Unifi-LR 换FLASH之后无法启动~！

wjh*** · 发表于 2014-12-18 13:12

只要是 7240 9283的主板任何机器我都能刷 unifi ！！能讲下思路吗？

化繁***

piter 发表于 2014-7-10 18:12
怎么个收法？如果价格可以接受，也行~！

50元一个！

zhut***

piter 发表于 2014-7-7 16:51
原来的FLASH用编程器读出来的固件在下面的微云网盘里
http://url.cn/NnonEu

链接已过期，请联系分享者重新分享，或者请楼主发一份到我邮箱，谢谢

jil***

大家讨论一下，unifi是如何分辨真假flash的。山寨uap是切割嫁接的。和原固件有区别

乌***

本帖最后由乌卡卡于 2014-11-17 19:19 编辑

~~~~~~~~~~~~链接已过期

ami***

搞定了吗

shiya***

piter 发表于 2014-7-23 13:55
已经证实是固件加密，但不知道是怎么个加密法，从另一台机器拆FLASH过来可以正常，但是拷贝就不正常~！

LZ能给一下flash芯片的型号不呢？我想研究一下看看。

fdcom***

本帖最后由 fdcomputer 于 2015-12-5 22:33 编辑

看来还是没有解决？？？？

是固件加密无疑了，我倒有一点成功经验分享一下：

昨晚在折腾一只UAP，原flash坏了（编程器校验失败），买了flashrom: w25q64fv
用编程器从另一只好的uap备份了固件，复制后结果如楼主所描述的一样。
然后，我试了中断autoboot
用help查了一下uboot的命令  [原版 U-Boot unifi-v1.5.2.206-g44e4c8bc (Aug 29 2014 - 18:01:57)]
最后成功启动了（UAP亮绿灯）
由于当时太晚了（到5:22am），精神不集中，已经忘记了自己操作的全过程
只记得运行了好多个命令，比较有印像的是如下：
setenv addr 192.168.1.20
setenv serverip 192.168.1.254
saveen
tftp 0x80000000 firmware.bin             --------->  unifi controller v3.2.10自带的升级固件
bootm x9f050000

运行大约1分钟后，UAP竟然变绿灯了（注：备份出来的固件与使用中的其中一只uap一样的MAC）
然后，重启了一下设备，意外出现了，启动提示如下：
U-Boot unifi-v1.5.2.206-g44e4c8bc (Aug 29 2014 - 18:01:57)

DRAM:  64 MB
Flash:  8 MB
PCIe WLAN Module found (tries: 1).
Net: eth0, eth1
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
Board: Ubiquiti Networks AR7241 board (e502-18.0101.002e)
UBNT application initialized
ERROR: Firmware Type Error!
ar7240>

最后操作是断电，按住复位键大约12秒，进行手动升级固件模式，用 tftp32 刷入firmware.bin
AP自动重启，一切工作正常。（后面改MAC的步骤省略……）

现在问题来了：
今早10点爬起来，我用有印象的方法重做了N次，结果都失败了！

现在可以肯定的是与uboot命令和我的操作顺序有关（上述的操作顺序不一定正确）。
ar7240> help
?    - alias for 'help'
base - print or set address offset
bdinfo  - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
chpart  - change active partition
cmp    - memory compare
coninfo - print console devices and information
cp    - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
echo - echo args to console
erase - erase FLASH memory
flinfo  - print FLASH memory information
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
go    - start application at address 'addr'
help - print online help
iminfo  - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loop - infinite loop on address range
ls    - list files in a directory (default /)
md    - memory display
mii    - MII utility commands
mm    - memory modify (auto-incrementing)
mtdparts- define flash/nand partitions
mtest - simple RAM test
mw    - memory write (fill)
nfs    - boot image via network using NFS protocol
nm    - memory modify (constant address)
pci    - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
pll [<val>] - Set to change CPU/AHB/DDR speeds
printenv- print environment variables
progmac - Set ethernet MAC addresses
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run    - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep - delay execution for some time
tftpboot- boot image via network using TFTP protocol
ubntfsboot  - UBNT fsboot command
urescue - start TFTP server and wait for firmware
version - print monitor version
autoscr - run script from memory
ar7240>

以上是uboot的命令列表。
印像中有运行过的命令：
bdinfo
bootm
chpart
coninfo
cp
flinfo
fsinfo
fsload
iminfo
imls
ls
mtdparts
printenv
pci
nfs
protect
rarpboot
saveen
sleep
tftpboot
urescue
version
ubntfsboot

整个操作过程实际是乱来的，但不知道为何固件能正常启动？？？  希望有高手能解答一下！！！
是不是无意中做了所谓的“去验证”呢？

万二分期待ing.....

fdcom*** · 发表于 2015-12-11 10:47

shiyang800 发表于 2015-3-17 20:07
LZ能给一下flash芯片的型号不呢？我想研究一下看看。

W25Q64FV

已经证实加密在最后面64K容量的EEPROM

fdcom***

fdcomputer 发表于 2015-12-5 14:35
看来还是没有解决？？？？

是固件加密无疑了，我倒有一点成功经验分享一下：

初步有结果了，只要换一个64K破解了的ART(EEPROM)，马上就能正常启动。

fdcom***

本帖最后由 fdcomputer 于 2015-12-10 09:52 编辑

呵呵，我遇到同样的问题，已经解决了！在折腾过程中，偶然发现了一些东西，以下方法供参考：

通电后，在固件启动之前中断，进入u-boot命令行:
U-Boot unifi-v1.5.2.206-g44e4c8bc (Aug 29 2014 - 18:01:57)

