请教wdr5620v3 mt7628 mt7612 如何从 2M 固件中提取 eeprom 让硬改后的设备启用5g呢

ht*** · 发表于 2019-9-29 10:45

本帖最后由 html 于 2019-10-1 11:27 编辑

设备是 wdr5620 v3 ，原来是2M flash 16M内存，硬改成了 64M 内存 8M flash

短路ttl附近一个空位的电阻然后进入控制台能输入， flash -layout 显示如下

==================================================
Flash Layout:
|------------------------| 0x00000000(0.0K)
| |
| |
|FACUBOOT(60.0K) |
| |
| |
|------------------------| 0x0000f000(60.0K)
|PROFILE(2.0K) |
|------------------------| 0x0000f800(62.0K)
|RADIO(2.0K) |
|------------------------| 0x00010000(64.0K)
| |
| |
|CONFIG(20.0K) |
| |
| |
|------------------------| 0x00015000(84.0K)
|TPHEAD(0.5K) |
|------------------------| 0x00015200(84.5K)
| |
| |
|FIRMWARE(1963.5K) |
| |
| |
|------------------------| 0x00200000(2048.0K)

复制代码

hexdump -C 2M原厂编程器
0000f000 94 d9 b3 82 c2 f3 这个是 mac
0000f800 开始的地方貌似 art
0000fc00 开始的地方貌似 5g art

该帖 61 楼提到内容为 62 76 01 的地方可能是 pcie eepron
https://www.right.com.cn/forum/f ... &ordertype=1&page=1

