备份了一个tplink ap300xgc-ct运营商定制ap的固件，大神给看下能不能刷公版固件

涛涛桃

把编程器固件解压出来了，里面是这样的，需要固件的可以私发

涛涛桃

ttl登录有密码，固件解压后密码文件看到是root1$kOCCeZO2$kkuOparwmnukviD1n1tCK.:0:0:root:/root:/bin/ash，把12345678替换成加密后，打包固件，不能启动了

涛涛桃

下面是部分ttl启动的日志
device 0 offset 0xe0000, size 0xd0
SF: 208 bytes @ 0xe0000 Read: OK
verifying uboot partition...
copy the full partition to ram ...
device 0 offset 0xc0000, size 0x20000
SF: 131072 bytes @ 0xc0000 Read: OK
ok
verifying kernel and romfs partition...
copy the full partition to ram ...
device 0 offset 0xe0600, size 0xbcfa00
SF: 12384768 bytes @ 0xe0600 Read: OK
ok
device 0 offset 0xe0000, size 0x600
SF: 1536 bytes @ 0xe0000 Read: OK
device 0 offset 0xc0000, size 0x20000
SF: 131072 bytes @ 0xc0000 Read: OK


U-Boot 2016.01 (Dec 07 2022 - 17:42:37 +0800)

