ELECOMのWRC-X3200GST3-Bのジャンクが安かったので買ってみた。電源がはいらないらしい。電源回路か、OpenWRTを焼いてミスったかわからなかったけどとりあえず開けてみる。
ピンヘッダがもうすでにハンダされていたので(GNDが芋ハンダになってたけど)シリアルに繋いで起動すると(baudrateは115200)
F0: 102B 0000 F6: 3800 00A0 F3: 1006 0037 F3: 4000 00E0 F5: 480A 0031 F5: 480A 0031 00: 1005 0000 F6: 3800 00A0 F3: 4000 00E0 F5: 480A 0031 F5: 480A 0031 01: 102A 0001 02: 1005 0000 BP: 0000 00C0 [0001] T0: 0000 057C [000F] System halt!
という表示が出てLEDすら光らない。おそらくSPI Flash(W25N01GVZEIG)の中身がうまく読み込めてなさそう。
このSPI Flash、SLCな上に1Gbit(128MB)という意外と高級なのが載ってる。もはやこのSPI Flashだけでもとが取れていそう。そのままLuckFoxとかで使えそう。
SPI Flash自体は基板の反対側に載ってるんだけど、いろんなFlashメモリが使えるようにパターンが存在していて、表面のSOP8のパッドにハンダした形跡があった。ここからFlashメモリをリカバリしようとしていたのかな？
とりあえずmtk_uartbootを使ってリカバリできるか試してみることに。
シリアルコンソールを繋いだまま、ルーターの電源を切って
./mtk_uartboot.exe -s COM4 --aarch64 -p bl2-mt7622-1ddr-ram.bin -f openwrt-25.12.5-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
とコマンドを打ったらルーターを起動する。
mtk_uartboot - 0.1.1 Using serial port: COM4 Handshake... hw code: 0x7622 hw sub code: 0x8a00 hw ver: 0xcb00 sw ver: 0x100 Baud rate set to 460800 sending payload to 0x201000... Checksum: 0xfcf1 Setting baudrate back to 115200 Jumping to 0x201000 in aarch64... Waiting for BL2. Message below: ================================== NOTICE: BL2: v2.10.0 (release):v2.10.0-mtk NOTICE: BL2: Built : 13:17:01, Mar 1 2024 NOTICE: WDT: Cold boot NOTICE: CPU: MT7622 NOTICE: WDT: disabled NOTICE: Starting UART download handshake ... ================================== BL2 UART DL version: 0x10 Baudrate set to: 921600 FIP sent. ================================== NOTICE: Received FIP 0xfdcd4 @ 0x40400000 ... ==================================
fipファイルがWRC-X3200GST3用のがなかったのでとりあえずE8450ので起動。
これであとはまたシリアルコンソールのツールに戻って、MAC addressがないとかエラーが出るのでCtrl+Cを連打してとめる。
MT7622> <INTERRUPT> MT7622> MT7622> nand read 0x46000000 0x0 0x8000000 'spi-nand0' is now active device Reading from 0x0 to 0x7ffffff, size 0x8000000 ... SPI-NAND: ECC: 1 bitflip corrected in page 0 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0 SPI-NAND: NFI calibration failed. Original sample delay: 0x28 SPI-NAND: ECC: 1 bitflip corrected in page 62 sect 0 SPI-NAND: ECC: 1 bitflip corrected in page 63 sect 0 SPI-NAND: ECC: 1 bitflip corrected in page 64 sect 0 SPI-NAND: ECC: 2 bitflips corrected in page 65 sect 0 SPI-NAND: ECC: 1 bitflip corrected in page 66 sect 0 SPI-NAND: ECC: 3 bitflips corrected in page 67 sect 0 SPI-NAND: ECC: 4 bitflips corrected in page 68 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0 SPI-NAND: NFI calibration failed. Original sample delay: 0x28 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0 SPI-NAND: NFI calibration failed. Original sample delay: 0x28 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0 SPI-NAND: NFI calibration failed. Original sample delay: 0x28 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0 SPI-NAND: NFI calibration failed. Original sample delay: 0x28 Succeeded MT7622> MT7622>
そんもってNANDフラッシュをRAMに読み込んで転送しようとしたらtftpのコマンドがなかったのでmd.bコマンドをつかってPythonツールを作ってちまちま読み込んでみた。#UBIが先頭に入っていて、ファイルの中間にも同じのが入っていてあとは00とFFで埋まってる…
これFlashメモリが死んでる？
このままOpenWRTを起動させてみる。
setenv ethaddr 00:11:22:33:44:55 setenv eth1addr 00:11:22:33:44:56 setenv serverip 192.168.1.254 setenv ipaddr 192.168.1.1 tftpboot 0x4A000000 elecom_wrc-x3200gst3-initramfs-kernel.bin bootm 0x4A000000
PCのIPを192.168.1.254にしてTFTPサーバを起動させて、initramfs用のカーネルを読み込んで起動してみた。
フラッシュメモリ生きてるかどうか確認しないと。
今度一旦剥がしてみるか…
