwm-b-lf-23, hat org rom version 1.06.00
wlan chipset ist nen ralink rt-2860t
bootloader lässt sich mit bischen geschick durch drücken der reset-taste und DANN erst strom einschalten, errreichen. ist bischen fummelkram, klappt bei mir auch nur bein 5-6 mal.
bootloader läuft auf 192.168.2.1:80 und 443. up & downgrade der fw ist im original bootloader möglich, sowie ein restore auf factory defaults.
passwort zum bootloader ist identich zum webif passwort der normalen firmware und steht somit hinten auf dem gerätedeckel.

todo:
1) serielle konsole finden. done

--5---4---3---2---1
+---+---+---+---+---+
| o | o | o | o | o |
+ + + + + +
| o | o | o | o | o |
+---+---+---+---+---+
-10---9---8---7---6

5=gnd, 3=tx, 2=rx
115200-8-N-1-No flow control.

2) bootlog erstellen. done:

Code:

ROM VER: 1.0.3
CFG 01
Readà
ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X



=======================================================================
Wireless ADSL Gateway DANUBE Loader v1.03.04 build May 15 2008 20:57:30
                    Arcadyan Technology Corporation
=======================================================================
MXIC MX29LV320ABTC bottom boot 16-bit mode found

Copying boot params.....DONE

Press Space Bar 3 times to enter command mode ...
Flash Checking  Passed.

Unzipping firmware at 0x80002000 ... with AREA[2][ZIP 3]
[ZIP Extra] [ZIP 1]  done
Ready to run firmware

In c_entry() function ...
install_exception
Co config = 80008483
[INIT] Interrupt ...
##### _ftext      = 0x80002000
##### _fdata      = 0x804F73A0
##### __bss_start = 0x805A3D90
##### end         = 0x81BF9314
##### Backup Data from 0x804F73A0 to 0x81C01314~0x81CADD04 len 707056
##### Backup Data completed
##### Backup Data verified
[GPIO FLOW] SetGpio() Begin ..
[GPIO FLOW] SetGpio() End.
[INIT] System Log Pool startup ...
[INIT] MTinitialize ..
[INIT] usrclk
CPU Clock 333333334 Hz
mips_counter_frequency:166666667
r4k_offset: 00028b0a(166666)
init_US_counter : time1 = 260451 , time2 = 40260504, diff 40000053
US_counter = 48
 cnt1 40984875 cnt2 40987142, diff 2267
Runtime code version: 1.07.000
System startup...
[INIT] Memory COLOR 0, 2548576 bytes ..
[INIT] Memory COLOR 1, 262144 bytes ..
[INIT] Memory COLOR 2, 5546928 bytes ..
InitCommSys: RESOURCE_BASE = 62, NUMRES = 640
InitCommSys: EVENT_BASE = 113, NUMEVT = 818
InitCommSys: MAILBOX_BASE = 6, NUMMBX = 64

rzMemory start: 0x80C5D5F0, end 0x81041700, size 4079888
Build Day = Dec 15 2008
>>>>set_MP_pass_Magic to 2
MXIC MX29LV320ABTC bottom boot 16-bit mode found
Set flash memory layout to Boot Parameters found !!!
HWOption set HWLAN : default PCI CLOCK External External interrupt PCI NUM 1
Bootcode version: v1.03.04
Serial number: J838010416
Hardware version: 01
pBootParams->password 59 71 6f (20)
Entered default password checking 0 8
fread_config_b> sizeof(struct III_Config_t) is 242652
MXIC MX29LV320ABTC bottom boot 16-bit mode found
fread_config_b> 7557 bytes read from flash
fread_config_b> 243163 bytes decompressed successfully.
-----------------------> Checking SysLog in Flash OK
-----------------------> Restore SysLog from Flash 490 bytes from 3b3e2
-----------------------> Restore Call Log from Flash 15 bytes from 3b5d3
DS_Tail ~ DS_Tail303_2 OK!
!!! Invalid wireless channel range 0 ~ 255
!!! Use default value 1 ~ 13
====xxx==============================-->425@-230;600(.4/.4/1,.4/3/1)
-->425@-230;30(.1/.25/1,.1/3/1)
-->600(.9/4.8)
-->600(.3/.5,.3/3)
-->600(.9/3.9)
check_WAN_switch returns 0
default route: 0.0.0.0
BufferInit:
BUF_HDR_SZ=160 BUF_ALIGN_SZ=4 BUFFER_OFFSET=384
BUF_BUFSZ0=544 BUF_BUFSZ1=4320
NUM_OF_B0=0 NUM_OF_B1=1400
BUF_POOL0_SZ=0 BUF_POOL1_SZ=6272000
sizeof(BUFFER0)=704,sizeof(BUFFER1)=4480
*BUF0=0x816883b8 *BUF1=0x8108cf98
Altgn *BUF0=0x816883c0 *BUF1=0x8108cfa0
End at BUF0:0x816883c0, BUF1:0x816883a0

BUF0[0]=0x816883c0 BUF1[0]=0x8108cfa0

buffer0 pointer init OK!
buffer1 pointer init OK!
[qm_lnk_init] CLOCKHZ=1000 ...
[qm_lnk_init] add if 3 into QM link 0
[qm_cbq_enable] no QM attached
[qm_cbq_detach] no QM is attached at link 0
f=3492148201/100000, ns_per_byte=1090005888/100000
New cls: id=0, bw=8080 ns/byte, maxd=0 ms,
         maxb=32, minb=2, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=0, borrow=0
         pri=0, maxidle=1, minidle=0,
         maxq=96, clsfg=17
f=2002645667/100000, ns_per_byte=1083109375/100000
New cls: id=1, bw=808080 ns/byte, maxd=0 ms,
         maxb=16, minb=1, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf62cc, borrow=81bf62cc
         pri=5, maxidle=1, minidle=0,
         maxq=48, clsfg=21
qm_cbq_attach(): cbqp->cbq_res=56
f=90439747/100000, ns_per_byte=1089990048/100000
New cls: id=2, bw=8162 ns/byte, maxd=0 ms,
         maxb=32, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf62cc, borrow=81bf62cc
         pri=5, maxidle=1, minidle=0,
         maxq=48, clsfg=21
f=3846176767/100000, ns_per_byte=1072693248/100000
New cls: id=3, bw=799999999 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=0, maxidle=0, minidle=0,
         maxq=96, clsfg=21
f=3846176767/100000, ns_per_byte=1072693248/100000
New cls: id=4, bw=799999999 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=1, maxidle=0, minidle=0,
         maxq=48, clsfg=23
f=3846176767/100000, ns_per_byte=1072693248/100000
New cls: id=5, bw=799999999 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=2, maxidle=0, minidle=0,
         maxq=48, clsfg=23
f=3846176767/100000, ns_per_byte=1072693248/100000
New cls: id=6, bw=799999999 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=3, maxidle=0, minidle=0,
         maxq=48, clsfg=23
f=3846176767/100000, ns_per_byte=1072693248/100000
New cls: id=7, bw=799999999 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=4, maxidle=0, minidle=0,
         maxq=48, clsfg=23
f=90439747/100000, ns_per_byte=1089990048/100000
New cls: id=8, bw=8162 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=6, maxidle=1, minidle=0,
         maxq=48, clsfg=20
CLOCKHZ=1000
gConfig.Interface[0].IP_Addr = 127.0.0.1
gConfig.Interface[0].Subnet_Mask = 255.255.255.255
time = 08/01/2003, 00:00:00
TRAP(linkUp) : send ok!
Interface 0 ip = 127.0.0.1

