智达康ZN-7200-C 拆解和TTL刷回原厂固件

vic***

刷机在二楼

原机U-boot和ART。

U-boot和ART备份下载 http://www.vdisk.cn/down/index/19506832

固件下载（2楼下载链接已失效）：
http://www.vdisk.cn/down/index/19506831

1. File: E:\Router\ZN-7200-C\Firmware\ZN-7200-C_F2.0.90(ZDC)6_LN1_20131218.img
   
2. Size: 5871084 bytes
   
3. Modified: 2015年6月9日, 9:21:25
   
4. MD5: EB35306560E3C4FBEBDDEA80D587FA78
   
5. SHA1: 0FDBC928886D2FBF529CEE11EB257880187B067B
   
6. CRC32: A793D22A
   
7. 
   
8. File: E:\Router\ZN-7200-C\Firmware\zn7200c_factory.img
   
9. Size: 3567451 bytes
   
10. Modified: 2014年12月2日, 14:11:46
    
11. MD5: BFBFBFEFDD92DC7077FB0808EA480240
    
12. SHA1: F6596CB7B3AEF9B37EB2A0D8F6895881ECC2FB6B
    
13. CRC32: 7A6F9C38
    
14. 
    
15. File: E:\Router\ZN-7200-C\Firmware\1ZN_7200_C.img
    
16. Size: 5560426 bytes
    
17. Modified: 2014年12月2日, 14:12:01
    
18. MD5: 59AC161EB4F6C7A3783182557F3C67C1
    
19. SHA1: 36DE63B05CE2C71E137EC45756A77E3AB65726C4
    
20. CRC32: 83F00FF3
    
21. 
    
22. File: E:\Router\ZN-7200-C\Firmware\2-ap内部中文版本（密）.img
    
23. Size: 6702376 bytes
    
24. Modified: 2014年12月2日, 14:12:09
    
25. MD5: 5600AA2CF341BF36BF5B37A79A571359
    
26. SHA1: E12C07C4E674E3086FA65A3DFBC7B72A82BD466A
    
27. CRC32: 957F5E92
    
28. 
    
29. File: E:\Router\ZN-7200-C\Firmware\ap.img
    
30. Size: 5805620 bytes
    
31. Modified: 2014年12月2日, 14:12:13
    
32. MD5: B0F4464E592CD8228E9FB05E8ADCBC4E
    
33. SHA1: F27B064717D547DB4C772EB7A15B92618B561E4B
    
34. CRC32: BAEE6B76
    
35. 
    
36. File: E:\Router\ZN-7200-C\mtd\u-boot.bin
    
37. Size: 262144 bytes
    
38. Modified: 2015年6月6日, 3:58:35
    
39. MD5: B347E3485EB4E287E87F2EE0784F7111
    
40. SHA1: 18D4F1DB4D1B00950803C3B329C42D7C93977064
    
41. CRC32: C1FE7679
    
42. 
    
43. File: E:\Router\ZN-7200-C\mtd\art.bin
    
44. Size: 65536 bytes
    
45. Modified: 2015年6月6日, 3:59:05
    
46. MD5: AB05E8A858B0A29ACAB54AAECECB4255
    
47. SHA1: FC10C5AF74121BBE49572AE164FC04060FCCBDBD
    
48. CRC32: E2F166BB
    
49. 
    
50. 
    

