Request

D3m0n · 14/4/11

No problem , just need the info so we can try see where the problem lies.

smb2700 · 15/4/11

I tried to use the command Ejctrl (0x10000) before the flash cfe and got the same result. As for the bug, i have writing the flash , the software don't crash. I using RC13.5

Engine setup successfully
Detected CPU ID: 0x635817F
Loading manufacturer data from device
Checking for a device specific script
Loading script: agpf.bcs
Creating memory interface (0x0 / 16777216 bytes)
Set AMD default write delay to: 100 ms
Flash device detected: AMD S29GL320 (16777216 bytes)
Located at memory address: 0x1E000000
Programming mode: AMD (16 bit) fast-write algorithum
Setting device parameter (AMD Flash delay) to 0x4B0
Setting device parameter (Memory Read Mode) to 0x1
EJTAG command issued: 0x10000 result: 0x228310
Button Hander::Calling Event: WriteCFE
Address 0x0: wrote 0x10 and read 0x0 (94210 mismatches)
Address 0x0: wrote 0x10 and read 0x0 (94208 mismatches)
Address 0x0: wrote 0x10 and read 0x0 (94206 mismatches)
Error: data verification at 0x0 failed!
Sucessfully flashed 131072 bytes
Programming Flash memory (16777216 bytes)
Address 0x0: wrote 0x10 and read 0xFF (130456 mismatches)
Address 0x0: wrote 0x10 and read 0xFF (130456 mismatches)
Address 0x0: wrote 0x10 and read 0xFF (130456 mismatches)
Error: data verification at 0x0 failed!
Address 0x20000: wrote 0x38 and read 0xFF (130450 mismatches)
Address 0x20000: wrote 0x38 and read 0xFF (130450 mismatches)
Address 0x20000: wrote 0x38 and read 0xFF (130450 mismatches)
Error: data verification at 0x20000 failed!
Address 0x40000: wrote 0xEA and read 0xFF (130542 mismatches)
Address 0x40000: wrote 0xEA and read 0xFF (130542 mismatches)
Address 0x40000: wrote 0xEA and read 0xFF (130542 mismatches)
Error: data verification at 0x40000 failed!
Address 0x60000: wrote 0xAC and read 0xFF (130588 mismatches)
Address 0x60000: wrote 0xAC and read 0xFF (130588 mismatches)
Address 0x60000: wrote 0xAC and read 0xFF (130588 mismatches)
Error: data verification at 0x60000 failed!
Address 0x80000: wrote 0xE1 and read 0xFF (130572 mismatches)
Address 0x80000: wrote 0xE1 and read 0xFF (130572 mismatches)
Address 0x80000: wrote 0xE1 and read 0xFF (130572 mismatches)
Error: data verification at 0x80000 failed!
Address 0xA0000: wrote 0xB7 and read 0xFF (130550 mismatches)
Address 0xA0000: wrote 0xB7 and read 0xFF (130550 mismatches)
Address 0xA0000: wrote 0xB7 and read 0xFF (130550 mismatches)
Error: data verification at 0xA0000 failed!
Address 0xC0000: wrote 0x23 and read 0xFF (130562 mismatches)
Address 0xC0000: wrote 0x23 and read 0xFF (130562 mismatches)
Address 0xC0000: wrote 0x23 and read 0xFF (130562 mismatches)
Error: data verification at 0xC0000 failed!
Address 0xE0000: wrote 0xB4 and read 0xFF (130563 mismatches)
Address 0xE0000: wrote 0xB4 and read 0xFF (130563 mismatches)
Address 0xE0000: wrote 0xB4 and read 0xFF (130563 mismatches)
Error: data verification at 0xE0000 failed!
Address 0x100000: wrote 0x10 and read 0xFF (130583 mismatches)
Address 0x100000: wrote 0x10 and read 0xFF (130583 mismatches)
Address 0x100000: wrote 0x10 and read 0xFF (130583 mismatches)
Error: data verification at 0x100000 failed!
Address 0x120000: wrote 0xAE and read 0xFF (130573 mismatches)
Address 0x120000: wrote 0xAE and read 0xFF (130573 mismatches)
Address 0x120000: wrote 0xAE and read 0xFF (130573 mismatches)
Error: data verification at 0x120000 failed!
Address 0x140000: wrote 0xA4 and read 0xFF (130536 mismatches)
Address 0x140000: wrote 0xA4 and read 0xFF (130536 mismatches)
Address 0x140000: wrote 0xA4 and read 0xFF (130536 mismatches)
Error: data verification at 0x140000 failed!
Address 0x160000: wrote 0x24 and read 0xFF (130560 mismatches)
Address 0x160000: wrote 0x24 and read 0xFF (130560 mismatches)
.....

D3m0n · 16/4/11

Ok thanks for trying that , i am hoping the next software release will have a few issues resolved, and hopefully this will be one of them. I will pass this info onto the developer and see if he has any comments.

Stay tuned.

D3m0n · 2/5/11

@ smb2700 , i sent you an email with a test build to try , but seems , you either never got the email or ??

smb2700 · 3/5/11

Hello, I'm sorry, I checked now, and by mistake was among the spam.