gConfig.Interface[1].IP_Addr = 192.168.2.1
gConfig.Interface[1].Subnet_Mask = 255.255.255.0
vlan=0, vid=1, port_mask=0xf
DMA g_desc_list=0x80AF2100
MAC Address: 00:23:08:23:53:ba
time = 08/01/2003, 00:00:00
TRAP(linkUp) : send ok!
Interface 1 ip = 192.168.2.1

gConfig.Interface[2].IP_Addr = 0.0.0.0
gConfig.Interface[2].Subnet_Mask = 0.0.0.0
PCI clock 33.3MHz
cut-off PCI internal clock
DANUBE_GPIO_P1_ALTSEL0=547
DANUBE_GPIO_P1_ALTSEL1=0
DANUBE_GPIO_P1_DIR=91f6
[HWLAN] ifno=2 irno=7 port=0x00000000
RTMP_ADAPTER_mem : 8073d3e0, sizeof(RTMP_ADAPTER) 374272
rt2860_probe : should call pci_set_master() ???
should call pci_set_drvdata ???
time = 08/01/2003, 00:00:00
TRAP(linkUp) : send ok!
Interface 2 ip = 192.168.2.1

gConfig.Interface[3].IP_Addr = 0.0.0.0
gConfig.Interface[3].Subnet_Mask = 0.0.0.0
ppe: ATM init succeeded (firmware version 1.1.0.2.1.13)
ATM_UBR
Init SAR ifno:3 g_atm_vcc[0] CONN:1 VPI/VCI:1/32
MAC Address: 00:23:08:23:53:bb
Interface 3 ip = 0.0.0.0

gConfig.Interface[5].IP_Addr = 0.0.0.0
gConfig.Interface[5].Subnet_Mask = 0.0.0.0
IFLNK_PPPOE init : (Linkp)ifno = 5 idx = 2
IFLNK_PPPOE init : (Driverp)ifno = 5 idx = 3
Interface 5 ip = 0.0.0.0

gConfig.Interface[8].IP_Addr = 0.0.0.0
gConfig.Interface[8].Subnet_Mask = 0.0.0.0
[HWLAN] ifno=8 irno=7 port=0x00000000
time = 08/01/2003, 00:00:00
TRAP(linkUp) : send ok!
Interface 8 ip = 192.168.2.1

gConfig.Interface[9].IP_Addr = 0.0.0.0
gConfig.Interface[9].Subnet_Mask = 0.0.0.0
[HWLAN] ifno=9 irno=7 port=0x00000000
time = 08/01/2003, 00:00:00
TRAP(linkUp) : send ok!
Interface 9 ip = 192.168.2.1

gConfig.Interface[10].IP_Addr = 0.0.0.0
gConfig.Interface[10].Subnet_Mask = 0.0.0.0
[HWLAN] ifno=10 irno=7 port=0x00000000
time = 08/01/2003, 00:00:00
TRAP(linkUp) : send ok!
Interface 10 ip = 192.168.2.1

gConfig.Interface[11].IP_Addr = 0.0.0.0
gConfig.Interface[11].Subnet_Mask = 0.0.0.0
[HWLAN] ifno=11 irno=7 port=0x00000000
time = 08/01/2003, 00:00:00
TRAP(linkUp) : send ok!
Interface 11 ip = 192.168.2.1

ruleCheck()> Group: 0,  Error: Useless rule index will be truncated
ruleCheck()> Group: 1,  Error: Useless rule index will be truncated
ruleCheck()> Group: 2,  Error: Useless rule index will be truncated
CBAC rule format check succeed !!
reqCBACBuf()> init match pool, Have: 1000
Memory Address: 0x81b9115c ~ 0x81b97ed8
reqCBACBuf()> init timeGap pool, Have: 10000
Memory Address: 0x81b97ed8 ~ 0x81bc8c2c
reqCBACBuf()> init sameHost pool, Have: 2000
Memory Address: 0x81bc8c2c ~ 0x81bd864c
CBAC rule pool initialized !!
[init_if] local_if_mask=0xf07
[init_if] local_wiredif_mask=0x2
[init_if] local_wirelessif_mask=0xf04
[init_if] localorVPN_if_mask=0xf07
1 set_timer: ti=0 type=1 ina[00000000] gid[00000000]
2 set_timer: ti=0 type=1 ina[00000000] gid[00000000]
3 set_timer: ti=0 type=1 ina[00000000] gid[00000000]
5 set_timer: ti=0 type=1 ina[00000000] gid[00000000]
8 set_timer: ti=0 type=1 ina[00000000] gid[00000000]
9 set_timer: ti=0 type=1 ina[00000000] gid[00000000]
10 set_timer: ti=0 type=1 ina[00000000] gid[00000000]
11 set_timer: ti=0 type=1 ina[00000000] gid[00000000]
Init NAT data structure
RUNTASK id=2 if_task if0...
RUNTASK id=3 if_task if1...
RUNTASK id=4 if_task if2...
RUNTASK id=5 if_task if3...
RUNTASK id=6 if_task if8...
RUNTASK id=7 if_task if9...
RUNTASK id=8 if_task if10...
RUNTASK id=9 if_task if11...
RUNTASK id=10 timer_task...
RUNTASK id=11 conn_mgr...
RUNTASK id=12 main_8021x...
Build Day = Dec 12 2008
gSetting.Rst_Time (12.12.2008, 12:45)-->year (2008),month (12),day (12),hour (1)
RUNTASK id=13 period_task...