复制代码

坛友的讨论和拆解
https://www.right.com.cn/forum/thread-115397-1-1.html
https://www.right.com.cn/forum/thread-115112-1-1.html

http://www.zcom.com.cn/产--品/运营商产品系列/无线客户端系列/ZN-7200-C

拆解：

POE 12V/1A（15V/0.8A）供电



AR7420+AR9285



AR9285+SiGe 2576L*2


内置8DB天线



功放下的散热


双功放右上角是JP1

vic***

1、TTL接法：

假如没有输出，将RX/TX互换。
防止图片消失，留下文字版本

+++RG
++T++

PS: R=RXD、T=TXD、G=GND

刷机正式开始
1、下载tftpd软件 (http://tftpd32.jounin.net)，下载下面的固件等。

1. 我收集到的固件如下：
   
2. http://pan.baidu.com/s/1bnD8oKB      提取码pxrn
   
3. 固件地址，里面有4个固件
   
4. 其中有三个是web升级，另一个用TFTT升级
   
5. 如果升级带AP的那个固件，得先刷带ap的那个，然后再刷2ap的那个，就可以了，web升级
   
6. 来自：wandyblues http://forum.anywlan.com/thread-342549-1-1.html
   
7. 
   
8. 链接: http://pan.baidu.com/s/1qW9ihLq 密码: hu77
   
9. 20131218是原厂接收固件
   
10. 来自 鬼影 http://bbs.mydigit.cn/read.php?tid=1260428&ds=1&page=4#40554702
    

复制代码

2、接入TTL，超级终端或者putty打开TTL串口115200

3、TTL输入printenv，查看输出的serverip=192.168.0.xx，使用网线把电脑和路由器的相连，手动设置电脑IP为serverip:192.168.0.xx

3、使用附件中的ap.img，放入tftpd32文件夹内，打开tftpd32，点击tftpd32->ShowDir确认弹出窗口中有你放入的文件ap.img。找不到请收到Browse找到ap.img的文件夹。

4、路由器开机，出现“Hit any key to stop autoboot:  3”。按任意键中断启动

输入upgrade。等待“firmware download ok”后重启

升级过程：
注意刷ART过程中，曾经死机卡住了，但是重启后会出现自动升级成功提示。
upgrade会自动升级三个文件：ap91fus-art.bin、config.bin、ap.img

1. U-Boot 1.0.6(ZN_7200_C)1 (Feb 24 2012 - 15:33:26)
   
2. 
   
3. AP91 (ar7240) U-boot
   
4. DRAM:
   
5. sri
   
6. #### TAP VALUE 1 = 9, 2 = a
   
7. 32 MB
   
8. id read 0x100000ff
   
9. flash size 8MB, sector count = 128
   
10. In:    serial
    
11. Out:   serial
    
12. Err:   serial
    
13. Net:   ag7240_enet_initialize...
    
14. Fetching MAC Address from 0x81fed350
    
15. : cfg1 0xf cfg2 0x7014
    
16. eth0: 00:03:7f:e0:00:4d
    
17. eth0 up
    
18. eth0
    
19. Hit any key to stop autoboot:  0
    
20. uboot> upgrade
    
21. GPIO OE      : 0002ecfe
    
22. GPIO IN      : 00001607
    
23. GPIO OUT     : 0000e427
    
24. GPIO SET     : 0000e027
    
25. GPIO CLR     : 0000e427
    
26. GPIO INT_EN  : 00000000
    
27. GPIO INT_TYPE: 00000000
    
28. GPIO INT_POL : 00000000
    
29. GPIO INT_PEN : 00000000
    
30. GPIO INT_MASK: 00000000
    
31. GPIO FUNC    : 00048082
    
32. RESET button is pressed.(download ART)
    
33. Un-Protected 1 sectors
    
34. Erasing Flash...
    
35. First 0x4 last 0x4 sector size 0x10000                                         4
    
36. Erased 1 sectors
    
37. Writing to Flash... write addr: 9f040000
    
38. done
    
39. Protected 1 sectors
    
40. dup 1 speed 100
    
41. Using eth0 device
    
42. TFTP from server 192.168.0.36; our IP address is 192.168.0.35
    
43. Filename 'ap91fus-art.bin'.
    
44. Load address: 0x8005fffc
    
45. Loading: #############
    
46. done
    
47. Bytes transferred = 65536 (10000 hex)
    
48. 
    
