螃蟹芯片的路由怎么修改mac

mury

一个二手仕牌路由型号：sp-wr1200用的是RTL8197DN+RTL8367RB+RTL8192ER+RTL8812AR的组合。想把路由mac改回原来的，从网上下载了编程器固件，修改mac后发现路由启动后总是重置mac成00e04c8196c1，pin值重置成15000279。谁知道怎么才能修改成自己想要的mac？以下是ttl信息:
Booting...
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@ chip__no chip__id mfr___id dev___id cap___id size_sft dev_size chipSize
@ 0000000h 0010215h 0000001h 0000002h 0000015h 0000001h 0000016h 0400000h
@ blk_size blk__cnt sec_size sec__cnt pageSize page_cnt chip_clk chipName
@ 0010000h 0000040h 0010000h 0000040h 0000100h 0000100h 000002dh S25FL032A
@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

---RealTek(RTL8196D)at 2014.02.10-18:50+0800 v1.1 [16bit](659MHz)
no sys signature at 00010000!
no sys signature at 00020000!
no sys signature at 00030000!
no sys signature at 00011000!
no sys signature at 00012000!
no sys signature at 00013000!
no sys signature at 00014000!
no sys signature at 00015000!
no sys signature at 00016000!
no sys signature at 00017000!
no sys signature at 00018000!
no sys signature at 00019000!
no sys signature at 0001A000!
no sys signature at 0001B000!
no sys signature at 0001C000!
no sys signature at 0001D000!
no sys signature at 0001E000!
no sys signature at 0001F000!
no sys signature at 00021000!
no sys signature at 00022000!
no sys signature at 00023000!
no sys signature at 00024000!
no sys signature at 00025000!
no sys signature at 00026000!
no sys signature at 00027000!
no sys signature at 00028000!
no sys signature at 00029000!
no sys signature at 0002A000!
no sys signature at 0002B000!
no sys signature at 0002C000!
no sys signature at 0002D000!
no sys signature at 0002E000!
no sys signature at 0002F000!
no sys signature at 00031000!
no sys signature at 00032000!
no sys signature at 00033000!
no sys signature at 00034000!
no sys signature at 00035000!
no sys signature at 00036000!
no sys signature at 00037000!
no sys signature at 00038000!
no sys signature at 00039000!
no sys signature at 0003A000!
no sys signature at 0003B000!
no sys signature at 0003C000!
no sys signature at 0003D000!
no sys signature at 0003E000!
no sys signature at 0003F000!
no rootfs signature at 000E0000!
no rootfs signature at 000F0000!
no rootfs signature at 00130000!
no rootfs signature at 000E1000!
no rootfs signature at 000E2000!
no rootfs signature at 000E3000!
no rootfs signature at 000E4000!
no rootfs signature at 000E5000!
no rootfs signature at 000E6000!
no rootfs signature at 000E7000!
no rootfs signature at 000E8000!
no rootfs signature at 000E9000!
no rootfs signature at 000EA000!
no rootfs signature at 000EB000!
no rootfs signature at 000EC000!
no rootfs signature at 000ED000!
no rootfs signature at 000EE000!
no rootfs signature at 000EF000!
no rootfs signature at 000F1000!
no rootfs signature at 000F2000!
no rootfs signature at 000F3000!
no rootfs signature at 000F4000!
no rootfs signature at 000F5000!
no rootfs signature at 000F6000!
no rootfs signature at 000F7000!
no rootfs signature at 000F8000!
no rootfs signature at 000F9000!
no rootfs signature at 000FA000!
no rootfs signature at 000FB000!
no rootfs signature at 000FC000!
no rootfs signature at 000FD000!
no rootfs signature at 000FE000!
no rootfs signature at 000FF000!
no rootfs signature at 00100000!
no rootfs signature at 00101000!
no rootfs signature at 00102000!
no rootfs signature at 00103000!
no rootfs signature at 00104000!
no rootfs signature at 00105000!
no rootfs signature at 00106000!
no rootfs signature at 00107000!
no rootfs signature at 00108000!
no rootfs signature at 00109000!
