Zyxel P660HW-D1: Actualització de firmware de Telefonica a Zyxel
Per començar ens cal el cable sèrie especial, conectar-lo al Zyxel i engegar l'aplicació de terminal sèrie (Minicom o HyperTerminal). La velocitat per defecte és 9600bps.
Inici
En arrancar el Zyxel premem un tecla per entrar a la BootBase
Bootbase Version: V1.05 | 10/17/2005 11:08:11 RAM: Size = 16384 Kbytes DRAM POST: Testing: 16384K OK FLASH: AMD 16M *1
ZyNOS Version: V3.40(AHF.0)b12 | 7/30/2007 9:59:42
Press any key to enter debug mode within 3 seconds. .......... Enter Debug Mode
Backup de la bootbase
Amb la comanda ATSE obtenim la llavor aleatòria a partir de la que calcular el password, que entrerem amb la comanda ATEN1,password:
ATSE 002CA9CA7BB2 OK ATEN1,43C182A OK
Ara li direm que volem descarregar la bootbase via XMODEM:
ATDO b0000000,4000 Starting XMODEM download...
Guardem el fitxer per seguretat (i referència)
Edicio BootBase
Segons com haguem procedit podem haver de modificar algunes coses de la Bootbase:
- A la direcció 0x3FF8 hi ha d'haver l'adreça MAC del router.
- A la direcció 0x3FD8 hi han els Feature Bits.
Els feature bits verifiquen el tipus de firmware que soportarà la bootbase. Si canviem de sèrie de firmware cal modificar-los.
Per saber el valor, obrim el firmware amb un editor Hexadecimal i busquem la cadena (text) Model 1. Seguidament d'aquest text hi anirà un número també en text ASCII. Cal convertir aquest nombre a hexadecimal (2 bytes) i girar-ne el sexe de paraula (intercanviar els 2 últims amb els 2 primers). Això són els feature bits.
Upload nova bootbase
ATBT1 OK ATUX0 Starting XMODEM upload (CRC mode)....
Upload Firmware
Donat que el firmware és molt més pesat (Mb), és interessant canviar la velocitat del port sèrie a 115200 amb la comanda ATBA5
ATUR Starting XMODEM upload (CRC mode)....
Recursos adicionals
Fitxers
BootBases
Firmwares
Comandes AT
BootBase 1.05
| Comanda | Descripció |
|---|---|
| AT | just answer OK |
| ATHE | print help |
| ATBAx | change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k |
| ATENx,(y) | set BootExtension Debug Flag (y=password) |
| ATSE | show the seed of password generator |
| ATTI(h,m,s) | change system time to hour:min:sec or show current time |
| ATDA(y,m,d) | change system date to year/month/day or show current date |
| ATDS | dump RAS stack |
| ATDT | dump Boot Module Common Area |
| ATDUx,y | dump memory contents from address x for length y |
| ATRBx | display the 8-bit value of address x |
| ATRWx | display the 16-bit value of address x |
| ATRLx | display the 32-bit value of address x |
| ATGO(x) | run program at addr x or boot router |
| ATGR | boot router |
| ATGT | run Hardware Test Program |
| ATRTw,x,y(,z) | RAM test level w, from address x to y (z iterations) |
| ATSH | dump manufacturer related data in ROM |
| ATTD | download router configuration to PC via XMODEM |
| ATUR | upload router firmware to flash ROM |
| ATLC | upload router configuration file to flash ROM |
| ATXSx | xmodem select: x=0: CRC mode(default); x=1: checksum mode |
| ATSR | system reboot |
| ATSP | send packet |
| ATMU | print Multiboot client version |
BootBase 1.06
| Comanda | Descripció |
|---|---|
| AT | just answer OK |
| ATHE | print help |
| ATBAx | change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k |
| ATENx,(y) | set BootExtension Debug Flag (y=password) |
| ATSE | show the seed of password generator |
| ATTI(h,m,s) | change system time to hour:min:sec or show current time |
| ATDA(y,m,d) | change system date to year/month/day or show current date |
| ATDS | dump RAS stack |
| ATDT | dump Boot Module Common Area |
| ATDUx,y | dump memory contents from address x for length y |
| ATWBx,y | write address x with 8-bit value y |
| ATWWx,y | write address x with 16-bit value y |
| ATWLx,y | write address x with 32-bit value y |
| ATRBx | display the 8-bit value of address x |
| ATRWx | display the 16-bit value of address x |
| ATRLx | display the 32-bit value of address x |
| ATGO(x) | run program at addr x or boot router |
| ATGR | boot router |
| ATGT | run Hardware Test Program |
| AT%Tx | Enable Hardware Test Program at boot up |
| ATBTx | block0 write enable (1=enable, other=disable) |
| ATRTw,x,y(,z) | RAM test level w, from address x to y (z iterations) |
| ATWEa(,b,c,d) | write MAC addr, Country code, EngDbgFlag, FeatureBit to flash ROM |
| ATCUx | write Country code to flash ROM |
| ATCB | copy from FLASH ROM to working buffer |
| ATCL | clear working buffer |
| ATSB | save working buffer to FLASH ROM |
| ATBU | dump manufacturer related data in working buffer |
| ATSH | dump manufacturer related data in ROM |
| ATWMx | set MAC address in working buffer |
| ATCOx | set country code in working buffer |
| ATFLx | set EngDebugFlag in working buffer |
| ATSTx | set ROMRAS address in working buffer |
| ATSYx | set system type in working buffer |
| ATVDx | set vendor name in working buffer |
| ATPNx | set product name in working buffer |
| ATMP | check & dump memMapTab |
| ATWZa(,b,c,d) | write ZyXEL MAC addr, Country code, EngDbgFlag, FeatureBit to flaM |
| ATDOx,y | download from address x for length y to PC via XMODEM |
| ATTD | download router configuration to PC via XMODEM |
| ATUPx,y | upload to RAM address x for length y from PC via XMODEM |
| ATUR | upload router firmware to flash ROM |
| ATLC | upload router configuration file to flash ROM |
| ATUXx(,y) | xmodem upload from flash block x to y |
| ATERx,y | erase flash rom from block x to y |
| ATWFx,y,z | copy data from addr x to flash addr y, length z |
| ATXSx | xmodem select: x=0: CRC mode(default); x=1: checksum mode |
| ATSI | run sieve benchmark |
| ATDHx(,y) | run dhrystone benchmark, 1:ver 1.1, 2:ver 2.1, runs y |
| ATSDx | decompress & load image (name=x) |
| ATLOa,b,c,d | Int/Trap Log Cmd |
| ATSR | system reboot |
| ATBR | Reset to default Romfile |
| ATSP | send packet |
| ATMU | print Multiboot client version |
| ATEB | print ExpressBoot client version |
127.0.0.1