DRAM:  64 MB
Flash:  8 MB
PCIe WLAN Module found (tries: 1).
Net: eth0, eth1
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
ar7240>
输入以下命令：
ar7240> printenv
bootcmd=run ubntappinit ubntboot
bootdelay=1
ipaddr=192.168.1.20
serverip=192.168.1.254
ubntappinit=go ${ubntaddr} uappinit;go ${ubntaddr} ureset_button;urescue;go ${ubntaddr} uwrite
mtdparts=mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)
ubntboot=bootm 0x9f050000
ethact=eth0
bootargs=console=ttyS0,115200=root=31:03 rootfstype=squashfs init=/init panic=3
stdin=serial
stdout=serial
stderr=serial
ubntaddr=80200020

Environment size: 469/65532 bytes
ar7240>
留意bootargs一行开头，有没有“＝console=ttyS0,", 如果没有，输入以下命令：
ar7240>setenv bootargs=console=ttyS0,115200=root=31:03 rootfstype=squashfs init=/init panic=3
如果需要保存，可以输入：(不保存重启将恢复原本设置）ar7240>saveen

无意中发现，这个参数应该是把固件运行的信息输出到console（TTL）如果不能启正常动，应该会有相应的出错信息，可以从中找出问题原因……

下面是正常的启动过程：
Board: Ubiquiti Networks AR7241 board (e512-57.0101.002e)
UBNT application initialized
## Booting image at 9f050000 ...
Image Name: MIPS Ubiquiti Linux-2.6.32.33
Created:    2015-05-31  23:49:15 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 918694 Bytes = 897.2 kB
Load Address: 80002000
Entry Point:  80002000
Verifying Checksum at 0x9f050040 ...OK
Uncompressing Kernel Image ... OK

Starting kernel ...

Booting...
[ 0.000000] Linux version 2.6.32.33 (build-unifi@ubnt-builder3) (gcc version                                                                                        4.1.2) #1 Sun May 31 16:49:13 PDT 2015
[ 0.000000] flash_size passed from bootloader = 8
[ 0.000000] arg 1: console=ttyS0,115200=root=31:03
[ 0.000000] arg 2: rootfstype=squashfs
[ 0.000000] arg 3: init=/init
[ 0.000000] arg 4: panic=3
[ 0.000000] arg 5: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(ke                                                                                     rnel),6528k(rootfs),256k(cfg),64k(EEPROM)
[ 0.000000] arg 6: mem=64M
[ 0.000000] arg 7: ubootver=unifi-v1.5.2.206-g44e4c8bc
[ 0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[ 0.000000] Determined physical RAM map:
[ 0.000000]  memory: 02000000 @ 00000000 (usable)
[ 0.000000] User-defined physical RAM map:
[ 0.000000]  memory: 04000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00004000
[ 0.000000] Movable zone start PFN for each node
[ 0.000000] early_node_map[1] active PFN ranges
[ 0.000000]    0: 0x00000000 -> 0x00004000
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pag                                                                                     es: 16256
[ 0.000000] Kernel command line: console=ttyS0,115200=root=31:03 rootfstype=s                                                                                     quashfs init=/init panic=3 mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),102                                                                                     4k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM) mem=64M ubootver=unifi-v1.5.2.206                                                                                     -g44e4c8bc
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32                                                                                        bytes
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 62184k/65536k available (1972k kernel code, 3276k reserve                                                                                     d, 480k data, 132k init, 0k highmem)
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] NR_IRQS:128
[ 0.000000] plat_time_init: plat time init done
[ 0.000000] Console: colour dummy device 80x25
[ 0.000000] Calibrating delay loop... 259.07 BogoMIPS (lpj=129536)
[ 0.016000] Mount-cache hash table entries: 512
[ 0.019000] NET: Registered protocol family 16
