CAN星际宝盒ttl及ssh

keke***

拆机后，自然而然的以为左边那四个孔是ttl，但是任何输出都没有，试了试测出来这个12针的接口上有ttl。。（因为jtag也没有12pin的啊，上面也就3个针有线路）
顺序是1-2-5分别为GND-TX-RX
上电后中断，输入help的记录如下

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00117
S - IMAGE_VARIANT_STRING=DAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000025
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1338 - bootable_media_detect_entry, Start
B -      2877 - bootable_media_detect_success, Start
B -      2892 - elf_loader_entry, Start
B -      4298 - auth_hash_seg_entry, Start
B -      6450 - auth_hash_seg_exit, Start
B -     74520 - elf_segs_hash_verify_entry, Start
B -    198294 - PBL, End
B -    198318 - SBL1, Start
B -    291584 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    293077 - boot_flash_init, Start
D -     93287 - boot_flash_init, Delta
B -    390664 - boot_config_data_table_init, Start
D -     13930 - boot_config_data_table_init, Delta - (419 Bytes)
B -    407353 - clock_init, Start
D -      7580 - clock_init, Delta
B -    418374 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    421787 - sbl1_ddr_set_params, Start
B -    426882 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    431265 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13172 - sbl1_ddr_set_params, Delta
B -    444575 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    515712 - sbl1_wait_for_ddr_training, Start
D -        28 - sbl1_wait_for_ddr_training, Delta
B -    531805 - Image Load, Start
D -    146195 - QSEE Image Loaded, Delta - (274048 Bytes)
B -    678427 - Image Load, Start
D -      2119 - SEC Image Loaded, Delta - (2048 Bytes)
B -    688577 - Image Load, Start
D -    181366 - APPSBL Image Loaded, Delta - (428763 Bytes)
B -    870339 - QSEE Execution, Start
D -        56 - QSEE Execution, Delta
B -    876567 - SBL1, End
D -    680251 - SBL1, Delta
S - Flash Throughput, 2038 KB/s  (705630 Bytes,  346135 us)
S - DDR Frequency, 672 MHz


U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Mar 20 2018 - 09:22:26)

smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  ID = 9580f12c
Vendor = 2c
Device = f1
ONFI device found
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC:   qca_mmc: 0
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 2
Hit any key to stop autoboot:  0
Net:   MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0

(IPQ40xx) #
(IPQ40xx) # help
?       - alias for 'help'
base    - print or set address offset
bootipq - bootipq from flash device
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
dumpipq_data- dumpipq_data crashdump collection from memory
dumpipq_flash_data- dumpipq_flash_data crashdump collection and storing in flash
echo    - echo args to console
env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
fuseipq - fuse QFPROM registers from memory

go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
imxtract- extract a part of a multi-image
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
smeminfo- print SMEM FLASH information
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
true    - do nothing, successfully
uartrd  - uartrd read from second UART
uartwr  - uartwr to second UART
ubi     - ubi commands
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version


然后我又进到failsafe模式下去修改密码，发现不让改，只能用passwd -d root清除密码
然后再正常进入系统后passwd修改密码，这下可以直接ssh登录了，查看了mtd信息如下
dev:    size   erasesize  name
mtd0: 00100000 00020000 "0: SBL1"
mtd1: 00100000 00020000 "0: MIBIB"
mtd2: 00100000 00020000 "0: BOOTCONFIG"
mtd3: 00100000 00020000 "0: QSEE_1"
mtd4: 00100000 00020000 "0: QSEE"
mtd5: 00080000 00020000 "0: CDT_1"
mtd6: 00080000 00020000 "0: CDT"
mtd7: 00080000 00020000 "0: BOOTCONFIG1"
mtd8: 00080000 00020000 "0: APPSBLENV"
mtd9: 00200000 00020000 "0: APPSBL_1"
mtd10: 00200000 00020000 "0: APPSBL"
mtd11: 00080000 00020000 "0: ART"
mtd12: 04100000 00020000 "rootfs_1"
mtd13: 03300000 00020000 "rootfs"
mtd14: 003c1000 0001f000 "kernel"
mtd15: 01a85000 0001f000 "ubi_rootfs"
mtd16: 0122a000 0001f000 "rootfs_data"


然后也通过winscp备份了mtd0-15，目前还没敢随便动手，如果直接mtd刷固件就算不对应该还能在uboot里恢复，但是ipq系列的闪存分区实在有点复杂，对此不够了解，而且编程器太贵了，先记录一下哈哈哈
下来是所有分区的备份
链接：https://pan.baidu.com/s/15uJ6pEGLEfr6-a8Pzy6E4w
提取码：cvje


已经被我彻底刷成砖啦，uboot都刷掉了~有没有朋友有nand编程器可以救砖啊~

cmh***

USB口设计不错。2个LAN可惜了

gw826***

下载地址来一发

dirdi***

感谢分享，我也入了一个 ，郁闷中， 无线一会儿就会自动关闭要再在电脑登录页面设置打开。期待能刷 机
直接  刷  华硕RT-ACRH17 类不知是否可行  哎，还是等 楼主 出手 救救吧，感谢

Q***

感谢楼主，难怪我怎么试也找不到TTL信息

av***

厉害了楼主。请问如何找ttl接口的呢？手头也有一个arm板子，没有资料

li***

厉害了楼主
厉害了楼主

5055***

支持一下

keke***

avnow 发表于 2019-7-9 21:33
厉害了楼主。请问如何找ttl接口的呢？手头也有一个arm板子，没有资料

gnd接地，然后拿rx挨个去碰，出信息的就是tx

5055***

有原固件全程启动日志吗？

dark***

CAN星际宝盒ttl及ssh

dirdi***

我比较菜不会拆机操作，只好等简单的刷机了，自带uboot？
手上这个插wan拨号，上网一会儿，无线就自动关闭。

keke***

dirdir2012 发表于 2019-7-9 22:21
我比较菜不会拆机操作，只好等简单的刷机了，自带uboot？
手上这个插wan拨号，上网一会儿，无线就自动关闭 ...

好像都是这样的，不知道为什么…

keke***

505575853 发表于 2019-7-9 21:58
有原固件全程启动日志吗？

没记录，正在胡整中哈哈哈

dirdi***

如果能仿:        RT-ACRH17 刷入opboot 就好玩 。明天试试插lan   做ap 会不会自动关闭无线。