DRAM:  smem ram ptable found: ver: 1 len: 4
256 MiB
Using default environment

In:    serial@78AF000
Out:   serial@78AF000
Err:   serial@78AF000
machid: 8040001
No ART partition found
SPI_ADDR_LEN=3
SF: Detected XM25QU128C with page size 256 Bytes, erase size 4 KiB, total 16 MiB
device 0 offset 0xe0000, size 0x600
SF: 1536 bytes @ 0xe0000 Read: OK
set_fs_bootargs flash_type = 6
SPI_ADDR_LEN=3
SF: Detected XM25QU128C with page size 256 Bytes, erase size 4 KiB, total 16 MiB
device 0 offset 0xe0600, size 0x300000
SF: 3145728 bytes @ 0xe0600 Read: OK
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@mp03.1' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM OpenWrt Linux-4.4.60
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x440000e4
     Data Size:    2284279 Bytes = 2.2 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x41208000
     Entry Point:  0x41208000
     Hash algo:    crc32
     Hash value:   ad1c2fd2
     Hash algo:    sha1
     Hash value:   0aab942efdbd89496f466c4ec90b38ffd52e16c3
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@mp03.1' configuration
   Trying 'fdt@mp03.1' fdt subimage
     Description:  ARM OpenWrt qcom-ipq50xx-mpxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4423c520
     Data Size:    56923 Bytes = 55.6 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   27c2dd65
     Hash algo:    sha1
     Hash value:   a4f43e8a7f3f45e8d4c1b674f97a7ba12e9d7134
   Booting using the fdt blob at 0x4423c520
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 497f0000, end 49800e5a ... OK
Using machid 0x8040001 from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.4.60 (jenkins@wlcilnx1) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 c61ae5429ef458c4a2bcefd7f0d6626ab0594d1c) ) #1 SMP PREEMPT Wed Dec 7 17:47:51 CST 2022
[    0.000000] CPU: ARMv7 Processor [51af8014] revision 4 (ARMv7), cr=10c0383d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine model: Qualcomm Technologies, Inc. IPQ5018/AP-MP03.1
[    0.000000] Reserved memory: not enough space all defined regions.
[    0.000000] Reserved memory: OVERLAP DETECTED!
[    0.000000] q6_mem_regions@4B000000 (0x4b000000--0x4e400000) overlaps with q6_code_data@4B000000 (0x4b000000--0x4b060000)
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] PERCPU: Embedded 10 pages/cpu @8fdc3000 s11968 r8192 d20800 u40960
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 43264
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 root=/dev/mtdblock6 rootfstype=squashfs,jffs2 rootwait swiotlb=1 radioScheme=IPQ5018,qcn6122
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 164820K/175104K available (4133K kernel code, 286K rwdata, 1544K rodata, 200K init, 2165K bss, 10284K reserved, 0K cma-reserved)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0x90800000 - 0xff800000   (1776 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x90000000   ( 256 MB)
[    0.000000]     modules : 0x7f000000 - 0x80000000   (  16 MB)
[    0.000000]       .text : 0x81208000 - 0x81793990   (5679 kB)
[    0.000000]       .init : 0x81794000 - 0x817c6000   ( 200 kB)
[    0.000000]       .data : 0x817c6000 - 0x8180d840   ( 287 kB)
[    0.000000]        .bss : 0x8180d840 - 0x81a2af58   (2166 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000]  Build-time adjustment of leaf fanout to 32.
[    0.000000]  RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=32, nr_cpu_ids=2
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] GICv2m: Node v2m: range[0xb00a000:0xb00affc], SPI[448:480]
[    0.000000] GICv2m: Node v2m: range[0xb00b000:0xb00bffc], SPI[480:512]
[    0.000000] Architected cp15 timer(s) running at 24.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[    0.000005] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.000017] Switching to timer-based delay loop, resolution 41ns
[    0.000456] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.000474] pid_max: default: 4096 minimum: 301
[    0.000554] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000565] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.001064] CPU: Testing write buffer coherency: ok
[    0.001455] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.001516] Setting up static identity map for 0x41208200 - 0x41208234
[    0.052139] MSM Memory Dump base table set up
[    0.052172] MSM Memory Dump apps data table set up
[    0.090382] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[    0.090491] Brought up 2 CPUs
[    0.090509] SMP: Total of 2 processors activated (96.00 BogoMIPS).
[    0.090515] CPU: All CPU(s) started in SVC mode.
[    0.103636] VFP support v0.3: implementor 51 architecture 3 part 40 variant 3 rev 4
[    0.103838] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.103869] futex hash table entries: 16 (order: -2, 1024 bytes)
[    0.103995] pinctrl core: initialized pinctrl subsystem
[    0.104983] NET: Registered protocol family 16
[    0.106335] DMA: preallocated 2048 KiB pool for atomic coherent allocations
[    0.107167] NET: Registered protocol family 42
[    0.111853] qcom,gcc-ipq5018 1800000.gcc: Registered ipq5018 GCC clocks provider
[    0.115366] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[    0.116453] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[    0.128252] CPU: IPQ0518, SoC Version: 1.1
[    0.164930] clocksource: Switched to clocksource arch_sys_counter
[    0.166974] NET: Registered protocol family 2
[    0.167672] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.167711] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    0.167753] TCP: Hash tables configured (established 2048 bind 2048)
[    0.167811] UDP hash table entries: 128 (order: 0, 4096 bytes)
[    0.167828] UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