0000f000 94 d9 b3 82 c2 f3 00 00 00 00 00 00 00 00 00 00 |....,l..........|
0000f010 31 32 33 34 35 36 37 30 00 00 00 00 00 00 00 00 |12345670........|
0000f020 00 00 d1 bf 04 6f b1 32 d1 df 52 b3 d8 91 0b a0 |.....o.2..R.....|
0000f030 1a 12 06 70 4d 96 a8 05 d5 5e c8 53 8c 88 e8 e5 |...pM....^.S....|
0000f040 6b 37 16 c7 7b 64 65 76 4d 6f 64 65 6c 3a 54 4c |k7..{devModel:TL|
0000f050 2d 57 44 52 35 36 32 30 2c 32 2e 34 67 43 68 69 |-WDR5620,2.4gChi|
0000f060 70 3a 4d 54 37 36 32 38 41 2c 35 67 43 68 69 70 |p:MT7628A,5gChip|
0000f070 3a 4d 54 37 36 31 32 45 2c 73 77 69 74 63 68 3a |:MT7612E,switch:|
0000f080 4e 2f 41 2c 68 77 56 65 72 3a 33 2e 30 7d 00 00 |N/A,hwVer:3.0}..|
0000f090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
0000f0c0 00 00 00 00 95 60 07 a8 27 48 a6 d4 07 0f 16 85 |.....`..'H......|
0000f0d0 11 51 04 16 89 d9 e9 05 59 5b bf 58 0b b7 e1 27 |.Q......Y[.X...'|
0000f0e0 69 8f 16 2d 09 fa 07 1a f6 8b cf 67 f6 da 98 6d |i..-.......g...m|
0000f0f0 06 96 aa 5a dc a0 d7 f5 2d d9 db 71 a8 fa bf d0 |...Z....-..q....|
0000f100 6a 35 5c f1 05 c7 be 82 37 29 7b c7 c2 b1 b2 f1 |j5\.....7){.....|
0000f110 7c 06 70 95 58 11 a4 ed 20 2b 0a a1 76 eb 8c 50 ||.p.X... +..v..P|
0000f120 79 3b 5e a2 b2 0a 16 e5 12 9c 63 b5 76 31 9b f6 |y;^.......c.v1..|
0000f130 36 d6 48 f2 ae 3b fc 9c e5 0c 3c 46 dd 76 fe ce |6.H..;....<F.v..|
0000f140 17 73 9a 54 00 00 00 00 00 00 00 00 00 00 00 00 |.s.T............|
0000f150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
0000f1c0 00 00 00 00 80 00 ff ff ff ff ff ff ff ff ff ff |................|
0000f1d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
0000f800 28 76 06 00 00 0c 43 e1 76 28 00 00 00 00 00 00 |(v....C.v(......|
0000f810 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
0000f820 00 00 00 00 20 00 00 00 00 0c 43 e1 76 29 00 0c |.... .....C.v)..|
0000f830 43 e1 76 2a 22 34 00 20 ff ff 00 01 00 00 00 00 |C.v*"4. ........|
0000f840 00 00 22 00 00 00 00 00 30 00 00 00 00 00 00 00 |..".....0.......|
0000f850 00 00 00 94 40 ba c0 cc 24 84 84 84 40 cc 24 83 |....@...$...@.$.|
0000f860 83 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
0000f870 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
0000f8a0 c2 c2 c2 c2 c2 c0 c0 c2 00 c2 00 00 82 82 00 00 |................|
0000f8b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
0000f8c0 00 00 00 00 00 00 00 00 00 1a 22 2a 31 35 01 35 |.........."*15.5|
0000f8d0 39 40 46 4d 7f 7f 7f 00 00 00 00 00 00 00 00 00 |9@FM............|
0000f8e0 11 1d 11 1d 1c 35 1c 35 1e 35 1e 35 17 19 17 19 |.....5.5.5.5....|
0000f8f0 02 00 00 00 b0 00 80 88 00 00 00 00 00 00 00 00 |................|
0000f900 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
0000f920 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 00 |..............w.|
0000f930 11 1d 11 1d 15 7f 15 7f 17 7f 17 7f 10 3b 10 3b |.............;.;|
0000f940 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
0000f9f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 34 12 |..............4.|
0000fa00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
0000fc00 62 76 01 00 00 0c 43 47 c2 80 12 76 c3 14 00 00 |bv....CG...v....|
0000fc10 00 00 12 76 c3 14 00 00 00 00 ff ff ff ff ff ff |...v............|
0000fc20 ff ff 37 d8 9d 00 ff 7f fd 9b ff ff ff ff ff ff |..7.............|
0000fc30 ff ff ff ff 22 ff 00 20 ff ff 34 01 00 00 00 00 |....".. ..4.....|
0000fc40 00 00 ff d3 00 00 00 00 00 00 00 00 00 00 e0 01 |................|
0000fc50 00 00 00 00 00 b4 84 0a 1a 00 00 00 83 0b 1a 00 |................|
0000fc60 00 00 7a 06 1a 00 00 7a 06 1e c1 c1 78 08 1e 83 |..z....z....x...|
0000fc70 84 7e 1b 02 00 00 76 16 1e 83 84 75 1c 1e c2 c1 |.~....v....u....|
0000fc80 79 0a 1a 00 00 79 0a 1e 00 00 7b 06 1e 83 83 77 |y....y....{....w|
0000fc90 14 1c 00 00 7e 05 1e 82 83 79 11 1e c1 c2 00 34 |....~....y.....4|
0000fca0 c3 c3 c4 c4 00 00 c4 c4 c2 81 c4 c4 c2 81 00 00 |................|
0000fcb0 00 00 c4 c4 c2 00 00 00 00 00 00 00 00 00 85 86 |................|
0000fcc0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
0000fcf0 ff ff ff ff ff ff 00 00 1e ff 00 00 00 00 00 00 |................|
0000fd00 0f ca 74 c5 e8 07 30 3d 01 b0 08 26 00 0e 04 15 |..t...0=...&....|
0000fd10 00 8a 00 40 00 00 00 08 00 9d 08 00 12 c0 00 00 |...@............|
0000fd20 08 20 04 2a 90 00 00 24 01 04 54 08 d0 a0 28 20 |. .*...$..T...( |
0000fd30 ff ff ff ff ff ff ff 08 ff ff ff ff ff ff 00 00 |................|
0000fd40 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
0000fde0 c0 81 82 c3 04 45 46 07 08 09 ff ff ff ff ff ff |.....EF.........|
0000fdf0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff 34 12 |..............4.|
0000fe00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00010000 4d 49 4e 49 46 53 00 00 00 00 00 00 00 00 00 00 |MINIFS..........|

