4

I have an ISP-provided router, Huawei B5318-42. I connected to it through UART and a UART-USB converter, copied the output from boot, and managed to figure out which chip is the onboard flash memory. By putting a jumper connected to onboard VCC on the flash memory, I am able stop boot at certain points w/o it being able to recover or continue, but that hasn't helped me get a shell. There is a point at boot (#Reset_MT7530) where there is a timer and four options (one of which is command prompt!) but I cannot choose anything.

This is what I have so far:

Flash memory data sheet: http://static6.arrow.com/aropdfconversion/ad37e5e560057875befe533ab753d2eb5063011f/125413166402097mx25l25635f203v20256mb20v1.5.pdf

I know it runs BusyBox and vPort Release +D2Tech+ VPORT_R_1_6_91 based on boot sequence.

It is MIPS architercture.

Raw output after pressing reset on the router:

    press for several seconds
ralink_gpio: sending a SIGUSR2 to process 332
[Reboot.sh]: start reboot......
unkown led action
[CM]:send reboot msg to ODU.
[CM]:send msg magic:0xaabbccdd, class:0x80, msgtype:0x40.
press for several seconds
ralink_gpio: sending a SIGUSR2 to process 332
[CM]:send reboot msg to ODU.
[CM]:send reboot msg to ODU.
[Reboot.sh]: start reboot......
unkown led action
[CM]:send msg magic:0xaabbccdd, class:0x80, msgtype:0x40.
1 /sbin/miniupnpd.sh remove && at^tmode=3
[CM]:send reboot msg to ODU.
[CM]:send reboot msg to ODU.
1 /sbin/miniupnpd.sh remove && at^tmode=3
[CM]:send reboot msg to ODU.
modem have no response.
usb 2-1: USB disconnect, device number 2
usb 2-1: [DBG HUB]Lock device done, device number 2
usb 2-1: [DBG HUB]mutex_lock hcd->bandwidth_mutex done, device number 2
usb 2-1: [DBG MESSAGE]set all interface unregister 2
usb 2-1: [DBG MESSAGE]remove interface 0
usb 2-1: [DBG MESSAGE]device delete interface 0
eth_data: unregister 'huawei_ether', usb-xhc_mtk-1, Huawei Ethernet Device
usb 2-1: [DBG MESSAGE]remove interface 1
usb 2-1: [DBG MESSAGE]device delete interface 1
eth_voip: unregister 'huawei_ether', usb-xhc_mtk-1, Huawei Ethernet Device
usb 2-1: [DBG MESSAGE]remove interface 2
usb 2-1: [DBG MESSAGE]device delete interface 2
eth_tr069: unregister 'huawei_ether', usb-xhc_mtk-1, Huawei Ethernet Device
usb 2-1: [DBG MESSAGE]remove interface 3
usb 2-1: [DBG MESSAGE]device delete interface 3
usbcomm0: unregister 'huawei_ether', usb-xhc_mtk-1, Huawei Ethernet Device
fxz-hw_stop: called
usb 2-1: [DBG MESSAGE]remove interface 4
usb 2-1: [DBG MESSAGE]device delete interface 4
option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0
option 2-1:1.4: device disconnected