[    0.168029] NET: Registered protocol family 1
[    0.175749] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.175805] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.177278] io scheduler noop registered
[    0.177297] io scheduler deadline registered (default)
[    0.179473] 80000000.pci supply vdda not found, using dummy regulator
[    0.179547] 80000000.pci supply vdda_phy not found, using dummy regulator
[    0.179607] 80000000.pci supply vdda_refclk not found, using dummy regulator
[    0.180416] PCI host bridge /soc/pci@80000000 ranges:
[    0.180450]    IO 0x80200000..0x802fffff -> 0x80200000
[    0.180465]   MEM 0x80300000..0x902fffff -> 0x80300000
[    1.414935] qcom-pcie 80000000.pci: phy link never came up
[    1.424970] qcom-pcie 80000000.pci: hostinit failed
[    1.424982] qcom-pcie 80000000.pci: cannot initialize host
[    1.425177] qcom-pcie: probe of 80000000.pci failed with error -110
[    1.429547] TZ Log : Will warn on Access Violation, as paniconaccessviolation is not set
[    1.430016] bt_driver 1943008.bt: bt_parse_ipc
[    1.430064] bt_driver 1943008.bt: bt_parse_mem
[    1.430115] bt_driver 1943008.bt: bt_parse_dt operating in secure mode
[    1.431059] 58000.qcom,msm-eud: ttyEUD0 at MMIO 0x0 (irq = 154, base_baud = 0) is a EUD UART
[    1.432456] Registered Sucessfully
[    1.433007] msm_serial 78af000.serial: msm_serial: detected port #0
[    1.433062] msm_serial 78af000.serial: uartclk = 1843199
[    1.433128] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 20, base_baud = 115199) is a MSM
[    1.433161] msm_serial: console setup on port #0
[    2.040745] console [ttyMSM0] enabled
[    2.045869] msm_serial: driver initialized
[    2.049356] msm_serial_hsl_init: driver initialized
[    2.053572] diag: IPC Logging disabled
[    2.058546] TRACK: P[0]      PMask[4]
[    2.061534] TRACK: P[1]      PMask[4]
[    2.064967] TRACK: P[2]      PMask[4]
[    2.068560] TRACK: P[3]      PMask[4]
[    2.071406] nik 4097 info->svc_id
[    2.115673] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    2.117172] m25p80 spi32766.0: found xm25qu128c, expected n25q128a11
[    2.121789] m25p80 spi32766.0: xm25qu128c (16384 Kbytes)
[    2.128951] ptnMask=0x000000ff
[    2.133409] Searching for RedBoot partition table
[    2.136329] 8 RedBoot partitions found on MTD device spi32766.0
[    2.141052] Creating 8 MTD partitions on "spi32766.0":
[    2.146805] 0x000000000000-0x00000009f800 : "factoryBoot"
[    2.152918] 0x00000009f800-0x0000000a0000 : "factoryInfo"
[    2.158358] 0x0000000a0000-0x0000000b0000 : "art"
[    2.163677] 0x0000000b0000-0x0000000c0000 : "config"
[    2.168479] 0x0000000c0000-0x0000000e0000 : "normalBoot"
[    2.173413] 0x0000000e0000-0x00000033947c : "kernel"
[    2.178778] 0x00000033947c-0x000000cb0000 : "rootfs"
[    2.183673] mtd: device 6 (rootfs) set to be root filesystem
[    2.187812] 0x000000cb0000-0x000001000000 : "rootfs_data"
[    2.195747] libphy: Fixed MDIO Bus: probed
[    2.414951] qca-mdio 88000.mdio: Could not find phy-reset-gpio
[    2.415087] libphy: qca_mdio: probed
[    2.420080] qca-mdio 88000.mdio: qca-mdio driver was registered
[    2.634955] qca-mdio 90000.mdio: Could not find phy-reset-gpio
[    2.635086] libphy: qca_mdio: probed
[    2.640053] qca-mdio 90000.mdio: qca-mdio driver was registered
[    2.745226] PPP generic driver version 2.4.2
[    2.745396] NET: Registered protocol family 24
[    2.748588] p p t p driver version 0.8.5
[    2.752979] cnss: INFO: IPC Logging is disabled!
[    2.757093] cnss[2]: INFO: Platform driver probed successfully. plat 8a1c0010 tgt 0xfffc
[    2.761495] cnss[41]: INFO: Platform driver probed successfully. plat 8a1d0010 tgt 0xfffb
[    2.770917] qcom-tsens 4a8000.thermal-sensor: tsens calibration failed
[    2.779364]
[    2.779364] Version Rollback Feature Disabled
[    2.786210] qcom-q6v5-wcss-pil cd00000.qcom_q6v5_wcss: “师夷长技以制夷” registeration success qcom_q6v5_wcss
[    2.789711] remoteproc remoteproc0: cd00000.qcom_q6v5_wcss is available
[    2.798366] q6v5_wcss_userpd1(8fde6710) node found
[    2.805867] platform q6v5_wcss_userpd1: “师夷长技以制夷” registeration success q6v5_wcss_userpd1
[    2.809741] remoteproc remoteproc1: q6v5_wcss_userpd1 is available
[    2.817305] q6v5_wcss_userpd2(8fde69b4) node found
[    2.824388] platform q6v5_wcss_userpd2: “师夷长技以制夷” registeration success q6v5_wcss_userpd2
[    2.828360] remoteproc remoteproc2: q6v5_wcss_userpd2 is available
[    2.836685] Mirror/redirect action on
[    2.842692] u32 classifier
[    2.845809]     input device check on
[    2.848373]     Actions configured
[    2.852172] nf_conntrack version 0.5.0 (2575 buckets, 10300 max)
[    2.856236] xt_time: kernel timezone is -0000
[    2.861767] gre: GRE over IPv4 demultiplexor driver
[    2.865881] ip_gre: GRE over IPv4 tunneling driver
[    2.871871] ip_tables: (C) 2000-2006 Netfilter Core Team
[    2.875546] Initializing XFRM netlink socket
[    2.881625] NET: Registered protocol family 10
[    2.886727] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    2.889668] NET: Registered protocol family 17
[    2.894889] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    2.899221] Bridge conntrack hooks registered
[    2.911955] 8021q: 802.1Q VLAN Support v1.8
[    2.916485] Registering SWP/SWPB emulation handler
[    2.922313] Registered character driver slp_flash_chrdev
[    3.034425] Flash UID signiture check OK.
[    3.034477] hctosys: unable to open rtc device (rtc0)

huaxie1988

看启动信息还是高通啊

涛涛桃

huaxie1988 发表于 2025-10-12 16:26
看启动信息还是高通啊

IPQ0518性能还不错

iamyangyi

这机器能中继不和无线桥接不

涛涛桃

iamyangyi 发表于 2026-3-4 00:45
这机器能中继不和无线桥接不

不能中继，可以用tplink的易展

iamyangyi

涛涛桃 发表于 2026-3-6 18:53
不能中继，可以用tplink的易展

可以 我研究出来了。 不过 又买了另外2台