Project

General

Profile

Actions

Support #4206

open

Unbrick cpe router without web ui interface and terminal

Added by jahcultura over 4 years ago. Updated about 3 years ago.

Status:
New
Priority:
Urgent
Assignee:
-
Target version:
-
Start date:
09/16/2019
Due date:
% Done:

0%

Spec Reference:
Tags:

Description

I have a router 4G cpe modem with linux embedded without web access and terminal does anyone know how to recover? I checked on the board has the points RX, TX, DLOAD, RESET_N, so I saw here only have SMD components so the only way to rewrite the firmware would be for these communication points. Note: I tried access via serial but stops at bootloader.

SERIAL LOG:
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.2-00075
S - IMAGE_VARIANT_STRING=LAATANAZA
S - OEM_IMAGE_VERSION_STRING=ubuntu
S - Boot Config, 0x000002e0
B - 1216 - PBL, Start
B - 3723 - bootable_media_detect_entry, Start
B - 4454 - bootable_media_detect_success, Start
B - 4458 - elf_loader_entry, Start
B - 6701 - auth_hash_seg_entry, Start
B - 6923 - auth_hash_seg_exit, Start
B - 59917 - elf_segs_hash_verify_entry, Start
B - 107892 - PBL, End
B - 97478 - SBL1, Start
B - 146003 - pm_device_init, Start
B - 163114 - PM_SET_VAL:Skip
D - 15890 - pm_device_init, Delta
B - 164120 - boot_config_data_table_init, Start
D - 174948 - boot_config_data_table_init, Delta - (420 Bytes)
B - 342576 - CDT version:3,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0
B - 348767 - sbl1_ddr_set_params, Start
B - 352580 - Pre_DDR_clock_init, Start
D - 244 - Pre_DDR_clock_init, Delta
D - 0 - sbl1_ddr_set_params, Delta
B - 365237 - pm_driver_init, Start
D - 4544 - pm_driver_init, Delta
B - 371642 - cpr_init, Start
D - 91 - cpr_init, Delta
B - 376156 - cpr_cx_mx_apc_vol_update, Start
D - 91 - cpr_cx_mx_apc_vol_update, Delta
B - 391071 - sbl1_qhsusb_al_do_fast_enum, Start
D - 0 - sbl1_qhsusb_al_do_fast_enum, Delta
B - 394060 - clock_init, Start
D - 152 - clock_init, Delta
B - 399855 - boot_flash_init, Start
D - 28670 - boot_flash_init, Delta
B - 500230 - Image Load, Start
D - 78172 - QSEE Image Loaded, Delta - (490820 Bytes)
B - 580049 - sbl1_efs_handle_cookies, Start
D - 0 - sbl1_efs_handle_cookies, Delta
B - 585661 - Devcfg Partition does not exist
B - 589839 - Image Load, Start
D - 518 - SEC Image Loaded, Delta - (2048 Bytes)
B - 597800 - Image Load, Start
D - 31994 - RPM Image Loaded, Delta - (152400 Bytes)
B - 629825 - Image Load, Start
D - 58804 - APPSBL Image Loaded, Delta - (367664 Bytes)
B - 688690 - QSEE Execution, Start
D - 152 - QSEE Execution, Delta
B - 694393 - SBL1, End
D - 599203 - SBL1, Delta
S - Throughput, 3000 KB/s (1013352 Bytes, 321860 us)
S - DDR Frequency, 240 MHz
Android Bootloader - UART_DM Initialized!!!
[0] welcome to lk
-----------------------------------------------------------------------
DMESG PART :

[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.18.20 (wangshihong@ubuntu-238) (gcc version 4.9.2 (GCC) ) #1 PREEMPT Mon Oct 22 19:35:14 CST 2018
[ 0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] Machine model: Qualcomm Technologies, Inc. MDM
------------------------------------------------------------------------------------------------
Technical Specifications

LTE Support Bands FDD Band 1/3/5/7/8/28
WCDMA 850Mhz and 2100MHz
CPU frequency 533MHz
Flash + Memory 4Gb + 2 Gb DDR2
WIFI
2T2R 2.4GHz
802.11b/g/n, 300Mbps
Interface
1 x Power DC Port :
DC12V/1A
1 x RJ11
1x RJ45
10Mbps/100Mbps/1000
Mbps WAN/LAN Port
1x Power Button
1x Reset Button
1x WPS Button
1x 2FF Standard SIM card slot
1x USB port


Files

869931025394402.jpg View 869931025394402.jpg 18.5 KB jahcultura, 09/16/2019 10:36 AM
226914030907596.jpg View 226914030907596.jpg 27.1 KB jahcultura, 09/16/2019 10:37 AM
Actions #1

Updated by KodaTrinktKaffee about 3 years ago

FOR RECORD, this device is sold in Brazil by the company TrĂ³pico and is named VLT I 5.

I was able to gain access by the Serial port utilizing an Arduino UNO, and after the boot is possible to type a username and password.
The method I used to send the commands was by "echo 'command' > device_conected"
You will aim for the username "root" and the password is "oelinux123". After authentication, I renamed the Telnetd service removing the "not run" stuff, rebooted and works fine.
It appears to be running a modified version of a Qualcom firmware.

Actions

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 48.8 MB)