360T7刷UBOOT过程变砖如何拯救？（已用编程器救回，感谢各位）

AMDX2xuyuen · 发表于 2023-8-23 23:44

本帖最后由 AMDX2xuyuen 于 2023-8-25 02:48 编辑

备份好所有东西之后没有重启直接刷ubbot，但是命令执行到一半跟其他教程的有点不一样然后就重启了一下就砖了，有什么救援方法吗？

cat /dev/mtd0 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd0 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd4 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd5 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd6 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd7 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd0 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd1 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd2 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd3 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd4 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd5 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd6 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd7 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd8 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd9 | nc 192.168.1.8 3333
root@(none):/# cat /dev/mtd10 | nc 192.168.1.8 3333
root@(none):/# wget -P /tmp http://192.168.1.8/mt7981_360t7-fip-fixed-parts.bin
--1970-01-01 00:45:28--  http://192.168.1.8/mt7981_360t7-fip-fixed-parts.bin
Connecting to 192.168.1.8:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 694785 (679K) [application/octet-stream]
Saving to: '/tmp/mt7981_360t7-fip-fixed-parts.bin'

mt7981_360t7-fip-fi 100%[===================>] 678.50K  --.-KB/s in 0.02s

1970-01-01 00:45:29 (37.6 MB/s) - '/tmp/mt7981_360t7-fip-fixed-parts.bin' saved [694785/694785]

root@(none):/# md5sum /tmp/mt7981_360t7-fip-fixed-parts.bin
45018ceda6c44a61a0baf8e9fc09e25f  /tmp/mt7981_360t7-fip-fixed-parts.bin
root@(none):/# mtd erase fip
Unlocking fip ...
Erasing fip ...
root@(none):/# mtd write /tmp/mt7981_360t7-fip-fixed-parts.bin
Usage: mtd [<options> ...] <command> [<arguments> ...] <device>[:<device>...]

The device is in the format of mtdX (eg: mtd4) or its label.
mtd recognizes these commands:
      unlock                unlock the device
      refresh                refresh mtd partition
      erase                erase all data on device
      verify <imagefile>|- verify <imagefile> (use - for stdin) to device
      write <imagefile>|-    write <imagefile> (use - for stdin) to device
      jffs2write <file>    append <file> to the jffs2 partition on the device
Following options are available:
      -q                   quiet mode (once: no [w] on writing,
                                       twice: no status messages)
      -n                   write without first erasing the blocks
      -r                   reboot after successful command
      -f                   force write without trx checks
      -e <device>          erase <device> before executing the command
      -d <name>             directory for jffs2write, defaults to "tmp"
      -j <name>             integrate <file> into jffs2 data when writing an image
      -s <number>          skip the first n bytes when appending data to the jffs2 partiton, defaults to "0"
      -p <number>          write beginning at partition offset
      -l <length>          the length of data that we want to dump

Example: To write linux.trx to mtd4 labeled as linux and reboot afterwards
      mtd -r write linux.trx linux

root@(none):/# reboot
reboot
root@(none):/# [ 3013.028984] reboot: Restarting system

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL

NOTICE:  BL2: v2.7(release):ct3003_MP_1.0.1.7824_20221102-1-g0bab9ebb
NOTICE:  BL2: Built : 17:32:57, Jan  3 2023
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a003f1 000000ff 00100000 00000000
1001d040 | 00027e71 000200a0 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0xc
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 576, worse bit 4, min window 68
Window Sum 596, worse bit 11, min window 72
Window Sum 554, worse bit 3, min window 68
Window Sum 540, worse bit 9, min window 64
Window Sum 542, worse bit 9, min window 66
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xc8
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 976
NOTICE:  Second info table with writecount 0 found in block 979
NOTICE:  NMBM has been successfully attached in read-only mode
ERROR: BL2: Failed to load image id 3 (-2)

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL

NOTICE:  BL2: v2.7(release):ct3003_MP_1.0.1.7824_20221102-1-g0bab9ebb
NOTICE:  BL2: Built : 17:32:57, Jan  3 2023
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 580, worse bit 4, min window 68
Window Sum 588, worse bit 8, min window 72
Window Sum 560, worse bit 3, min window 68
Window Sum 548, worse bit 9, min window 66
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xc8
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 976
NOTICE:  Second info table with writecount 0 found in block 979
NOTICE:  NMBM has been successfully attached in read-only mode
ERROR: BL2: Failed to load image id 3 (-2)

