|
本帖最后由 keke1023 于 2019-7-10 00:43 编辑
拆机后,自然而然的以为左边那四个孔是ttl,但是任何输出都没有,试了试测出来这个12针的接口上有ttl。。(因为jtag也没有12pin的啊,上面也就3个针有线路)
顺序是1-2-5分别为GND-TX-RX
上电后中断,输入help的记录如下
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00117
S - IMAGE_VARIANT_STRING=DAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000025
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1338 - bootable_media_detect_entry, Start
B - 2877 - bootable_media_detect_success, Start
B - 2892 - elf_loader_entry, Start
B - 4298 - auth_hash_seg_entry, Start
B - 6450 - auth_hash_seg_exit, Start
B - 74520 - elf_segs_hash_verify_entry, Start
B - 198294 - PBL, End
B - 198318 - SBL1, Start
B - 291584 - pm_device_init, Start
D - 7 - pm_device_init, Delta
B - 293077 - boot_flash_init, Start
D - 93287 - boot_flash_init, Delta
B - 390664 - boot_config_data_table_init, Start
D - 13930 - boot_config_data_table_init, Delta - (419 Bytes)
B - 407353 - clock_init, Start
D - 7580 - clock_init, Delta
B - 418374 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B - 421787 - sbl1_ddr_set_params, Start
B - 426882 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 431265 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13172 - sbl1_ddr_set_params, Delta
B - 444575 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 515712 - sbl1_wait_for_ddr_training, Start
D - 28 - sbl1_wait_for_ddr_training, Delta
B - 531805 - Image Load, Start
D - 146195 - QSEE Image Loaded, Delta - (274048 Bytes)
B - 678427 - Image Load, Start
D - 2119 - SEC Image Loaded, Delta - (2048 Bytes)
B - 688577 - Image Load, Start
D - 181366 - APPSBL Image Loaded, Delta - (428763 Bytes)
B - 870339 - QSEE Execution, Start
D - 56 - QSEE Execution, Delta
B - 876567 - SBL1, End
D - 680251 - SBL1, Delta
S - Flash Throughput, 2038 KB/s (705630 Bytes, 346135 us)
S - DDR Frequency, 672 MHz
U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Mar 20 2018 - 09:22:26)
smem ram ptable found: ver: 1 len: 3
DRAM: 512 MiB
machid : 0x8010001
NAND: ID = 9580f12c
Vendor = 2c
Device = f1
ONFI device found
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC: qca_mmc: 0
In: serial
Out: serial
Err: serial
machid: 8010001
flash_type: 2
Hit any key to stop autoboot: 0
Net: MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
(IPQ40xx) #
(IPQ40xx) # help
? - alias for 'help'
base - print or set address offset
bootipq - bootipq from flash device
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
chpart - change active partition
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
dhcp - boot image via network using DHCP/TFTP protocol
dumpipq_data- dumpipq_data crashdump collection from memory
dumpipq_flash_data- dumpipq_flash_data crashdump collection and storing in flash
echo - echo args to console
env - environment handling commands
exit - exit script
false - do nothing, unsuccessfully
fdt - flattened device tree utility commands
fuseipq - fuse QFPROM registers from memory
go - start application at address 'addr'
help - print command description/usage
i2c - I2C sub-system
imxtract- extract a part of a multi-image
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nm - memory modify (constant address)
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
showvar - print local hushshell variables
smeminfo- print SMEM FLASH information
source - run script from memory
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
true - do nothing, successfully
uartrd - uartrd read from second UART
uartwr - uartwr to second UART
ubi - ubi commands
usb - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
然后我又进到failsafe模式下去修改密码,发现不让改,只能用passwd -d root清除密码
然后再正常进入系统后passwd修改密码,这下可以直接ssh登录了,查看了mtd信息如下
dev: size erasesize name
mtd0: 00100000 00020000 "0: SBL1"
mtd1: 00100000 00020000 "0: MIBIB"
mtd2: 00100000 00020000 "0: BOOTCONFIG"
mtd3: 00100000 00020000 "0: QSEE_1"
mtd4: 00100000 00020000 "0: QSEE"
mtd5: 00080000 00020000 "0: CDT_1"
mtd6: 00080000 00020000 "0: CDT"
mtd7: 00080000 00020000 "0: BOOTCONFIG1"
mtd8: 00080000 00020000 "0: APPSBLENV"
mtd9: 00200000 00020000 "0: APPSBL_1"
mtd10: 00200000 00020000 "0: APPSBL"
mtd11: 00080000 00020000 "0: ART"
mtd12: 04100000 00020000 "rootfs_1"
mtd13: 03300000 00020000 "rootfs"
mtd14: 003c1000 0001f000 "kernel"
mtd15: 01a85000 0001f000 "ubi_rootfs"
mtd16: 0122a000 0001f000 "rootfs_data"
然后也通过winscp备份了mtd0-15,目前还没敢随便动手,如果直接mtd刷固件就算不对应该还能在uboot里恢复,但是ipq系列的闪存分区实在有点复杂,对此不够了解,而且编程器太贵了,先记录一下哈哈哈
下来是所有分区的备份
链接:https://pan.baidu.com/s/15uJ6pEGLEfr6-a8Pzy6E4w
提取码:cvje
已经被我彻底刷成砖啦,uboot都刷掉了~有没有朋友有nand编程器可以救砖啊~
|
本帖子中包含更多资源
您需要 登录 才可以下载或查看,没有账号?立即注册
×
|