no rootfs signature at 0010A000!
no rootfs signature at 0010B000!
no rootfs signature at 0010C000!
no rootfs signature at 0010D000!
no rootfs signature at 0010E000!
no rootfs signature at 0010F000!
no rootfs signature at 00110000!
no rootfs signature at 00111000!
no rootfs signature at 00112000!
no rootfs signature at 00113000!
no rootfs signature at 00114000!
no rootfs signature at 00115000!
no rootfs signature at 00116000!
no rootfs signature at 00117000!
no rootfs signature at 00118000!
no rootfs signature at 00119000!
no rootfs signature at 0011A000!
no rootfs signature at 0011B000!
no rootfs signature at 0011C000!
no rootfs signature at 0011D000!
no rootfs signature at 0011E000!
no rootfs signature at 0011F000!
no rootfs signature at 00120000!
no rootfs signature at 00121000!
no rootfs signature at 00122000!
no rootfs signature at 00123000!
no rootfs signature at 00124000!
no rootfs signature at 00125000!
no rootfs signature at 00126000!
no rootfs signature at 00127000!
no rootfs signature at 00128000!
no rootfs signature at 00129000!
no rootfs signature at 0012A000!
no rootfs signature at 0012B000!
no rootfs signature at 0012C000!
no rootfs signature at 0012D000!
no rootfs signature at 0012E000!
no rootfs signature at 0012F000!
no rootfs signature at 00131000!
no rootfs signature at 00132000!
no rootfs signature at 00133000!
no rootfs signature at 00134000!
no rootfs signature at 00135000!
no rootfs signature at 00136000!
no rootfs signature at 00137000!
no rootfs signature at 00138000!
no rootfs signature at 00139000!
no rootfs signature at 0013A000!
no rootfs signature at 0013B000!
no rootfs signature at 0013C000!
no rootfs signature at 0013D000!
no rootfs signature at 0013E000!
no rootfs signature at 0013F000!
no rootfs signature at 00140000!
no rootfs signature at 00141000!
no rootfs signature at 00142000!
no rootfs signature at 00143000!
no rootfs signature at 00144000!
no rootfs signature at 00145000!
no rootfs signature at 00146000!
no rootfs signature at 00147000!
no rootfs signature at 00148000!
no rootfs signature at 00149000!
no rootfs signature at 0014A000!
no rootfs signature at 0014B000!
no rootfs signature at 0014C000!
no rootfs signature at 0014D000!
no rootfs signature at 0014E000!
no rootfs signature at 0014F000!
no rootfs signature at 00150000!
no rootfs signature at 00151000!
no rootfs signature at 00152000!
no rootfs signature at 00153000!
no rootfs signature at 00154000!
no rootfs signature at 00155000!
no rootfs signature at 00156000!
no rootfs signature at 00157000!
no rootfs signature at 00158000!
no rootfs signature at 00159000!
no rootfs signature at 0015A000!
no rootfs signature at 0015B000!
no rootfs signature at 0015C000!
no rootfs signature at 0015D000!
no rootfs signature at 0015E000!
no rootfs signature at 0015F000!
no rootfs signature at 00160000!
no rootfs signature at 00161000!
no rootfs signature at 00162000!
no rootfs signature at 00163000!
no rootfs signature at 00164000!
no rootfs signature at 00165000!
no rootfs signature at 00166000!
no rootfs signature at 00167000!
no rootfs signature at 00168000!
no rootfs signature at 00169000!
no rootfs signature at 0016A000!
no rootfs signature at 0016B000!
no rootfs signature at 0016C000!
no rootfs signature at 0016D000!
no rootfs signature at 0016E000!
no rootfs signature at 0016F000!
Jump to image start=0x80500000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003400
Realtek WLAN driver - version 1.6 (2013-02-21)
DFS function - version 1.0.22
8812 mp chip !!