========== ADSL Modem initialization OK ! ======

RUNTASK id=14 dhcp_daemon...
found signature: 78h 56h 34h 12h
ulImgLens=1290220, LENGTH[2]-12=3801076
length checking OK
[0] find End at 0xB018AC00 len=1290220
found signature: 78h 56h 34h 12h
ulImgLens=271340, LENGTH[2]-12=3801076
length checking OK
[1] find End at 0xB01CD000 len=271340
---[ ZIP1 head start in 0xB01CD400 ]---
found signature: 78h 56h 34h 12h
ulImgLens=150508, LENGTH[2]-12=3801076
length checking OK
[2] find End at 0xB01F1C00 len=150508
---[ ZIP1 head start in 0xB01F2000 ]---
found signature: 78h 56h 34h 12h
ulImgLens=417772, LENGTH[2]-12=3801076
length checking OK
[3] find End at 0xB0257C00 len=417772
Image[1] at 0xB0050000, len = 1290220
Image[2] at 0xB018B000, len = 271340
Image[3] at 0xB01CD400, len = 150508
Image[4] at 0xB01F2000, len = 417772
unzip for U/I from 0xb018b000 size 271340
Unzipping from B018B000 to 81D00000 ... [ZIP 3] [ZIP 0]
[ZIP Extra] [ZIP 1] [ZIP 1 2f534650] done
Uncompressed size = 1842350
drive start addr[0]=81d00000, [1]=81ec1cb0
httpd: listen at 192.168.2.1:80
httpd: listen at 192.168.2.1:443
RUNTASK httpd...
RUNTASK id=18 SSLClient ...
g_Client_Cert_Array=0x80c5d55c
RUNTASK id=19 dnsproxy...
RUNTASK id=20 dhcpd_mgmt_task...
UPnP is disabled
TR64 is enabled
TR64 Device initialize success! slot=21
[0] Allocate mailbox 6
[0] Allocate mailbox 7
FirstUseDate:0000-00-00T00:00:00
RUNTASK id=24 wscmain...
RUNTASK id=25 wsc_Send_eap_packet...
RUNTASK id=26 wsc_Send_UPNP_packet...
RUNTASK id=27 WSC_WaitUserAction_Task...
Starting Multitask...
run_project_task
RUNTASK id=28 CMV_task...
[0] Allocate resource 62, FreeResource = 1
fpiclk=83333333, rmc=16, fpiclk/rmc=5208333
ifx_ssc_clock = 5208333, baud=1000000
ifx_ssc_set_baud: br = 2