D3m0n · 4/5/11

There is a newer build in the software section now , but you will still need to alter your script accordingly to accommodate the new layout of the script functions.

smb2700 · 4/5/11

I sent the script by email

smb2700 · 4/5/11

This is my script:

# Script file for BCM6358 - 0x0635817F,
# This script is automatically executed when BlackcatUSB

MyDevice = "AGPF" #Name of device
CFEBase = 0x00000000
CFESize = 131072

JTAG.MemoryAddress(0x00000000)
JTAG.MemorySize(0x1000000)
JTAG.MemoryInit()
JTAG.Flashbase(0x1E000000)
JTAG.FlashInit()

#removed this to gain performance. If you have reading issues, uncomment
#SetParam(3,100) #Sets read delay to 0
SetParam(2,1200) #Sets the AMD flash delay to 200
SetParam(4,1) #Sets read mode to 1

t1 = Tab.Create(MyDevice)

Tab(t1).AddGroup("CFE",10,10,420,54)
Tab(t1).AddButton("ReadCFE","Read",130,30)
Tab(t1).AddButton("WriteCFE","Write",220,30)

Tab(t1).AddImage("LOGO","Motorola.gif",45,240)

CreateEvent(ReadCFE)
Status("Reading the CFE")
Tab(t1).ButtonDisable()
MyData = Flash.ReadVerify(CFEBase,CFESize)
if (MyData = Nothing)
Status("Error: data read back failed")
Tab(t1).ButtonEnable()
Exit Event
endif
Prompt = "Choose filename to save the firmware"
SaveFile(MyData,Prompt,"CFE.bin")
Status("Successfully read CFE from Flash")
Tab(t1).ButtonEnable()
EndEvent

CreateEvent(WriteCFE)
Tab(t1).ButtonDisable()
Prompt = "Choose a CFE to write into Flash"
MyData = OpenFile(Prompt,"CFE files (*.bin)|*.bin")
if (MyData = Nothing)
goto WriteCFEExit
endif
if not (Len(MyData) = CFESize)
Status("Error: File is not the size of the CFE")
goto WriteCFEExit
endif
Flash.Write(MyData,CFEBase,CFESize)
Status("New CFE successfully written")
WriteCFEExit:
Tab(t1).ButtonEnable()
EndEvent

D3m0n · 4/5/11

Try this script now ...

smb2700 · 4/5/11

Unfortunately it does not work.

LibUsbDotNet version: 2.2.8.104
BlackcatUSB Script Engine running, build: 150
Welcome to Blackcat USB interfacing software, build: 267
Running on: Microsoft Windows XP Professional (32 bit)
Initializing EJTAG engine
Device connected in JTAG mode: 6,01
Engine setup successfully
Detected CPU ID: 0x635817F
Loading manufacturer data from device
Checking for a device specific script
No script files available
Loading script: AGPF.bcs
Set AMD default write delay to: 100 ms
Flash device detected: AMD S29GL320 (16777216 bytes)
Located at memory address: 0x1E000000
Programming mode: AMD (16 bit) fast-write algorithum
Setting device parameter (Memory Read Delay) to 0x64
Setting device parameter (AMD Flash delay) to 0xFA
Setting device parameter (Memory Read Mode) to 0x1
Tab.AddImage, specified image not found: images\Motorola.gif
Button Hander::Calling Event: WriteCFE
Address 0x0: wrote 0x10 and read 0x0 (94196 mismatches)
Address 0x0: wrote 0x10 and read 0x0 (94205 mismatches)
Address 0x0: wrote 0x10 and read 0x0 (128526 mismatches)
Error: data verification at 0x0 failed!
Write Flash operation complete
131072 bytes written in 15,522 seconds, 8.444 Bytes/s
Sucessfully programmed 131072 bytes

D3m0n · 8/5/11

Sorry for the late reply , i have been slightly busy .

Tell me , have you tried altering the parameters on the script with the new software ? and if so are you getting similar results ?

Is the CFE you are trying similar to this one

Code:

http://darviniano.eu/anselmo/files/hacking_routers/alice_gate/firmware_originale/

found here ?? Asking this so i can test the CFE write on a diff model , if not could you email me the CFE please.

Are you able to get a full flash backup with new software ??

smb2700 · 16/5/11

Hello, cfe okay what you linked, I tried to change SetParam (2.XXX) # Sets the AMD flash delay to 200, but to no avail. I did not try to read the flash, the router is now locked, I have to connect the lpt jtag and flash the cfe.

D3m0n · 19/5/11

Tell me where would i be able to get one of these devices ??, so i can do some proper tests on it , as i am having no issues writing the CFE to different devices , so i am assuming it is the device itself that needs looking into.

smb2700 · 20/5/11

The AGPF is used by telecom Italy. Where are you from?

D3m0n · 26/5/11

Sorry for the late reply again , i am working out of the country at the moment... I am based in the UK , i have searched ebay for one of these devices , but it seems they only have them on ebay.it and none seem to ship to the UK.

D3m0n · 1/6/11

Right i am back ,, tell me is there a place i can get one of these devices ?

smb2700 · 2/6/11

If I want I can buy it and send it. But you never tried to write the CFE on a flash like that of my router?

D3m0n · 3/6/11

if you can get me one that would be great , i would pay you for it , i will send details in an email. I have managed to write the cfe to a different flash with no errors , the problem i have is i do not have one of those flash tsopd available. Also the issue will not be the tsop , but the actual device , we have to find a way to halt the cpu to enable a perfect write.

D3m0n · 14/6/11

@smb2700 , i have emailed you a couple of times , not sure if you got them or not ?

smb2700 · 17/6/11

Yes I read your email and I have also answered (you get my email?), I can just buy a router and I will send agpf.

Request

Administrator

New Member

Administrator

Administrator

New Member

Administrator

New Member

New Member

Administrator

Attachments

New Member

Administrator

New Member

Administrator

New Member

Administrator

Administrator

New Member

Administrator

Administrator

New Member