49. Run RAM art, Entry is 0xe07f0300 ......
    
50. 
    
51. 机器死了，拔电重启
    
52. 
    
53. U-Boot 1.0.6(ZN_7200_C)1 (Feb 24 2012 - 15:33:26)
    
54. 
    
55. AP91 (ar7240) U-boot
    
56. DRAM:
    
57. sri
    
58. #### TAP VALUE 1 = 9, 2 = a
    
59. 32 MB
    
60. id read 0x100000ff
    
61. flash size 8MB, sector count = 128
    
62. In:    serial
    
63. Out:   serial
    
64. Err:   serial
    
65. Net:   ag7240_enet_initialize...
    
66. Fetching MAC Address from 0x81fed350
    
67. : cfg1 0xf cfg2 0x7014
    
68. eth0: 00:03:7f:e0:00:4d
    
69. eth0 up
    
70. eth0
    
71. Hit any key to stop autoboot:  0
    
72. uboot> upgrade
    
73. GPIO OE      : 0002ecfe
    
74. GPIO IN      : 00001607
    
75. GPIO OUT     : 0000e427
    
76. GPIO SET     : 0000e027
    
77. GPIO CLR     : 0000e427
    
78. GPIO INT_EN  : 00000000
    
79. GPIO INT_TYPE: 00000000
    
80. GPIO INT_POL : 00000000
    
81. GPIO INT_PEN : 00000000
    
82. GPIO INT_MASK: 00000000
    
83. GPIO FUNC    : 00048082
    
84. RESET button is pressed.(download ART)
    
85. Un-Protected 1 sectors
    
86. Erasing Flash...
    
87. First 0x4 last 0x4 sector size 0x10000                                         4
    
88. Erased 1 sectors
    
89. Writing to Flash... write addr: 9f040000
    
90. done
    
91. Protected 1 sectors
    
92. dup 1 speed 100
    
93. Using eth0 device
    
94. TFTP from server 192.168.0.36; our IP address is 192.168.0.35
    
95. Filename 'ap91fus-art.bin'.
    
96. Load address: 0x8005fffc
    
97. Loading: #############
    
98. done
    
99. Bytes transferred = 65536 (10000 hex)
    
100. 
     
101. Run RAM art, Entry is 0xe07f0300 ......
     
102. eth0 up
     
103. eth0
     
104. Hit any key to stop autoboot:  0
     
105. uboot>
     
106. uboot>
     
107. uboot> upgrade
     
108. GPIO OE      : 0002ecfe
     
109. GPIO IN      : 00001607
     
110. GPIO OUT     : 0000e427
     
111. GPIO SET     : 0000e427
     
112. GPIO CLR     : 0000e427
     
113. GPIO INT_EN  : 00000000
     
114. GPIO INT_TYPE: 00000000
     
115. GPIO INT_POL : 00000000
     
116. GPIO INT_PEN : 00000000
     
117. GPIO INT_MASK: 00000000
     
118. GPIO FUNC    : 00048082
     
119. RESET button is pressed.(download ART)
     
120. Un-Protected 1 sectors
     
121. Erasing Flash...
     
122. First 0x4 last 0x4 sector size 0x10000                                         4
     
123. Erased 1 sectors
     
124. Writing to Flash... write addr: 9f040000
     
125. done
     
126. Protected 1 sectors
     
127. dup 1 speed 100
     
128. Using eth0 device
     
129. TFTP from server 192.168.0.36; our IP address is 192.168.0.35
     
130. Filename 'ap91fus-art.bin'.
     
131. Load address: 0x8005fffc
     
132. Loading: *
     
133. TFTP error: 'File not found' (1)
     
134. download ap91fus-art.bin fail!
     