call ifx_ssc_init() = 0
call ifx_ssc_open() = 0
SPI_Init!
gptu: totally 6 16-bit timers/counters
Init timer (4) - OK
T_WLAN_INT=2
gSetting.CountryCode=0x8114
gSetting.Interface[T_WLAN_INT].Link_Type=1
RUNTASK id=30 apAppInit...
RUNTASK id=33 ScanMIH_task...
[qm_outbnd_bw_update] ...
[qm_cbq_resetclst] n_totalcls=9
aft rst: id=0, bw=8080 ns/byte, maxd=0 ms,
         maxb=32, minb=2, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=0, borrow=0
         pri=0, maxidle=1, minidle=0,
         maxq=96, clsfg=17
aft rst: id=1, bw=808080 ns/byte, maxd=0 ms,
         maxb=16, minb=1, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf62cc, borrow=81bf62cc
         pri=5, maxidle=1, minidle=0,
         maxq=48, clsfg=21
aft rst: id=2, bw=8162 ns/byte, maxd=0 ms,
         maxb=32, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf62cc, borrow=81bf62cc
         pri=5, maxidle=1, minidle=0,
         maxq=48, clsfg=21
aft rst: id=3, bw=800000000 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=0, maxidle=0, minidle=0,
         maxq=96, clsfg=21
aft rst: id=4, bw=800000000 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=1, maxidle=0, minidle=0,
         maxq=48, clsfg=23
aft rst: id=5, bw=800000000 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=2, maxidle=0, minidle=0,
         maxq=48, clsfg=23
aft rst: id=6, bw=800000000 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=3, maxidle=0, minidle=0,
         maxq=48, clsfg=23
aft rst: id=7, bw=800000000 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=4, maxidle=0, minidle=0,
         maxq=48, clsfg=23
aft rst: id=8, bw=8162 ns/byte, maxd=0 ms,
         maxb=16, minb=4, avgpktsz=0, maxpktsz=0,
         offtime=1, parent=81bf4ccc, borrow=81bf4ccc
         pri=6, maxidle=1, minidle=0,
         maxq=48, clsfg=20
init psock cnt=8000
[qm_cbq_enable] CBQ enabled at link: 0, DeQTask=34, wakeup event=10
                low_pri_mtu: 2475
[qm_outbnd_bw_update] ok
ifno2dot1x_if[2]=0
ifno2dot1x_if[8]=81
ifno2dot1x_if[9]=82
ifno2dot1x_if[10]=83
ifno2dot1x_if[11]=84
dot1x_wireless_if_mask=0xf04
[reset_802dot1x] before loop waiting
ralink_init_flag 1 APReady 0
Danube MEI version:1.00.07
Unzip DSP firmware ...
Unzipping from B01CD400 to 81A3C800 ... [ZIP 1] [ZIP 1 49d78]  VOICE_DRV_Init
Reset Duslic High begin
Wait VOIP_Init() finished...done
Uncompressed size = 302464
RUNTASK id=35 Atheros_NetTask ...
rt2860_open : should call request_irq ????????????????????????
rt2860_open 1
rt2860_open 2
rt2860_init 1
rt2860_init 2
rt2860_init 3
rt2860_init 6
rt2860_init 7
rt2860_init 8
rt2860_init 9
rt2860_init 10
update_img_hdr = A1A3C800
idx=0 mem_ptr=0xA1A3C800 size=65536
idx=1 mem_ptr=0xA1A4C800 size=65536
Reset Duslic end
IFX TAPI, version 3.6.1.10, (c) 2001-2008 Infineon Technologies AG
[37] Allocate mailbox 8
TAPI_init_task_queue: enter loop..8
sizeof(RT2860AP_DAT) : 1577
idx=2 mem_ptr=0xA1A5C800 size=65536
[31] Allocate resource 63, FreeResource = 2
[31] Allocate resource 64, FreeResource = 3
Channel=0
idx=3 mem_ptr=0xA1A6C800 size=65536
IFX VMMC device driver, version 1.2.1.10, (c) 2006-2008 Infineon Technologies AG
ifx_mps_init_module...
ifx_mps_init_structures request_irq 1 146
ifx_mps_init_structures request_irq 2 147
ifx_mps_init_structures request_irq 3 0 142
ifx_mps_init_structures request_irq 3 1 143
ifx_mps_init_structures request_irq 3 2 144
ifx_mps_init_structures request_irq 3 3 145
VMMC_Open : Major 122 Minor 10
ifx_tapi_open minorNum 10 majorNum 122
----------------------------> ifx_tapi_open dev 0 ch 0
[31] Allocate resource 65, FreeResource = 4
idx=4 mem_ptr=0xA1A7C800 size=40320
>>>>>>>>>>>>>>>>> TAPI_LL_Prepare_Dev vmmc_current_device 808436e0
[31] Allocate resource 66, FreeResource = 5
[31] Allocate resource 67, FreeResource = 6
[31] Allocate resource 68, FreeResource = 7
-----------------------VMMC_VOICE_POLL-----------------------
rtmp_read_wds_from_file() is called !!!
rtmp_read_wds_from_file : WDS disabled
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 1
-----------------------VMMC_TAPI_WAKEUP-----------------------
[31] Allocate resource 69, FreeResource = 8
[31] Allocate resource 70, FreeResource = 9
[31] Allocate resource 71, FreeResource = 10
[31] Allocate resource 72, FreeResource = 11
[31] Allocate resource 73, FreeResource = 12
[31] Allocate resource 74, FreeResource = 13
[31] Allocate resource 75, FreeResource = 14
[31] Allocate resource 76, FreeResource = 15
[31] Allocate resource 77, FreeResource = 16
[31] Allocate resource 78, FreeResource = 17
[31] Allocate resource 79, FreeResource = 18
[31] Allocate resource 80, FreeResource = 19
[31] Allocate resource 81, FreeResource = 20
[31] Allocate resource 82, FreeResource = 21
[31] Allocate resource 83, FreeResource = 22
[31] Allocate resource 84, FreeResource = 23
[31] Allocate resource 85, FreeResource = 24
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 2
[31] Allocate resource 86, FreeResource = 25
HT: Auto BA  = Enable
HT: MCS = AUTO
HT: STBC = 1
HT: Tx Stream = 2
HT: Rx Stream = 2
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 3
[31] Allocate resource 87, FreeResource = 26
Magic No. in Boot Param check OK!!!
sould check E2PROM MAC ?????????????????
EEPROM_NIC1 123
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 4
[31] Allocate resource 88, FreeResource = 27
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 5
[31] Allocate resource 89, FreeResource = 28
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 6
[31] Allocate resource 90, FreeResource = 29
ADSL Firmware: 2.1.5.2.1.2 ATUR >>>>>>>>>>>>>>>>>(FW: 1.07.000)
[Annex B:0x4208 0x0]
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 7
[31] Allocate resource 91, FreeResource = 30
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 8
[31] Allocate resource 92, FreeResource = 31
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 9
VMMC_LL_Open, nDev 0, inode 0 mpsCh 1
ifx_mps_open, inode 1
g_drvpTapiDev 80c5b238
VMMC_Open --> 80a89948 80c5b238
i 0 VMMC_handle:80c5b238
VMMC_Open : Major 122 Minor 11
ifx_tapi_open minorNum 11 majorNum 122
----------------------------> ifx_tapi_open dev 0 ch 1
VMMC_LL_Open, nDev 0, inode 1 mpsCh 2
ifx_mps_open, inode 2
g_drvpTapiDev 80c58628
VMMC_Open --> 80a89948 80c58628
i 1 VMMC_handle:80c58628
VMMC_Open : Major 122 Minor 12
ifx_tapi_open minorNum 12 majorNum 122
----------------------------> ifx_tapi_open dev 0 ch 2
VMMC_LL_Open, nDev 0, inode 2 mpsCh 3
ifx_mps_open, inode 3
g_drvpTapiDev 80c58ba8
VMMC_Open --> 80a89948 80c58ba8
i 2 VMMC_handle:80c58ba8
VMMC_Open : Major 122 Minor 13
ifx_tapi_open minorNum 13 majorNum 122
----------------------------> ifx_tapi_open dev 0 ch 3
VMMC_LL_Open, nDev 0, inode 3 mpsCh 4
ifx_mps_open, inode 4
g_drvpTapiDev 80c59128
VMMC_Open --> 80a89948 80c59128
i 3 VMMC_handle:80c59128
VMMC_Open : Major 122 Minor 14
ifx_tapi_open minorNum 14 majorNum 122
----------------------------> ifx_tapi_open dev 0 ch 4
VMMC_LL_Open, nDev 0, inode 4 mpsCh 5
ifx_mps_open, inode 5
g_drvpTapiDev 80c596a8
VMMC_Open --> 80a89948 80c596a8
i 4 VMMC_handle:80c596a8
VMMC_Open : Major 122 Minor 15
ifx_tapi_open minorNum 15 majorNum 122
----------------------------> ifx_tapi_open dev 0 ch 5
VMMC_LL_Open, nDev 0, inode 5 mpsCh 6
ifx_mps_open, inode 6
g_drvpTapiDev 80c59c28
VMMC_Open --> 80a89948 80c59c28
i 5 VMMC_handle:80c59c28
VMMC_Open : Major 122 Minor 16
ifx_tapi_open minorNum 16 majorNum 122
----------------------------> ifx_tapi_open dev 0 ch 6
VMMC_LL_Open, nDev 0, inode 6 mpsCh 7
ifx_mps_open, inode 7
g_drvpTapiDev 80c5a1a8
VMMC_Open --> 80a89948 80c5a1a8
i 6 VMMC_handle:80c5a1a8
VMMC_Open : Major 122 Minor 17
ifx_tapi_open minorNum 17 majorNum 122
----------------------------> ifx_tapi_open dev 0 ch 7
VMMC_LL_Open, nDev 0, inode 7 mpsCh 8
g_drvpTapiDev 80c5a728
VMMC_Open --> 80a89948 80c5a728
i 7 VMMC_handle:80c5a728
VMMC_Open : Major 122 Minor 18
ifx_tapi_open minorNum 18 majorNum 122
----------------------------> ifx_tapi_open dev 0 ch 8
VMMC_LL_Open, nDev 0, inode 8 mpsCh 9
g_drvpTapiDev 80c5aca8
VMMC_Open --> 80a89948 80c5aca8
i 8 VMMC_handle:80c5aca8
===>
Set PCM I/F 0 VMMC_handle:80c5b238
[31] Allocate resource 93, FreeResource = 32
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 10
[31] Allocate resource 94, FreeResource = 33
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 11
[31] Allocate resource 95, FreeResource = 34
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 12
[31] Allocate resource 96, FreeResource = 35
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 13
[31] Allocate resource 97, FreeResource = 36
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 14
[31] Allocate resource 98, FreeResource = 37
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 15
[31] Allocate resource 99, FreeResource = 38
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 16
[31] Allocate resource 100, FreeResource = 39
>>>>>>>>>>>>>>>>>>>>>>>>> OS_GetEventNumber event number 17
ifx_mps_ioctl: FIO_MPS_DOWNLOAD...
Unzipping from B01F2000 to 817A6F84 ... [ZIP 1] [ZIP 1 a75cb796] done
Uncompressed size = 642816
IFX_MPS: Download firmware (size 642816 bytes)... ifx_mps_download_firmware: fi!
ok!
Version 11.0.0.1.0 up and running...
call ifx_mps_bufman_init
.Msleep at ch#13 to collect RX=0, RSSI=-127, CRC error =6, False CCA =18
ADSL> READY
set_VoIP__reg_led_timeout clear -1 t 1361
Msleep at ch#12 to collect RX=0, RSSI=-127, CRC error =36, False CCA =296
[reset_802dot1x] wireless module ready
[reset_802dot1x] 802.1Xv2 ready
.Msleep at ch#11 to collect RX=0, RSSI=-127, CRC error =4, False CCA =523
.Msleep at ch#10 to collect RX=0, RSSI=-127, CRC error =0, False CCA =33
MPS_ready() set ifx_mps_initialising=0===>
 VMMC_Ioctl: Phone 1 IFX_TAPI_LINE_TYPE ok!
 VMMC_Ioctl: Phone 1 IFXPHONE_SET_LINEFEED ok!
 VMMC_Ioctl: Phone 1 IFX_TAPI_MAP_DATA_ADD ok!
Set PCM I/F 1 VMMC_handle:80c58628
===>
 VMMC_Ioctl: Phone 2 IFX_TAPI_LINE_TYPE ok!
 VMMC_Ioctl: Phone 2 IFXPHONE_SET_LINEFEED ok!
 VMMC_Ioctl: Phone 2 IFX_TAPI_MAP_DATA_ADD ok!
Set PCM I/F 2 VMMC_handle:80c58ba8
===>
Set PCM I/F 3 VMMC_handle:80c59128
===>
Set PCM I/F 4 VMMC_handle:80c596a8
===>
Set PCM I/F 5 VMMC_handle:80c59c28
===>
Set PCM I/F 6 VMMC_handle:80c5a1a8
===>
Set PCM I/F 7 VMMC_handle:80c5a728
===>
Set PCM I/F 8 VMMC_handle:80c5aca8
Setting HOOK Related Parameters 0
Setting HOOKFLASH_TIME min 70 ms max 310 ms
Setting HOOKON_TIME min 370 max 370
Setting HOOK Related Parameters 1
Setting HOOK Related Parameters 2
Setting HOOK Related Parameters 3
RUNTASK id=38 VINETIC_DRV_Task...
[39] Allocate mailbox 9
RUNTASK id=39 VINETIC_T38_Task...
RUNTASK id=41 FXO_flash_task...
RUNTASK id=40 VOICE_API_task...
************** Enable ProDaaCheckInterrupt() detect 4041
.Msleep at ch#9 to collect RX=0, RSSI=-127, CRC error =1, False CCA =84
.Msleep at ch#8 to collect RX=0, RSSI=-127, CRC error =0, False CCA =40
Reset Duslic High begin
Reset Duslic end
ProDAAInitialize: begin now
ProDAAInitialize: Line-Side Device Status 40
Port 2 sytem-side revision 44, line-side revision 6
init_DTMF_data: time 5866
force_daa_offhook ch 2 onoff 1 time 5866
ProDaaOffhook 0 2 onoff 1
CID_Detect CH 2 onoff 0
VMMC_IFX_TAPI_LL_SIG_CID_RX_Stop ch 2
FXO_PolState_DTMFCID --> Disable DTMF CID
force_daa_offhook ch 2 onoff 0 time 5928
ProDaaOffhook 1 2 onoff 0
CID_Detect CH 2 onoff 1
VMMC_IFX_TAPI_LL_SIG_CID_RX_Start ch 2 hookmode 0
FXO_PolState_DTMFCID --> Detect Polarity Changed Enable DTMF CID
 TEL_DRV_Init
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_StartDetVOIPHook
 TEL_DRV_StartDetDTMF
 TEL_DRV_StartDetCEDTone
 TEL_DRV_InitTone
When * the value is 60000
When * the value is 60000
sys_voip_cfg->cpt.reorder = 425@-230;20(0.24/0.24/1)
TEL_DRV_TONE_REORDER  duration = 480
. TEL_DRV_InitRing