[ 0.021000] ===== ar7240_platform_init: 0
[ 0.021000] PCIe WLAN H/W found [tries: 1]
[ 0.021000] PCI init:ar7240_pcibios_init
[ 0.021000] ar7240_pcibios_init(368): PCI CMD write: 0x356
[ 0.021000] registering PCI controller with io_map_base unset
[ 0.026000] bio: create slab <bio-0> at 0
[ 0.028000] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[ 0.028000] pci 0000:00:00.0: PME# disabled
[ 0.029000] Returning IRQ 48
[ 0.030000] Switching to clocksource MIPS
[ 0.033000] NET: Registered protocol family 2
[ 0.033000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.035000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.035000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.035000] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.035000] TCP reno registered
[ 0.035000] NET: Registered protocol family 1
[ 0.036000] AR7240 GPIOC major 0
[ 0.038000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.038000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY                                                                                     ) (c) 2001-2006 Red Hat, Inc.
[ 0.038000] msgmni has been set to 121
[ 0.039000] io scheduler noop registered
[ 0.039000] io scheduler deadline registered (default)
[ 0.064000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.066000] serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
[ 0.403000] console [ttyS0] enabled
[ 0.408000] 6 cmdlinepart partitions found on MTD device ar7240-nor0
[ 0.414000] Creating 6 MTD partitions on "ar7240-nor0":
[ 0.419000] 0x000000000000-0x000000040000 : "u-boot"
[ 0.426000] 0x000000040000-0x000000050000 : "u-boot-env"
[ 0.433000] 0x000000050000-0x000000150000 : "kernel"
[ 0.439000] 0x000000150000-0x0000007b0000 : "rootfs"
[ 0.445000] mtd: partition "rootfs" set to be root filesystem
[ 0.451000] 0x0000007b0000-0x0000007f0000 : "cfg"
[ 0.457000] 0x0000007f0000-0x000000800000 : "EEPROM"
[ 0.464000] u32 classifier
[ 0.466000]    Performance counters on
[ 0.470000]    input device check on
[ 0.474000]    Actions configured
[ 0.480000] TCP westwood registered
[ 0.483000] NET: Registered protocol family 17
[ 0.488000] Bridge firewalling registered

[ 0.505000] ar7240wdt_init: Registering WDT success
[ 0.510000] [caution]: last reboot is triggered by WDT!
[ 0.522000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[ 0.530000] Freeing unused kernel memory: 132k freed
[ 0.542000] Please be patient, while UniFi loads ...
[ 1.648000] Algorithmics/MIPS FPU Emulator v1.5
[ 1.952000] ubnthal: module license 'Proprietary' taints kernel.
[ 1.958000] Disabling lock debugging due to kernel taint
[ 2.095000] ubnthal: Ubiquiti UAP-LR
[ 2.098000] ubnthal: Kiwi: maxPower 28 powerOffset 7 txmask 3 antenna 4 [0] gain 0 caps 0x4014
[ 2.210000] gpiodev: (reset_timeout=3 factory_countdown=1000000)
[ 4.789000] **** drop_caches_sysctl_handler: all done timer added ...****
...running /sbin/init
[ 7.347000] SCSI subsystem initialized
[ 7.532000] fuse init (API version 7.13)
[ 7.646000] pktgen 2.72: Packet Generator for packet performance testing.
[ 12.469000] ATHR_GMAC: Length per segment 1536
[ 12.474000] ATHR_GMAC: fifo cfg 3 01f00140
[ 12.478000] ATHR_GMAC: Mac address for unit 0:83a29e7c
[ 12.483000] ATHR_GMAC: xx:xx:xx:xx:xx:xx  [此处显示你的有线网卡的MAC地址]
[ 13.045000] athr_gmac_mii_setup 0
[ 13.049000] Virian MDC CFG Value ==> 6
[ 13.053000] ATHR_GMAC: Max segments per packet : 1
[ 13.058000] ATHR_GMAC: Max tx descriptor count : 80
[ 13.063000] ATHR_GMAC: Max rx descriptor count : 252
[ 13.068000] ATHR_GMAC: Mac capability flags : 4401
[ 13.073000] ATHR_GMAC: Mac address for unit 1:83a29e7c
[ 13.078000] ATHR_GMAC: 02:27:22:e8:3c:1f
[ 13.640000] athr_gmac_mii_setup 1
[ 13.644000] Virian MDC CFG Value ==> 6
