WRC-X3200GST3-Bのジャンクを買ってみた

 ELECOMのWRC-X3200GST3-Bのジャンクが安かったので買ってみた。電源がはいらないらしい。電源回路か、OpenWRTを焼いてミスったかわからなかったけどとりあえず開けてみる。

ピンヘッダがもうすでにハンダされていたので(GNDが芋ハンダになってたけど)シリアルに繋いで起動すると(baudrateは115200)

F0: 102B 0000
F6: 3800 00A0
F3: 1006 0037
F3: 4000 00E0
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F6: 3800 00A0
F3: 4000 00E0
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 057C [000F]
System halt!

という表示が出てLEDすら光らない。おそらくSPI Flash(W25N01GVZEIG)の中身がうまく読み込めてなさそう。

このSPI Flash、SLCな上に1Gbit(128MB)という意外と高級なのが載ってる。もはやこのSPI Flashだけでもとが取れていそう。そのままLuckFoxとかで使えそう。

SPI Flash自体は基板の反対側に載ってるんだけど、いろんなFlashメモリが使えるようにパターンが存在していて、表面のSOP8のパッドにハンダした形跡があった。ここからFlashメモリをリカバリしようとしていたのかな？

とりあえずmtk_uartbootを使ってリカバリできるか試してみることに。

シリアルコンソールを繋いだまま、ルーターの電源を切って

./mtk_uartboot.exe -s COM4 --aarch64 -p bl2-mt7622-1ddr-ram.bin -f openwrt-25.12.5-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip

とコマンドを打ったらルーターを起動する。

mtk_uartboot - 0.1.1
Using serial port: COM4
Handshake...
hw code: 0x7622
hw sub code: 0x8a00
hw ver: 0xcb00
sw ver: 0x100
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0xfcf1
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0   (release):v2.10.0-mtk
NOTICE:  BL2: Built : 13:17:01, Mar  1 2024
NOTICE:  WDT: Cold boot
NOTICE:  CPU: MT7622
NOTICE:  WDT: disabled
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0xfdcd4 @ 0x40400000 ...
==================================

fipファイルがWRC-X3200GST3用のがなかったのでとりあえずE8450ので起動。
これであとはまたシリアルコンソールのツールに戻って、MAC addressがないとかエラーが出るのでCtrl+Cを連打してとめる。

MT7622> <INTERRUPT>
MT7622> 
MT7622> nand read 0x46000000 0x0 0x8000000
'spi-nand0' is now active device
Reading from 0x0 to 0x7ffffff, size 0x8000000 ...
SPI-NAND: ECC: 1 bitflip corrected in page 0 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 1 sect 0
SPI-NAND: NFI calibration failed. Original sample delay: 0x28
SPI-NAND: ECC: 1 bitflip corrected in page 62 sect 0
SPI-NAND: ECC: 1 bitflip corrected in page 63 sect 0
SPI-NAND: ECC: 1 bitflip corrected in page 64 sect 0
SPI-NAND: ECC: 2 bitflips corrected in page 65 sect 0
SPI-NAND: ECC: 1 bitflip corrected in page 66 sect 0
SPI-NAND: ECC: 3 bitflips corrected in page 67 sect 0
SPI-NAND: ECC: 4 bitflips corrected in page 68 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 69 sect 0
SPI-NAND: NFI calibration failed. Original sample delay: 0x28
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 70 sect 0
SPI-NAND: NFI calibration failed. Original sample delay: 0x28
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 71 sect 0
SPI-NAND: NFI calibration failed. Original sample delay: 0x28
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: ECC: Uncorrectable bitflips in page 72 sect 0
SPI-NAND: NFI calibration failed. Original sample delay: 0x28
Succeeded
MT7622> 
MT7622> 

そんもってNANDフラッシュをRAMに読み込んで転送しようとしたらtftpのコマンドがなかったのでmd.bコマンドをつかってPythonツールを作ってちまちま読み込んでみた。#UBIが先頭に入っていて、ファイルの中間にも同じのが入っていてあとは00とFFで埋まってる…

これFlashメモリが死んでる？

このままOpenWRTを起動させてみる。

setenv ethaddr 00:11:22:33:44:55
setenv eth1addr 00:11:22:33:44:56
setenv serverip 192.168.1.254
setenv ipaddr 192.168.1.1
tftpboot 0x4A000000 elecom_wrc-x3200gst3-initramfs-kernel.bin
bootm 0x4A000000

PCのIPを192.168.1.254にしてTFTPサーバを起動させて、initramfs用のカーネルを読み込んで起動してみた。

RAM上で起動はできた。普通にLANのLEDも点滅してるし…

フラッシュメモリ生きてるかどうか確認しないと。

今度一旦剥がしてみるか…