>>>> STUN Setting <<<<
stun Enable : 0
stun Test Enable : 0
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
stun Server : "", IP : 0.0.0.0
stun Port : 3478
[31] Allocate resource 101, FreeResource = 40
[31] Allocate mailbox 10
 VOICE_DRV_SetRxDataHookFunc
 VOICE_DRV_SetRxDataHookFunc
TEL_MGR_Init
[31] Allocate resource 102, FreeResource = 41
tel_mgr_mutex=102
[31] Allocate mailbox 11
 TEL_DM_Init
[31] Allocate resource 103, FreeResource = 42
******** TEL_LOG_UpdateCallRecord: No CallRecord Update, recNum:0 !!
[31] Allocate resource 104, FreeResource = 43
 TEL_DRV_SetPhoneEvtHookFunc
 TEL_DRV_SetLineEvtHookFunc
Msleep at ch#7 to collect RX=0, RSSI=-127, CRC error =0, False CCA =23
.Msleep at ch#6 to collect RX=0, RSSI=-127, CRC error =1, False CCA =28
Msleep at ch#5 to collect RX=0, RSSI=-127, CRC error =0, False CCA =149
 TEL_MGR_VoiceChannelInit
 TEL_MGR_SetVoiceChannel 1
TEL_MGR_SetVoiceChannel: ec mode is 16ms
 TEL_MGR_SetPhoneEC
 VOICE_DRV_SetEC ch 0 mode 32
 TEL_MGR_SetPhoneVAD
 VOICE_DRV_SetVAD 0
 TEL_MGR_SetPhoneGain
 VOICE_DRV_SetGain ch 0
VMMC_IFX_TAPI_LL_ALM_Volume_Set Ch 0 TxGain 0 RxGain -7
 TEL_MGR_SetPhoneJitter
 VOICE_DRV_SetJitter
Create task ISDN_GetCCBSCFStatus 43
SIP_CALLBACK_EnableDebug
SIP_CORE_EnableDebug
SIP_CORE_Init
[31] Allocate resource 105, FreeResource = 44
[31] Allocate mailbox 12
SIP_CORE_SetSipStatus
SIP_CORE_CreateTask
>>> SIP_CORE_Task
SIP_CORE_Set_Codec_Bandwidth : Bandwidth_Control = 1
SIP_CORE_Set_Codec_Bandwidth : ADSL / VDSL
SIP_CORE_Set_Codec_Bandwidth : Codec_Bandwidth[def_fax_call] = 106
SIP_CORE_Set_Codec_Bandwidth : Codec_Bandwidth[def_g711_call] = 106
SIP_CORE_Set_Codec_Bandwidth : Codec_Bandwidth[def_g726_32_call] = 85
SIP_CORE_Set_Codec_Bandwidth : Codec_Bandwidth[def_g726_24_call] = 64
SIP_CORE_Set_Codec_Bandwidth : Codec_Bandwidth[def_g729_call] = 43
SIP_CORE_Set_Codec_Bandwidth : Codec_Bandwidth[def_g722_call] = 106
[31] Allocate resource 106, FreeResource = 45
 OK.
RUNTSK l2s3 31
RUNTSK l3l2 45
RUNTSK lll2 46
RUNTSK decrTout 47
ISDN: Q_L2S3:3, Q_L3L2:4, Q_LLL2:5
ISDN: Q_L2S3:3, Q_L3L2:4, Q_LLL2:5
Msleep at ch#3 to collect RX=0, RSSI=-127, CRC error =0, False CCA =34
Msleep at ch#2 to collect RX=0, RSSI=-127, CRC error =4, False CCA =799
Msleep at ch#1 to collect RX=0, RSSI=-127, CRC error =0, False CCA =31
Dirtyness = 0.0.0.0 - 0.0.1.1 - 2.2.11.2 - 11.2
pAd->CommonCfg.Channel = 1
rt2860_open 3
should Set up the Mac address ?????????
RT2860_WDS_Init --->
rt2860_open 4
rt2860_open 5
rt2860_open 6
ND 2 ???
Init_SSLServer> input listen_protocol=6, nListenPort=443
[17] ssld_conf_init> ssl server info:
[17] PrivateKey=
[17] MyCertificate=
[17] CaCertificate=
[17] SSL_method=31
[17] verify_mode=0
[17] cipher_suites=ALL:@STRENGTH:!kEDH
[17] tftp_server_ip=140.92.61.131
[17] fn_myCerttificate=ServCert.pem
[17] fn_privateKey=PrivKey.pem
[17] fn_caCertificate=CaCert.pem
[17] ssld_conf_init> ssl server info end:
PKCS12_PBE_add>
PKCS12_PBE_add> support RC4
PKCS12_PBE_add> support DES
PKCS12_PBE_add> support RC2
[17] pCtx=0x80c2e9ec in ssld_conf_init
ssld_ctx_reset_cert> this is pkcs12 type certificate