#######################################################
SKB_BUF_SIZE=3600 MAX_SKB_NUM=768
#######################################################

#######################################################
SKB_BUF_SIZE=3600 MAX_SKB_NUM=768
#######################################################


Probing RTL8186 10/100 NIC-kenel stack size order[3]...
chip name: 8196C, chip revid: 0
NOT YET
eth0 added. vid=9 Member port 0x2...
eth1 added. vid=8 Member port 0x1...
eth2 added. vid=9 Member port 0x4...
eth3 added. vid=9 Member port 0x8...
eth4 added. vid=9 Member port 0x10...
eth5 added. vid=9 Member port 0x0...
[peth0] added, mapping to [eth1]...
Realtek FastPath:v1.03
init started: BusyBox v1.13.4 (2016-01-15 19:41:06 CST)
HW configuration invalid, reset default!
Generated PIN = 15000279
******************
sysconf init gw all
***************
MIB Version update
setMIB end...
Init Start...
******************
sysconf wlanapp kill wlan0
***************
password ==00e04c8196c1
!!! adjust 5G 2ndoffset for 8812 !!!
******************
sysconf wlanapp kill wlan1
***************
getssid ====RTK 11n AP 2.4G ,ssidBuf==11N_8196D1
password ==00e04c8196d1
Init bridge interface...
<=== FirmwareDownload8812()
[MAC_REG_8192Emp]
[PHY_REG_8192Emp]
[AGC_TAB_8192Emp]
[RadioA_8192Emp]
[RadioB_8192Emp]
Init Wlan application...
WiFi Simple Config v2.14-wps2.0 (2014.04.02-09:07+0000).
Register to wlan0
Register to wlan1
route: SIOCDELRT: No such process
IEEE 802.11f (IAPP) using interface br0 (v1.8)
Init WAN Interface...
start samba
iwcontrol RegisterPID to (wlan0)
iwcontrol RegisterPID to (wlan1)
boa: server version Boa/0.94.14rc21
boa: server built Jan 28 2016 at 14:44:04.
boa: starting server pid=1064, port 80
#

盐巴下酒

mtd_get_mac_ascii()
{
        local mtdname="$1"
        local key="$2"
        local part
        local mac_dirty

        part=$(find_mtd_part "$mtdname")
        if [ -z "$part" ]; then
                echo "mtd_get_mac_ascii: partition $mtdname not found!" >&2
                return
        fi

        mac_dirty=$(strings "$part" | sed -n 's/^'"$key"'=//p')

        # "canonicalize" mac
        [ -n "$mac_dirty" ] && macaddr_canonicalize "$mac_dirty"
}

mtd_get_mac_binary() {
        local mtdname="$1"
        local offset="$2"
        local part

        part=$(find_mtd_part "$mtdname")
        if [ -z "$part" ]; then
                echo "mtd_get_mac_binary: partition $mtdname not found!" >&2
                return
        fi

        dd bs=1 skip=$offset count=6 if=$part 2>/dev/null | hexdump -v -n 6 -e '5/1 "%02x:" 1/1 "%02x"'
}

盐巴下酒

应该是system.sh脚本中的这两个函数起作用，可是我还是找不出MAC在FLASH中的存放地址。offset不知道是多少，头痛！

mury

盐巴下酒 发表于 2017-10-22 22:40
应该是system.sh脚本中的这两个函数起作用，可是我还是找不出MAC在FLASH中的存放地址。offset不知道是多少 ...

我用的是原厂固件，无法修改成自己想要的mac。症状是修改mac后，系统会在启动时将mac重置成00:e0:4c:81:96:c1和00:e0:4c:81:96:d1，pin也重置成15000279，而且是将闪存里存放mac和pin的部分清空重写了。mac存放在编程器固件的6000起始的部分。

盐巴下酒

mury 发表于 2017-10-26 21:30
我用的是原厂固件，无法修改成自己想要的mac。症状是修改mac后，系统会在启动时将mac重置成00:e0:4c:81:9 ...

这个，只有在SDK源代码找找看吧

AR9341

螃蟹路由MAC都是改不了！