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL

NOTICE:  BL2: v2.7(release):ct3003_MP_1.0.1.7824_20221102-1-g0bab9ebb
NOTICE:  BL2: Built : 17:32:57, Jan  3 2023
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 584, worse bit 4, min window 68
Window Sum 600, worse bit 11, min window 72
Window Sum 554, worse bit 1, min window 68
Window Sum 546, worse bit 9, min window 66
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xc8
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 976
NOTICE:  Second info table with writecount 0 found in block 979
NOTICE:  NMBM has been successfully attached in read-only mode
ERROR: BL2: Failed to load image id 3 (-2)

ljwan · 发表于 2023-8-24 00:05

这个只能换flash了，都没起到uboot命令行哪里

邪恶海盗 · 发表于 2023-8-24 00:48

我好像看到有条命令不对,应该是与撸主说的"跟其它教程不一样"的原因,根源在于没有按教程操作...

AMDX2xuyuen · 发表于 2023-8-24 09:32

邪恶海盗发表于 2023-8-24 00:48
我好像看到有条命令不对,应该是与撸主说的"跟其它教程不一样"的原因,根源在于没有按教程操作... ...

mtd write /tmp/mt7981_360t7-fip-fixed-parts.bin这条命令是输入进去的，但是显示出来的东西跟教程上的不一样。就是在这个步骤

mycee · 发表于 2023-8-24 10:52

你这是才买的吗，最近不是因为360偷偷换了spi然后一大堆人刷了错版uboot然后变砖的吗，你看看你会不会是这个原因

czkwg8 · 发表于 2023-8-24 11:29

你看看用的flash是不是winbond的
是的话应该要用的新的uboot，那个刚加上了这flash的支持

453395398 · 发表于 2023-8-24 12:08

AMDX2xuyuen 发表于 2023-8-24 09:32
mtd write /tmp/mt7981_360t7-fip-fixed-parts.bin这条命令是输入进去的，但是显示出来的东西跟教程上的 ...

你看的教程有问题，写入的命令是mtd write /tmp/mt7981_360t7-fip-fixed-parts.bin fip，而且其实不需要先erase的。你把fip分区擦除了，但是write命令漏了个参数，导致其实没写进去，重启后直接变砖。
现在要救砖只能上编程器了

fry2022 · 发表于 2023-8-24 12:10

只能上编程器救砖了，前提是你要有编程器固件

邪恶海盗 · 发表于 2023-8-24 13:32

453395398 发表于 2023-8-24 12:08
你看的教程有问题，写入的命令是mtd write /tmp/mt7981_360t7-fip-fixed-parts.bin fip，而且其实不需要 ...

+1,很明显没仔细看教程的结果...

AMDX2xuyuen · 发表于 2023-8-24 17:29

453395398 发表于 2023-8-24 12:08
你看的教程有问题，写入的命令是mtd write /tmp/mt7981_360t7-fip-fixed-parts.bin fip，而且其实不需要 ...

原来如此，哥们好眼神，新手确实没仔细看，erase命令就是擦除命令对吧？

AMDX2xuyuen · 发表于 2023-8-24 17:48

czkwg8 发表于 2023-8-24 11:29
你看看用的flash是不是winbond的
是的话应该要用的新的uboot，那个刚加上了这flash的支持 ...

不是！用的是ESMT P28N502E

13327407816 · 发表于 2023-9-24 20:18

怎么救回的兄弟

arbol57457 · 发表于 2024-6-27 18:41

兄弟，闪存不拆下来，直接飞线能行吗

苍梧 · 发表于 2024-6-30 23:40

大佬，怎么救回来的

nofateyang · 发表于 2024-9-10 14:52

请教一下，编程器怎么把 bl2.img 和 fip.bin 烧进去的？

账号		自动登录	找回密码
密码			立即注册

360T7刷UBOOT过程变砖如何拯救？（已用编程器救回，感谢各位）

相关帖子

点评

点评

点评

点评

欢迎大家光临恩山无线论坛 /2