135. Using eth0 device
     
136. TFTP from server 192.168.0.36; our IP address is 192.168.0.35
     
137. Filename 'config.bin'.
     
138. Load address: 0x82100000
     
139. Loading: #############
     
140. done
     
141. Bytes transferred = 65536 (10000 hex)
     
142. Using eth0 device
     
143. TFTP from server 192.168.0.36; our IP address is 192.168.0.35
     
144. Filename 'ap.img'.
     
145. Load address: 0x82100000
     
146. Loading: #################################################################
     
147.          #################################################################
     
148.          #################################################################
     
149.          #################################################################
     
150.          #################################################################
     
151.          #################################################################
     
152.          #################################################################
     
153.          #################################################################
     
154.          #################################################################
     
155.          #################################################################
     
156.          #################################################################
     
157.          #################################################################
     
158.          #################################################################
     
159.          #################################################################
     
160.          #################################################################
     
161.          #################################################################
     
162.          #################################################################
     
163.          ##########################################
     
164. done
     
165. Bytes transferred = 5871084 (5995ec hex)
     
166. firmware check pass
     
167. 
     
168. First 0x66 last 0x75 sector size 0x10000                                     117
     
169. Erased 16 sectors
     
170. Copy to Flash... write addr: 9f660000
     
171. done
     
172. 
     
173. First 0x5 last 0x65 sector size 0x10000                                      101
     
174. Erased 97 sectors
     
175. Copy to Flash... write addr: 9f050000
     
176. done
     
177. 
     
178. First 0x7d last 0x7d sector size 0x10000                                     125
     
179. Erased 1 sectors
     
180. firmware download ok
     
181. uboot>
     
182. 
     

复制代码

那个***

我刷了uboot和breed都不支持原厂固件   刷dd和ubnt后网口变成wan   又刷成智达康了

vic***

小茅 发表于 2015-6-10 15:43
你这是sop16的闪存，夹子一般都是针对SOP8的，所以可能不行，而且烧录夹还是要用到编程器。TTL的话你可以看 ...

对的，我已经找到那个16针的夹子了(应该能用)。
主要问题还是电路能不能不拆芯片刷！

那个***

ttl没看到  要刷的话估计得上编程器     如果能找到对应的dd固件可以直刷其他固件

vic***

那个男人 发表于 2015-6-10 17:35
ttl没看到  要刷的话估计得上编程器     如果能找到对应的dd固件可以直刷其他固件

这个路由只有一个10针的JP1，在天线边上，而且使用至少三层板，看不到TTL走线！

vic***

TTL定义为86、87脚（芯片右侧从上往下的第10、11脚）。
此路由打了个洞，从中间那层板子走线。

from:https://www.right.com.cn/forum/thread-75141-1-1.html






TTL启动记录

1. 
   
2. / # reboot
   
3. starting pid 862, tty '': '/bin/umount /proc'
   
4. umount: can't umount /proc: Device or resource busy
   
5. starting pid 863, tty '': '/bin/umount /dev/pts'
   
6. starting pid 864, tty '': '/bin/umount /tmp'
   
7. umount: can't umount /tmp: Device or resource busy
   
8. starting pid 865, tty '': '/bin/synczcomWdgIoctl: Disabled Watchdog.
   
9. '
   
10. The system is going down NOW!
    
11. Sent SIGTERM to all processes
    
12. Sent SIGKILL toRestarting system.
    
13. 
    
14. 
    
15. U-Boot 1.0.6(ZN_7200_C)1 (Feb 24 2012 - 15:33:26)
    
16. 
    
17. AP91 (ar7240) U-boot
    
18. DRAM:
    
19. sri
    
20. #### TAP VALUE 1 = 9, 2 = a
    
21. 32 MB
    
22. id read 0x100000ff
    
23. flash size 8MB, sector count = 128
    
24. In:    serial
    
25. Out:   serial
    
26. Err:   serial
    
27. Net:   ag7240_enet_initialize...
    
28. Fetching MAC Address from 0x81fed350
    
29. : cfg1 0xf cfg2 0x7014
    
30. eth0: 00:03:7f:e0:00:4d
    
31. eth0 up
    
32. eth0
    
33. Hit any key to stop autoboot:  0
    
34. ## Booting image at 9f660000 ...
    