[17] ssld_ctx_reset_cert : re-LoadServerCertAndKey() ok!!

[17] ssld_ctx_reset_cert> re-LoadCACertificate( 1stCA ) ok!![17] ssld_conf_initk
[18] SSLClient> SSLClient() run
[18] sslc_conf_init> ssl client info:
[18] PrivateKey=
[18] MyCertificate=
[18] CaCertificate=
[18] SSL_method=31
[18] verify_mode=1
[18] cipher_suites=ALL:@STRENGTH:!kEDH
[18] tftp_server_ip=140.92.61.131
[18] fn_myCerttificate=ServCert.pem
[18] fn_privateKey=PrivKey.pem
[18] fn_caCertificate=CaCert.pem
[18] sslc_conf_init> ssl client info end:
[18] sslc_conf_init> pCtx=0x80c1cf40 in ssld_conf_init

[18] sslc_ctx_reset_cert> re-LoadCACertificate( 3rdCA ) ok!!
[18] sslc_ctx_reset_cert> re-LoadCACertificate( 2ndCA ) ok!!
[18] sslc_ctx_reset_cert> re-LoadCACertificate( 1stCA ) ok!!sslc_ctx_reset_certe

[18] sslc_ctx_reset_cert : re-LoadServerCertAndKey() ok!!
[18] sslc_conf_init> sslc_conf_init() ok
[18] SSLClient> want to bind socket for client application!
SSDP Initialization completed...
*********************************************
Wi-Fi Simple Config Application - Intel Corp.
Version: Build 2.01.1.DTM1.1, Dec 12 2008 18:48:55
*********************************************
Initializing stack...
---------in wsc init----------
----------sizeof(uint32)=4
----------sizeof(uint-long)=4
----------sizeof(uint32)=2
[PORTABLITY]:WscCreateThread--------------------
 @#*@#*@#*EAP-WSC: Entered eap_wsc_init *#@*#@*#@
WSC_WaitUserAction:wait user action:2
ScanMIH_task> DHCP ip give: 192.168.2.100 ~ 199, range: 100
[HWLAN] [36] rapi_tmr_task running
WscCmd:ActualCBThreadProc: Started

>> Parse Service 'urn:dslforum-org:service:DeviceInfo:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:DeviceConfig:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:Layer3Forwarding:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:LANConfigSecurity:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:ManagementServer:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:Time:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:UserInterface:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:X_VoIP:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:LANHostConfigManagement:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:LANEthernetInterfaceConfig:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:WLANConfiguration:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:Hosts:1' : TRUE
>> Parse Device 'urn:dslforum-org:device:LANDevice:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:WANCommonInterfaceConfig:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:WANDSLInterfaceConfig:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:WANEthernetInterfaceConfig:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:WANDSLConnectionManagement:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:WANDSLLinkConfig:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:WANEthernetLinkConfig:1' : TRUE
>> Parse Service 'urn:dslforum-org:service:WANPPPConnection:1' : TRUE
>> Parse Device 'urn:dslforum-org:device:WANConnectionDevice:1' : TRUE
>> Parse Device 'urn:dslforum-org:device:WANDevice:1' : TRUE
>> Parse Device 'urn:dslforum-org:device:InternetGatewayDevice:1' : TRUETR64::T.
[htf_dbg]     - OnlineActiveWirless() 1299
WirelessMode 9 BasicRate 15
AutochannelSelect 0 Channel 0
autoChannel : 1
NEW : channel 1, BW 1(40MHZ), EXTCHA 1(ABOVE)
stopWlanG ... start
[PORTABLITY]:WscCreateThread--------------------
 WscCmd:ActualUIThreadProc: Started.
ActualUIThreadProc: wait q
stopWlanG .. done
>>>>>>>>>>>>>>>>>>>>>>tick 12624
MasterControl constructor
WscCmd::MC instantiated ok
[PORTABLITY]:WscCreateThread--------------------
 [PORTABLITY]:pthread_mutex_init--------------------
 CTransport Construction
[PORTABLITY]:WscCreateThread--------------------
 In CTransport::ActualCBThreadProc
ActualCBThreadProc: Calling Dequeue
MC::Init: Init complete ok
WscCmd::MC intialized ok
WscCmd::Init ok, starting stack...
Info::ReadConfigFile:File open ok
******************uuid_p:0x000000000000000110000023082353ba*****
mp_deviceInfo->uuid[i]:
0-0-0-0-0-0-0-1-10-0-0-23-8-23-53-ba-
mp_deviceInfo->macAddr:00:23:08:23:53:BA
gSetting.dot1x.if_entry[0].enableWEP:0
authTypeFlags is 2 ,encrTypeFlags is 4 ,m_nwKey is SP1163BC041, key len is b
 ssid is WLAN-235316
MC::SwitchModeOn: EModeApProxyRegistrar enter
RegistrarSM constructor
[PORTABLITY]:WscCreateThread--------------------
 RegistrarSM constructor
[PORTABLITY]:WscCreateThread--------------------
 [PORTABLITY]:pthread_mutex_init--------------------
 MC::SetBeaconIE: call to trans->SetBeaconIE() ok
MC::SetProbeRespIE: call to trans->SetProbeRespIE() ok
©§©§
mp_deviceInfo->authTypeFlags:2
mp_deviceInfo->encrTypeFlags:4
*******build M1 start**********
RPROTO: BuildMessageM1_For_REG built: -2136365216 bytes
*******build M1 end**********
after InitializeSM....
in startMonitor....
CInbEap Construction
Sizeof(WSC_NOTIFY_DATA) = -2136365120
---test--sizeof(WSC_NOTIFY_DATA) = 36
[PORTABLITY]:WscCreateEvent--------------------
 Entered udp_open
Socket open successful, sd: -2136365136
Entered udp_open
Socket open successful, sd: -2136365136
Entered udp_bind
Binding successful for socket [-2136365152]
[PORTABLITY]:WscCreateThread--------------------
 In CInbEap::StaticRecvThread
CInbEap::ActualRecvThread Started
Entered udp_read
exit StartMonitor TRANSPORT_TYPE_UPNP_DEV
in startMonitor....
CInbUPnPDev Construction
Entered udp_open
Socket open successful, sd: -2136365136
Entered udp_open
Socket open successful, sd: -2136365136
Entered udp_bind
Binding successful for socket [-2136365152]
CInbUPnPDev StartMonitor
[PORTABLITY]:WscCreateThread--------------------
 exit switch_mode
MC::SwitchModeOn: Exit
MC::StartStack: Informing app of mode
In CInbUPnPDev::StaticUPnPThread
end UPnPCreateMicroStack
Entered udp_read
WscCmd::CallbackProc Enqueue done
MC::SwitchModeOn: Done callback
exit wscmain
WscCmd:ActualCBThreadProc: CB_MAIN_PUSH_MODE recd