[ 13.647000] ATHR_GMAC: Max segments per packet : 1
[ 13.652000] ATHR_GMAC: Max tx descriptor count : 40
[ 13.657000] ATHR_GMAC: Max rx descriptor count : 252
[ 13.663000] ATHR_GMAC: Mac capability flags : 4D81
[ 15.849000] ath_hal: 0.9.17.1 (AR5416, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
[ 16.557000] ath_dfs: Version 2.0.0
[ 16.557000] Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
[ 17.190000] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
[ 18.477000] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
[ 21.306000] ath_pci: 9.2.0_U10.5.13 (Atheros/multi-bss)
[ 21.311000] wevent: registered
[ 21.314000] qos: registered
[ 21.317000] __ath_attach: Set global_scn[0]
[ 21.322000] ACBKMinfree = 48
[ 21.324000] ACBEMinfree = 32
[ 21.327000] ACVIMinfree = 16
[ 21.330000] ACVOMinfree = 0
[ 21.333000] CABMinfree = 48
[ 21.336000] UAPSDMinfree = 0
[ 21.345000] ath_hal: Ubiquiti Kiwi
[ 21.349000] ath_hal: maxPower 56 minPower 0 powerOffset 14
[ 21.356000] [DFS] dfs_attach: use DFS enhancements
[ 21.367000] ath_get_caps[5174] rx chainmask mismatch actual 3 sc_chainmak 0
[ 21.374000] ath_get_caps[5149] tx chainmask mismatch actual 3 sc_chainmak 0
[ 21.410000] wifi0: Atheros 9287: mem=0x10000000, irq=48 hw_base=0xb0000000
Dec 31 16:00:26 crond[668]: crond (busybox 1.11.2) started, log level 5

[ 26.845000] ubnt_roam [BASIC]:Initialized
[ 27.106000] wlan_vap_create : enter. devhandle=0x830f42c0, opmode=IEEE80211_M_STA, flags=0x3
[ 27.115000] wlan_vap_create : exit. devhandle=0x830f42c0, opmode=IEEE80211_M_STA, flags=0x3.
[ 27.124000] VAP device ath0 created
[ 27.166000] setting antenna gain to 0
[ 27.235000] WARNING: Fragmentation with HT mode NOT ALLOWED!!
[ 27.288000] wlan_vap_create : enter. devhandle=0x830f42c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
[ 27.297000] wlan_vap_create : exit. devhandle=0x830f42c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
[ 27.306000] VAP device ath1 created
[ 27.332000] ubnt_roam [BASIC]:UDP TX thread starting
[ 27.371000] ubnt_roam [BASIC]:Radio [830F42C0] for VAP ath0 not found, creating one...
[ 27.474000] ubnt_roam [BASIC]:Radio [830F42C0] for VAP ath1 already created...
[ 27.932000] Ebtables v2.0 registered
[ 28.859000] device eth0 entered promiscuous mode
[ 28.873000] device ath0 entered promiscuous mode
[ 28.888000] device ath1 entered promiscuous mode
[ 28.916000] athr_gmac_ring_alloc Allocated 1280 at 0x83b78000
[ 28.922000] athr_gmac_ring_alloc Allocated 4032 at 0x82d75000
[ 29.229000] athr_gmac_mii_setup 0
[ 29.232000] Virian MDC CFG Value ==> 6
[ 29.236000] Setting Drop CRC Errors, Pause Frames and Length Error frames
[ 29.244000] Setting PHY...
[ 32.270000] ATHR_GMAC: Enet Unit:0 PHY:4 is UP GMii 100Mbps full duplex
[ 32.270000] ATHR_GMAC: done cfg2 0x7115 ifctl 0x10000 miictrl
[ 32.270000] athr_gmac_mii_setup 0
[ 32.270000] Virian MDC CFG Value ==> 6
[ 32.270000] Setting Drop CRC Errors, Pause Frames and Length Error frames
[ 32.345000] br0: port 1(eth0) entering learning state
[ 32.819000] br0: port 3(ath1) entering learning state
[ 33.351000] br0: port 1(eth0) entering forwarding state

Please press Enter to activate this console. [ 33.824000] br0: port 3(ath1) entering forwarding state
[ 35.498000] ubnt_roam [BASIC]:Using IP address 192.168.88.40 for br0...

UBNT login: ubnt
Password:

希望对大家研究UNIFI固件加密有帮助吧！

dsxm***

fdcomputer 发表于 2015-12-9 09:37
W25Q64FV

已经证实加密在最后面64K容量的EEPROM

加密的部分好像也是art里，我研究过用山寨的unifi测试，提取原厂的art参数填上去即可以启动，不过关键你如何提取得到art的参数

fdcom***

dsxmg1990 发表于 2015-12-11 10:47
加密的部分好像也是art里，我研究过用山寨的unifi测试，提取原厂的art参数填上去即可以启动，不过关键你 ...

你意思是替换art吧？

这个方法我也试过，只能对某些型号的产品有效！

现在欠缺的是对UBNT加密方式深入研究的人！！！？？？

PS.如果有人可以破解出来的可以联系我 Q:2728113900, 有人愿意为此pay for money!!!

账号		自动登录	找回密码
密码			立即注册

Unifi-LR 换FLASH之后无法启动~！

点评

点评

点评

点评

点评

欢迎大家光临恩山无线论坛 /1