35.    Image Name:   Linux Kernel Image
    
36.    Created:      2013-12-18   2:39:33 UTC
    
37.    Image Type:   MIPS Linux Kernel Image (lzma compressed)
    
38.    Data Size:    890212 Bytes = 869.3 kB
    
39.    Load Address: 80002000
    
40.    Entry Point:  801c3550
    
41.    Verifying Checksum ... OK
    
42.    Uncompressing Kernel Image ... OK
    
43. 
    
44. Starting kernel ...
    
45. 
    
46. Booting AR7240(Python)...
    
47. Linux version 2.6.31--LSDK-9.2.0_U10.5.13_ZOS Modify-svn552 (allen@s3.local) (gcc version 4.3.3 (GCC) ) #1 Tue Dec 17 11:09:25 CST 2013
    
48. flash_size passed from bootloader = 8
    
49. arg 1: console=ttyS0,115200
    
50. arg 2: root=31:02
    
51. arg 3: rootfstype=jffs2
    
52. arg 4: init=/sbin/init
    
53. arg 5: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configure),64k(mfg),64k(eeprom)
    
54. arg 6: mem=32M
    
55. CPU revision is: 00019374 (MIPS 24Kc)
    
56. Determined physical RAM map:
    
57. memory: 02000000 @ 00000000 (usable)
    
58. User-defined physical RAM map:
    
59. memory: 02000000 @ 00000000 (usable)
    
60. Initrd not found or empty - disabling initrd
    
61. Zone PFN ranges:
    
62.   Normal   0x00000000 -> 0x00002000
    
63. Movable zone start PFN for each node
    
64. early_node_map[1] active PFN ranges
    
65.     0: 0x00000000 -> 0x00002000
    
66. Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
    
67. Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),6208k(rootfs),1472k(uImage),64k(configure),64k(mfg),64k(eeprom) mem=32M
    
68. PID hash table entries: 128 (order: 7, 512 bytes)
    
69. Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
    
70. Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
    
71. Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    
72. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    
73. Writing ErrCtl register=00000000
    
74. Readback ErrCtl register=00000000
    
75. Memory: 29900k/32768k available (1814k kernel code, 2868k reserved, 526k data, 148k init, 0k highmem)
    
76. NR_IRQS:128
    
77. plat_time_init: plat time init done
    
78. Calibrating delay loop... 232.96 BogoMIPS (lpj=465920)
    
79. Mount-cache hash table entries: 512
    
80. ZOS Init Board Type = [▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒![@]
    
81. 
    
82. Unknown Borad Type, Please Besure Your Device Was Ready!
    
83. NET: Registered protocol family 16
    
84. ===== ar7240_platform_init: 0
    
85. PCI init:ar7240_pcibios_init
    
86. registering PCI controller with io_map_base unset
    
87. bio: create slab <bio-0> at 0
    
88. pci 0000:00:00.0: PME# supported from D0 D1 D3hot
    
89. pci 0000:00:00.0: PME# disabled
    
90. Returning IRQ 48
    
91. NET: Registered protocol family 2
    
92. IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    
93. TCP established hash table entries: 1024 (order: 1, 8192 bytes)
    
94. TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
    
95. TCP: Hash tables configured (established 1024 bind 1024)
    
96. TCP reno registered
    
97. NET: Registered protocol family 1
    
98. AR7240 GPIOC major 0
    
99. squashfs: version 4.0 (2009/01/31) Phillip Lougher
    
100. JFFS2 version 2.2 (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
     
101. msgmni has been set to 16
     
102. alg: No test for lzma (lzma-generic)
     
103. alg: No test for stdrng (krng)
     
104. io scheduler noop registered
     
105. io scheduler deadline registered (default)
     
106. Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
     
107. serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
     
108. console [ttyS0] enabled
     
109. brd: module loaded
     
110. PPP generic driver version 2.4.2
     
111. PPP Deflate Compression module registered
     
112. PPP BSD Compression module registered
     
113. PPP MPPE Compression module registered
     
114. NET: Registered protocol family 24
     
115. PPPoL2TP kernel driver, V1.0
     
116. 7 cmdlinepart partitions found on MTD device ar7240-nor0
     
117. Creating 7 MTD partitions on "ar7240-nor0":
     
118. 0x000000000000-0x000000040000 : "u-boot"
     
119. 0x000000040000-0x000000050000 : "u-boot-env"
     
120. 0x000000050000-0x000000660000 : "rootfs"
     
121. 0x000000660000-0x0000007d0000 : "uImage"
     
122. 0x0000007d0000-0x0000007e0000 : "configure"
     
123. 0x0000007e0000-0x0000007f0000 : "mfg"
     
124. 0x0000007f0000-0x000000800000 : "eeprom"
     
125. u32 classifier
     
126.     input device check on
     
127.     Actions configured
     
128. nf_conntrack version 0.5.0 (512 buckets, 2048 max)
     
129. ip_tables: (C) 2000-2006 Netfilter Core Team
     
130. TCP cubic registered
     
131. NET: Registered protocol family 17
     
132. Bridge firewalling registered
     
133. 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
     
134. All bugs added by David S. Miller <davem@redhat.com>
     
135. ar7240wdt_init: Registering WDT success
     
136. VFS: Mounted root (jffs2 filesystem) readonly on device 31:2.
     
137. Freeing unused kernel memory: 148k freed
     
138. init started: BusyBox v1.15.0 (2013-12-18 10:39:48 CST)
     
139. starting pid 24, tty '': '/etc/rc.d/rcS'
     
140. mount: mounting /sys on /sys failed: No such device
     
141. Unknown Borad Type, Fail to init GPIO!
     
142. zcomMiscInit: init zcommisc OK (Netlink, GPIO, Watchdog).
     
143. ATHR_GMAC: Length per segment 1536
     
144. ATHR_GMAC: fifo cfg 3 01f00140
     
145. ATHR_GMAC: athr_gmacs[0]->mac_base: 19000000
     
146. ATHR_GMAC: Mac address for unit 0:bfff0000
     
147. ATHR_GMAC: 00:03:7f:e0:00:4d
     
148. ATHR_GMAC: Max segments per packet :   1
     
149. ATHR_GMAC: Max tx descriptor count :   40
     
150. ATHR_GMAC: Max rx descriptor count :   128
     
151. ATHR_GMAC: Mac capability flags    :   4403
     
152. ATHR_GMAC: athr_gmacs[1]->mac_base: 1a000000
     
153. ATHR_GMAC: Mac address for unit 1:bfff0006
     
154. ATHR_GMAC: ff:ff:ff:ff:ff:ff
     
155. ATHR_GMAC: Max segments per packet :   1
     
156. ATHR_GMAC: Max tx descriptor count :   40
     
157. ATHR_GMAC: Max rx descriptor count :   96
     
158. ATHR_GMAC: Mac capability flags    :   4D83
     
159. Wed Dec 18 10:38:24 UTC 2013
     
160. starting pid 53, tty '': '/sbin/getty ttyS0 115
     
161. 
     
162. 
     
163. BusyBox v1.15.0 (2013-12-18 10:39:48 CST) built-in shell (ash)
     
164. Enter 'help' for a list of built-in commands.
     
165. 
     
166. / # configserver 2.2.0  allen @/home/allen/zn-7200-c/zdc/2.0.90/now/build/.. #2013-12-18 10:41:24
     
167. DetectProduct: Fail To Identify Product[ZCN-1523H-2-8] from Kernel. Try to Obtain Platform Info From MFG info.
     
168. GetProductConfig: Obtain Product Name is [ZCN-1523H-2-8].
     
169. asf: module license 'Proprietary' taints kernel.
     