******* MODE: AP with built-in Registrar and UPnP Proxy *******
*******p_header->eType:5
LCB_MENU_AP_PROXY_REGISTRAR
**************b_tryAgain:1

Options:
0. Quit
1. Configure Client
2. Configure Client via push-button
Enter selection:
ADSL Firmware: 2.1.5.2.1.2 ATUR >>>>>>>>>>>>>>>>>(FW: 1.07.000)
[Annex B:0x4208 0x0]
ADSL> READY
set_VoIP__reg_led_timeout clear -1 t 61476

3) nach jtag suchen
4) möglichst unkastrierte firmware eines anderen oem finden, die läuft und ata mode möglich macht

(edit) hardware infos erweitert
pic in grösser gern nach pm per mail
(edit2) todo 1 & 2 fertig

scolopender · 10 Jan 2010

byteeater schrieb:
bootloader lässt sich mit bischen geschick durch drücken der reset-taste und DANN erst strom einschalten...

Das ist nicht der Bootloader, das ist die Recovery-Funktion.

byteeater schrieb:
1) serielle konsole finden

Halte Ausschau nach einem Pfostenstecker mit 10 Pins (5 Paare). Dann geht es weiter wie beim W700V.

byteeater schrieb:
2) bootlog erstellen

Ja - das Teil schreibt dann (der Anfang):

Code:

ROM VER: 1.0.3
CFG 01
Read EEPROMX
X
=======================================================================
Wireless ADSL Gateway DANUBE Loader v1.03.04 build May 15 2008 20:57:30
Arcadyan Technology Corporation
=======================================================================
MXIC MX29LV320ABTC bottom boot 16-bit mode found
Copying boot params.....DONE
Press Space Bar 3 times to enter command mode ...123
Please Enter Password:
Flash Checking Passed.
Unzipping firmware at 0x80002000 ... with AREA[2] [ZIP 3] [ZIP Extra] [ZIP 1] done
Ready to run firmware
In c_entry() function ...
...

byteeater schrieb:
3) nach jtag suchen

Halte Ausschau nach Lötaugen für einem Pfostenstecker mit 14 Pins (7 Paare). Das W700V hat das auch, funktioniert aber nicht richtig. Die erforderliche JTAG-Beschreibung für den Lantiq DANUBE gibt's auch nicht.

byteeater schrieb:
4) möglichst unkastrierte firmware eines anderen oem finden, die läuft und ata mode möglich macht

Kannst Du schlichtweg vergessen. Man kann nicht einmal die Original-FW analysieren geschweige denn modifizieren - die ist unbekannt ("ZIP Extra") verschlüsselt.

G., -#####o:

byteeater · 10 Jan 2010

die stellen für die ser hab ich lange gesehen. fragt sich atm nur noch wo rx tx und wiewiel bps.

für den sx541 auch nen arcadyan produkt, hat sich nach bischen suchen die smc 7908vowbrb firmware gefunden, die prima auf der hütte rennt....

scolopender · 10 Jan 2010

byteeater schrieb:
die stellen für die ser hab ich lange gesehen. fragt sich atm nur noch wo rx tx und wiewiel bps.

Sag ich doch: wie beim W700V. Pin 1 hat eine Markierung und ein rechteckiges Lötauge.

byteeater schrieb:
für den sx541 auch nen arcadyan produkt, hat sich nach bischen suchen die smc 7908vowbrb firmware gefunden...

Für das W700V hat sich nach heftiger Suche die Firmware von der Easybox A600 gefunden, die nur dann auf dem W700V läuft, wenn auch der Bootloader ersetzt wird...
Bisher habe ich noch kein mit dem W303V-A vergleichbares Gerät (Prozessor, WLAN, Anschlüsse, Leuchtanzeigen ...) gesehen.

G., -#####o:

stanleys · 14 Jan 2010

FW Version 1.09 ist seit 13.01.2010 verfügbar leider noch ohne Beschreibung der FW-Änderungen.

http://kuerzer.de/303v

byteeater · 18 Jan 2010

nu iss da!
aber was tolles ist nicht drinn.

Andi_84 · 22 Feb 2010

byteeater schrieb:
...
ist nen arcadyan avr7526PW laut label auf dem print,

Bist du dir sicher, dass es nicht ARV7526 heißt?
Auf der Website von Arcadyan (Products -> ISP/Telco) heißen nämlich alle ADSL IAD's "ARVxxxx". Einen ARV7526 habe ich allerdings weder dort, noch im Produktkatalog finden können.

Zur CPU: Nachdem ja schon der Begriff "Lantiq DANUBE" gefallen ist:
Entweder ist es ein PSB 50702 "XWAY™ DANUBE"
"Single-chip solution for ADSL2/2+ with integrated 2-Channel Analog CODEC for IADs and Home Gateways"

oder ein PSB 50712 "XWAY™ DANUBE-S"
"ADSL2/2+ single-chip solution with integrated 2-Ch. AnalogCODEC with add. HW support for IPSec"

Ein pdf mit knappen Infos über diese Chips gibt's hier.

Zum WLAN:
Die verfügbaren Infos auf der Ralink-Website sind ebenfalls spärlich. Es gibt ein 1-seitiges pdf mit den wichtigsten Daten des Chips.

VG,
Andi

byteeater · 24 Feb 2010

Andi_84 schrieb:
Bist du dir sicher, dass es nicht ARV7526 heißt?

Da hat meine Legasthenie gnadelos zugeschlagen. Na klar hast Du recht. Habs verbessert.
Thxs für die weiteren Infos.

byteeater · 3 Apr 2010

https://dev.openwrt.org/browser/trunk/package/uboot-lantiq

Da tut sich was...

Code:

config UBOOT_TARGET
	        string "target"
	        default "easy50712_DDR166M"
	        depends on PACKAGE_uboot-lantiq
	        help
	          The configuration reflects the settings for a dedicated board hardware.
	          Select for Danube evaluation board easy50712_DDR166M .

Zwar wohl nur erstmal nen Evaluation Board des Danube, aber ich geb die Hoffnung nicht auf.

