• Visit https://www.embeddedcomputers.net/ for Hardware; Software and all other things related to FlashcatUSB

6141

mac11

Member
was trying to upload this for the past couple of minutes finally got it, its from a 6141 sbv plz take a look at it plz sir and if possible can you make a script for, thanks alot
 

Attachments

  • 6141.zip
    3.1 MB · Views: 173
Will try for you , i am presently out of the country for a while , but as soon as i am back i will look into it. Is the layout for this model not similar to the sbv6220 ?
 
yes it is i can read and write but writing is no going good, a full dump yes but to put on force or alpha is no going the right places ,, thanks man
 
it needs a script so we can see what is what but i cant construct scripts so i just have to wait on demon or anyone who is able to do so
 
if we could log the serial start, i think we can gather the info needed to write the script, example from an arris cm802a:

Serial Flash [Bus:0 CS:0] : w25q64bv 8192KB, 2048 sectors each 4KB
partitions[0] = {.name = U-Boot, .offset = 0x00000000,.size = 0x00020000 (128K) }
partitions[1] = {.name = env1, .offset = 0x00020000,.size = 0x00010000 (64K) }
partitions[2] = {.name = env2, .offset = 0x00030000,.size = 0x00010000 (64K) }
partitions[3] = {.name = UBFI1, .offset = 0x00040000,.size = 0x003b0000 (3776K) }
partitions[4] = {.name = UBFI2, .offset = 0x003f0000,.size = 0x003b0000 (3776K) }
partitions[5] = {.name = Kernel, .offset = 0x000416bc,.size = 0x000d0d44 (835K) }
partitions[6] = {.name = RootFileSystem, .offset = 0x00112400,.size = 0x00284400 (2577K) }
partitions[7] = {.name = nvram, .offset = 0x007a0000,.size = 0x00050000 (320K) }

also this:

*** ACTIMAGE = 1, will try to boot UBFI1 stored @0x48040000
## Executing script at 48040000
Bad magic number
*** UBFI1 is corrupted, try UBFI2...
## Executing script at 483f0000

I think it will be pretty easy to change an existing script for a similar model (6120?) I hope that the fact that it bonds more channels than the 6120 doesn't mean that it will not be good for testing. I see that it does have a TI chipset, and it's definitely puma5 based, hopefully this can mean alpha or the like.
 
I unsquashed the filesystem and found a file at /etc/agent_cm_production.cnf that had this in a portion of it:

DOCSIS 3.0 Cable Modem <<HW_REV: TNETC550W Rev 03; VENDOR: TI; BOOTR: 1.2; SW_REV: 0.5.0.1; MODEL: Puma-5>>
syscontact Texas Instruments, Inc

I then found this:

https://github.com/duyunfu/U-boot/tree/master/docs

Which may help...
 
Any luck on writing a script to flash this? I have compiled a noisy bootloader for this modem but I am waiting on some definitive flash definitions to test. Here is the bootloader for anyone who wants to try it and let me know how it works. This was compiled using the opensource moto files for the 6141 with the puma5 toolchain. I would really appreciate anyi help I can get in testing this. I only recently opened my 6141, and it was a little tough, it has some catches on the top seam similar to the back of the xbox 360. I did not readily notice serial access, but I may have missed it. If I did not miss it, there is still the possibility of using the trick that people are using for the 6121's that come without a serial port, soldering directly to the chip. If this noisy bootloader works it's definitely a step in the right direction.
 

Attachments

  • uboot.zip
    54.6 KB · Views: 56
Can you get me a proper full dump as the one listed seems to be missing bits , then i can construct a working script.
 
does anyone have one as this is the only one i have ,ill try looking around fah one thanks
 
I'm a little reluctant to post my full dump as it is my legit, subbed modem. Is there any easy way to remove mac/certs that you know of?
 
Also, for the record, forceware will NOT work on this modem out of the box. You can flash it, and it will boot, it will not initialize the tuner though. I have tried to ask mgn about source so I could compile a working kernel and drivers from the opensource stuff, but I don't think he's going to be interested in doing that.
 
its not a problem he just wants it to create a script the one i posted was also a ligit subb, its all good here trust me
 
I think you're missing the point mac11, as far as I understand the flash layout is the same between that 6120 and 6141, the problem is not the layout of the flash, you can either use my 6120 script or the standard 6120 script to flash the modem. The modem will boot fine, but you will get no signal as the tuner is unsupported by forceware. I will open my 6141 today when I get home from work and verify that the layout of the flash is the same. I have the puma5 toolchain compiled and working, and I have the 6141 source, I'm not sure what all is needed to add tuner support, but I have a pretty good idea. I am, however, unsure as to whether or not I can use the unique files from the extracted forceware or not.
 
ill try and get another one of these as soon as i get it ill post a clean dump thanks man
 
here is a dump I have found don,t know if this would help out
 

Attachments

  • 6141.zip
    3.1 MB · Views: 120
Back
Top