170. Disabling lock debugging due to kernel taint
     
171. ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
     
172. ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
     
173. ath_dfs: Version 2.0.0
     
174. Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
     
175. ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
     
176. ath_pci: 9.2.0_U11.14 (Atheros/multi-bss)
     
177. __ath_attach: Set global_scn[0]
     
178. ACBKMinfree = 48
     
179. ACBEMinfree = 32
     
180. ACVIMinfree = 16
     
181. ACVOMinfree = 0
     
182. CABMinfree = 48
     
183. UAPSDMinfree = 0
     
184. Switch Antenna: External(1) -> Internal(0).
     
185. DFS min filter rssiThresh = 18
     
186. DFS max pulse dur = 151 ticks
     
187. ath_get_caps[5191] rx chainmask mismatch actual 1 sc_chainmak 0
     
188. ath_get_caps[5166] tx chainmask mismatch actual 1 sc_chainmak 0
     
189. wifi0: Atheros 9285: mem=0x10000000, irq=48 hw_base=0xb0000000
     
190. athr_gmac_ring_alloc Allocated 640 at 0x81f3c000
     
191. athr_gmac_ring_alloc Allocated 2048 at 0x81c47000
     
192. Setting Drop CRC Errors, Pause Frames and Length Error frames
     
193. Setting PHY...
     
194. .
     
195. ATHR_GMAC: Enet Unit:0 PHY:4 is UP Mii 100Mbps full duplex
     
196. ATHR_GMAC: done cfg2 0x7115 ifctl 0x10000 miictrl
     
197. Setting Drop CRC Errors, Pause Frames and Length Error frames
     
198. wlan_vap_create : enter. devhandle=0x81f302c0, opmode=IEEE80211_M_STA, flags=0x3
     
199. wlan_vap_create : exit. devhandle=0x81f302c0, opmode=IEEE80211_M_STA, flags=0x3.
     
200. mc_ioctl: clone enable:1, clone mode:0, clone mac 30:49:3b:04:86:8a
     
201. Scan in progress.. Cancelling it
     
202. Invalid command : autocvupdate
     
203. Interface doesn't accept private ioctl...
     
204. shortgi (8BE0): Invalid argument
     
205. mc_ioctl: clone enable:1, clone mode:0, clone mac 30:49:3b:04:86:8a
     
206. Scan in progress.. Cancelling it
     
207. CheckDeamon, 52: restart '/usr/sbin/webs 'br0: starting userspace STP failed, starting kernel STP
     
208. device eth0 entered promiscuous mode
     
209. br0: port 1(eth0) entering listening state
     
210. device atha0 entered promiscuous mode
     
211. br0: port 1(eth0) entering learning state
     
212. Scan in progress.. Cancelling it
     
213. auto_mac_clone_handler: interface name:atha0, mac:e89a8f8278be
     
214. br0: port 2(atha0) entering disabled state
     
215. br0: topology change detected, propagating
     
216. br0: port 1(eth0) entering forwarding state
     
217. eth0: received packet with own address as source address
     
218. Scan in progress.. Cancelling it
     
219. br0: port 2(atha0) entering disabled state
     
220. Scan in progress.. Cancelling it
     
221. eth0: received packet with own address as source address
     
222. br0: port 2(atha0) entering disabled state
     
223. eth0: received packet with own address as source address
     
224. eth0: received packet with own address as source address
     
225. eth0: received packet with own address as source address
     
226. eth0: received packet with own address as source address
     
227. eth0: received packet with own address as source address
     
228. br0: port 2(atha0) entering listening state
     
229. br0: port 2(atha0) entering learning state
     
230. br0: topology change detected, propagating
     
231. br0: port 2(atha0) entering forwarding state
     
232. eth0: received packet with own address as source address
     
233. eth0: received packet with own address as source address
     
234. eth0: received packet with own address as source address
     
235. eth0: received packet with own address as source address
     
236. eth0: received packet with own address as source address
     
237. eth0: received packet with own address as source address
     
238. eth0: received packet with own address as source address
     
239. eth0: received packet with own address as source address
     
240. eth0: received packet with own address as source address
     
241. eth0: received packet with own address as source address
     
242. 
     