(edit)
Mein 303 ist auf dem Weg zu Blogic.
Mit ein wenig Geduld gibt es bald Openwrt. Voip Support sollte dann kurz nach Ende des Google Summer of Code Projekts von blogic hoffentlich auch da sein.
Stay tuned!

Andi_84 · 4 Jun 2010

Firmware des W303V Tpy A zerlegen und analysieren

Für diejenigen, die die Firmware des W303V Typ A in ihre Bestandteile zerlegen und analysieren wollen:
Ich habe ein kleines Tool geschrieben, das Arcadyan Firmware-Files (für W303V Typ A und W722V Typ B) "entschlüsseln" kann, so dass das dabei entstehende File mit dem Tool SP700EX in seine Bestandteile zerlegt werden kann.

Weitere Infos und Download des Tools ~~siehe hier.~~
EDIT
Neue Version, siehe hier.
/EDIT

VG,
Andi

Andi_84 · 8 Jun 2010

Neues in Punkto "Firmware zerlegen":
Mein Tool kann jetzt auch den Part 1 (Operating System) der FW entschlüsseln (sowohl beim W303 als auch beim W722).
Danke an scolopender für viele nützliche Hinweise.

Nur Part 2 (Web-Interface) kann das Tool noch nicht entschlüsseln. Da arbeite ich noch dran.
(Die Parts 3, 4 und 5 konnten auch schon mit der letzten Version entschlüsselt werden.)

Weiterhin wird bei lzma und komprimierten bin-Parts jetzt auch die Größe der dekomprimierten Datei (aus dem lzma-Header) ausgegeben.

Alle lzma und bin-Parts, die entschlüsselt werden konnten, werden - sofern lzma.exe im gleichen Verzeichnis vorhanden ist - auch gleich mit lzma.exe entpackt.

Download der neuen Version hier.

Ausgaben des Tools beim Entschlüsseln und "Zerlegen" der aktuellen FW für den W303V Typ A:

Code:

E:\DSL_Debug\Arcadyan_FW>arcadyan_dec fw_speedportW303_TypA_v_1.09.000.bin
-------------------------------------------------------------------------------
    Arcadyan firmware decrpytion utility v0.18 ** For personal use only **
             ® 2010 by Andi_84 ++ Special thanks to scolopender ++
              ** This tool comes with absolutely no warranty! **
-------------------------------------------------------------------------------
Opened firmware file fw_speedportW303_TypA_v_1.09.000.bin, size: 2129940 Bytes.
Reading firmware file ... Finished, 2129940 Bytes read.
Decrypting firmware file ... Finished, got 2129930 Bytes.
Writing decrypted firmware to output file fw_speedportW303_TypA_v_1.09.000_decrypted.bin ... Finished, 2129930 Bytes written.
Extracting parts ...

 Part 1: 0x00000000 ... 0x0013AFFF
  Size: 1290240 Bytes (0x0013B000)
  Format: bin (compressed)
  File size: 1290220 Bytes (0x0013AFEC) -> OK.
  CRC: 9674892A -> OK.
  Decrypting bin part ... Finished, got 1290212 Bytes.
  Uncompressed size: 5906144 Bytes
 Writing firmware part to output file fw_speedportW303_TypA_v_1.09.000-1.lzma ... Finished, 1290212 Bytes written.
 Uncompressing file using lzma.exe ...
lzma.exe d fw_speedportW303_TypA_v_1.09.000-1.lzma fw_speedportW303_TypA_v_1.09.000-1.bin

LZMA 4.65 : Igor Pavlov : Public domain : 2009-02-03
 Finished.

 Part 2: 0x0013B000 ... 0x0017D3FF
  Size: 271360 Bytes (0x00042400)
  Format: bin (compressed)
  File size: 271340 Bytes (0x000423EC) -> OK.
  CRC: FFB98A51 -> OK.
 Writing firmware part to output file fw_speedportW303_TypA_v_1.09.000-2.lzma ... Finished, 271340 Bytes written.

 Part 3: 0x0017D400 ... 0x001A1FFF
  Size: 150528 Bytes (0x00024C00)
  Format: lzma
  File size: 150508 Bytes (0x00024BEC) -> OK.
  CRC: D71DA665 -> OK.
  Uncompressed size: 303432 Bytes
 Writing firmware part to output file fw_speedportW303_TypA_v_1.09.000-3.lzma ... Finished, 150508 Bytes written.
 Uncompressing file using lzma.exe ...
lzma.exe d fw_speedportW303_TypA_v_1.09.000-3.lzma fw_speedportW303_TypA_v_1.09.000-3.bin

LZMA 4.65 : Igor Pavlov : Public domain : 2009-02-03
 Finished.

 Part 4: 0x001A2000 ... 0x00207FFF
  Size: 417792 Bytes (0x00066000)
  Format: lzma
  File size: 417772 Bytes (0x00065FEC) -> OK.
  CRC: 9EA58D71 -> OK.
  Uncompressed size: 642816 Bytes
 Writing firmware part to output file fw_speedportW303_TypA_v_1.09.000-4.lzma ... Finished, 417772 Bytes written.
 Uncompressing file using lzma.exe ...
lzma.exe d fw_speedportW303_TypA_v_1.09.000-4.lzma fw_speedportW303_TypA_v_1.09.000-4.bin

LZMA 4.65 : Igor Pavlov : Public domain : 2009-02-03
 Finished.

 Part 5: 0x00208000 ... 0x00208009
  Size: 10 Bytes (0x0000000A)
  Format: bin
 Writing firmware part to output file fw_speedportW303_TypA_v_1.09.000-5.bin ... Finished, 10 Bytes written.

Finished extracting, found 5 parts

VG,
Andi

ksawery46 · 21 Sep 2011

Vielen Dank für die Firmware dafür ist nicht eine komplette Auspacken.
Aber dass 50% der Erfolg, wenn man nicht packen?
Spp w303v Typ A hat eine PSB 50702-Prozessor und Firmware ADSL-Modem-Code-Version: 2.1.5.12.0.2. Annex B.
Ich brauche Annnex A und dies bedeutet, dass Sie den Treiber für das ADSL-Modem-Code-Version ändern müssen: 2.2.0.9.1.1 Annnex A.
und Änderungen in Teilen der Nr. 2 bei den Möglichkeiten für die Einstellung des APS: VPI, VCI, VC Mux, PPPoA.
Ist jemand in der Lage, das zu tun?
wenn jemand weiß, wie man für Spp w303v typ A - Firmware-Pack?

Languages

Suche

Languages

Suche

Speedport W303V A ( Arcadyan ) Info's

byteeater

Neuer User

Anhänge

scolopender

Aktives Mitglied

byteeater

Neuer User

scolopender

Aktives Mitglied

stanleys

Neuer User

byteeater

Neuer User

Andi_84

Aktives Mitglied

byteeater

Neuer User

byteeater

Neuer User

Andi_84

Aktives Mitglied

Anhänge

Andi_84

Aktives Mitglied

ksawery46

Neuer User

Zurzeit aktive Besucher

Neueste Beiträge

Statistik des Forums