复制代码

但是从2M原厂固件提取出来的 art 或 eeprom 拼凑到 8M 固件的 openwrt 里面（按照dts文件移动了5g art 的位置），依然没有 5G
网上找到过一个8M的 MAC1200R 编程器固件，直接写入后在硬改的 wdr5620 v3 上无法启动，ttl 只有一行输出然后什么没有了
把这个 8M的 MAC1200R 编程器固件填入 breed 和 openwrt ，可以正常启动，但启动后依然么有5g
尝试过各种 breed 和 mt7628 的 openwrt 固件的组合，均没有5G
其中 mac1200r-v2 的固件写入后 ttl 只有输出，不能输入

dmesg 部分内容

[ 0.236682] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[ 0.392257] PCI host bridge /pcie@10140000 ranges:
[ 0.397057] MEM 0x0000000020000000..0x000000002fffffff
[ 0.402317] IO 0x0000000010160000..0x000000001016ffff
[ 0.425570] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 0.431480] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 0.437244] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 0.443905] PCI host bridge to bus 0000:00
[ 0.447998] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[ 0.454992] pci_bus 0000:00: root bus resource [io 0xffffffff]
[ 0.460924] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.467798] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.475837] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400
[ 0.475877] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[ 0.475893] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[ 0.475971] pci 0000:00:00.0: supports D1
[ 0.475982] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[ 0.476241] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.484524] pci 0000:01:00.0: [14c3:7662] type 00 class 0x028000
[ 0.484600] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[ 0.484658] pci 0000:01:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[ 0.484775] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[ 0.484985] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 0.485005] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[ 0.485052] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[ 0.491685] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[ 0.498774] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[ 0.505589] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[ 0.512908] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[ 0.519765] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[ 0.527181] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[ 0.534452] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 0.539485] pci 0000:00:00.0: bridge window [mem 0x20000000-0x200fffff]
[ 0.546333] pci 0000:00:00.0: bridge window [mem 0x20100000-0x201fffff pref]

复制代码

希望能指点一二，谢谢了

青*** · 发表于 2019-9-29 10:55

我之前有一wdr5620v1，百兆的，8+64m的，刚好有备份eeprom。

ht*** · 发表于 2019-9-29 11:08

青烟发表于 2019-9-29 10:55
我之前有一wdr5620v1，百兆的，8+64m的，刚好有备份eeprom。

方便分享么

青*** · 发表于 2019-9-29 12:02

html 发表于 2019-9-29 11:08
方便分享么

邮箱……

ht*** · 发表于 2019-9-29 12:32

青烟发表于 2019-9-29 12:02
邮箱……

谢谢了 zhngq2312@gmail.com

zha*** · 发表于 2019-10-1 10:35

你这到底是5600还是5620?

ht*** · 发表于 2019-10-1 11:27

zhang-3 发表于 2019-10-1 10:35
你这到底是5600还是5620?

改过来了 wdr5620 v3

ouji*** · 发表于 2019-10-16 15:46

青烟发表于 2019-9-29 10:55
我之前有一wdr5620v1，百兆的，8+64m的，刚好有备份eeprom。

我的闪存焊下来的时候，可能是静电弄坏了，341编程器识别不了，强硬读出来都是FF.

兄弟方便给一个编程器固件或者eeprom么？谢谢！
38898357@qq。com

青*** · 发表于 2019-10-17 22:40

oujinlai 发表于 2019-10-16 15:46
我的闪存焊下来的时候，可能是静电弄坏了，341编程器识别不了，强硬读出来都是FF.

兄弟方便给一个编程 ...

你问下楼主，我设备送人了，备份上回发给楼主后也删了。

雨好*** · 发表于 2019-11-10 20:37

青烟发表于 2019-9-29 10:55
我之前有一wdr5620v1，百兆的，8+64m的，刚好有备份eeprom。

大师帮我传个，195806236@qq.com

zha*** · 发表于 2020-2-18 10:17

本帖最后由 zhang-3 于 2020-3-11 16:15 编辑

楼主解决了吗？刷各种openwrt都无法启动，目前只有pandora能用。我的是V1版的。
已经搞定了，添加了usb，刷了自己编译openwrt19.07.2。5G正常，就是信号很渣，特别是5G。

https://www.right.com.cn/forum/thread-2918842-1-1.html

账号		自动登录	找回密码
密码			立即注册

请教wdr5620v3 mt7628 mt7612 如何从 2M 固件中提取 eeprom 让硬改后的设备启用5g呢

点评

点评

点评