243. / # ls
     
244. root  sbin  proc  usr   var   sys   tmp   lib   etc   dev   bin
     
245. / # __ratelimit: 2 callbacks suppressed
     
246. eth0: received packet with own address as source address
     
247. 
     
248. / # cat /proc/mtd
     
249. dev:    size   erasesize  name
     
250. mtd0: 00040000 00010000 "u-boot"
     
251. mtd1: 00010000 00010000 "u-boot-env"
     
252. mtd2: 00610000 00010000 "rootfs"
     
253. mtd3: 00170000 00010000 "uImage"
     
254. mtd4: 00010000 00010000 "configure"
     
255. mtd5: 00010000 00010000 "mfg"
     
256. mtd6: 00010000 00010000 "eeprom"
     
257. / # cat /proc/partitions
     
258. major minor  #blocks  name
     
259. 
     
260.   31        0        256 mtdblock0
     
261.   31        1         64 mtdblock1
     
262.   31        2       6208 mtdblock2
     
263.   31        3       1472 mtdblock3
     
264.   31        4         64 mtdblock4
     
265.   31        5         64 mtdblock5
     
266.   31        6         64 mtdblock6
     
267. / # cat /proc/version
     
268. Linux version 2.6.31--LSDK-9.2.0_U10.5.13_ZOS Modify-svn552 (allen@s3.local) (gcc version 4.3.3 (GCC) ) #1 Tue Dec 17 11:09:25 CST 2013
     
269. / #
     

复制代码

那个***

vic-dou 发表于 2015-6-11 10:36
TTL定义为86、87脚（芯片右侧从上往下的第10、11脚）。
此路由打了个洞，从中间那层板子走线。

既然找到ttl了 那就直接刷breed 或者不死uboot啊

那个***

这个和我刚入手的大唐CPE一样的  http://forum.anywlan.com/thread-364716-1-1.html

vic***

那个男人 发表于 2015-6-12 15:15
既然找到ttl了 那就直接刷breed 或者不死uboot啊

那个第三方固件好像不支持内置外置天线互换。

并且我猜测内置两个功放，一个是内置天线功放，一个是外置天线功放。需要原厂固件控制功放开关。

Breed估计不支持此原厂固件，只能刷UBNT和TP-link和openwrt。

算了，原厂就可以了，而且是定向天线。做路由器不合适。

那个***

vic-dou 发表于 2015-6-12 15:19
那个第三方固件好像不支持内置外置天线互换。

并且我猜测内置两个功放，一个是内置天线功放，一个是外 ...

备份个art就阔以了     你用ttl刷个不死uboot  然后看看是否会启动原厂固件  一般是会启动的   然后备份个art 在刷ubnt B M2 然后进uboot刷入原厂art

那个***

刷完uboot或者breed后建议备份下原厂固件

那个***

我买的那个cpe已经在用了   晚上有空刷ubnt试试

vic***

我在帖子里贴出TTL输出文本，就会被敏感词系统判定为垃圾广告，进而要版主审核，今天第二次了，版主辛苦了！

那个***

vic-dou 发表于 2015-6-12 17:18
我在帖子里贴出TTL输出文本，就会被敏感词系统判定为垃圾广告，进而要版主审核，今天第二次了，版主辛苦了 ...

刷了没有啊？

vic***

那个男人 发表于 2015-6-13 11:10
刷了没有啊？

haha, after you.