OK


usb 2-1: [DBG MESSAGE]remove interface 5
usb 2-1: [DBG MESSAGE]device delete interface 5
option1 ttyUSB1: GSM modem (1-port) converter now disconnected from ttyUSB1
option 2-1:1.5: device disconnected
usb 2-1: [DBG MESSAGE]remove interface 6
usb 2-1: [DBG MESSAGE]device delete interface 6
option1 ttyUSB2: GSM modem (1-port) converter now disconnected from ttyUSB2
option 2-1:1.6: device disconnected
usb 2-1: [DBG MESSAGE]remove interface 7
usb 2-1: [DBG MESSAGE]device delete interface 7
option1 ttyUSB3: GSM modem (1-port) converter now disconnected from ttyUSB3
option 2-1:1.7: device disconnected
usb 2-1: [DBG MESSAGE]remove all interface_ep_devs 2
usb 2-1: [DBG MESSAGE]set all interface NULL 2
usb 2-1: [DBG MESSAGE]set device state ADDRESS done 2
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
xhc_mtk xhc_mtk: [MTK]Doesn't find ep_sch instance when removing endpoint
usb 2-1: [DBG HUB]usb_disable_device done, device number 2
usb 2-1: [DBG HUB]mutex_unlock hcd->bandwidth_mutex done, device number 2
usb 2-1: [DBG HUB]usb_remove_ep_devs done, device number 2
usb 2-1: [DBG HUB]usb_unlock_device done, device number 2
[ModemReboot]: usb net disconnect.
VAPP is shuting down
vapp_sip_manage.c 131: Stopping SIP
[ 3: 7:54.621340][LCM]:signal 15 exit.
[CM]:cm process is killed:15
[CM]:send reboot msg to ODU.
SHUTDOWN - _VAPP_mgmtEventWriteTask
[CM]:send reboot msg to ODU.
SHUTDOWN - sipUaHandlerTask. infc:0
Stopped WatchDog Timer.
Restarting system.


===================================================================

            MT7621   stage1 code Mar 12 2015 14:43:30 (ASIC)

            CPU=500000000 HZ BUS=166666666 HZ

==================================================================

Change MPLL source from XTAL to CR...

do MEMPLL setting..

MEMPLL Config : 0x11000000

3PLL mode + External loopback

=== XTAL-40Mhz === DDR-1200Mhz ===

PLL2 FB_DL: 0x6, 1/0 = 584/440 19000000

PLL3 FB_DL: 0xf, 1/0 = 577/447 3D000000

PLL4 FB_DL: 0x14, 1/0 = 589/435 51000000

do DDR setting..[01F40000]

Apply DDR3 Setting...(use default AC)

          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120

      --------------------------------------------------------------------------------

0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1

000E:|    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1

000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0

0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0

0011:|    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0    0

0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

DRAMC_DQSCTL1[0e0]=13000000

DRAMC_DQSGCTL[124]=80000033

rank 0 coarse = 15

rank 0 fine = 72

B:|    0    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0

opt_dle value:11

DRAMC_DDR2CTL[07c]=C287223D

DRAMC_PADCTL4[0e4]=000022B3

DRAMC_DQIDLY1[210]=0C0B070B

DRAMC_DQIDLY2[214]=07090909

DRAMC_DQIDLY3[218]=0D0A0909

DRAMC_DQIDLY4[21c]=0B080C0A

DRAMC_R0DELDLY[018]=0000211F

==================================================================

        RX  DQS perbit delay software calibration 

==================================================================

1.0-15 bit dq delay value

==================================================================

bit|     0  1  2  3  4  5  6  7  8  9

--------------------------------------

0 |    11 7 11 11 9 9 9 7 7 7 

10 |    8 9 9 11 7 11 

--------------------------------------




==================================================================

2.dqs window

x=pass dqs delay value (min~max)center 

y=0-7bit DQ of every group

input delay:DQS0 =31 DQS1 = 33

==================================================================

bit DQS0     bit      DQS1

0  (1~62)31  8  (1~62)31

1  (1~62)31  9  (1~62)31

2  (1~62)31  10  (1~62)31

3  (1~59)30  11  (0~58)29

4  (1~62)31  12  (1~63)32

5  (1~62)31  13  (1~64)32

6  (1~62)31  14  (0~65)32

7  (1~62)31  15  (2~64)33

==================================================================

3.dq delay value last

==================================================================

bit|    0  1  2  3  4  5  6  7  8   9

--------------------------------------

0 |    11 7 11 12 9 9 9 7 9 9 

10 |    10 13 10 12 8 11 

==================================================================

==================================================================

     TX  perbyte calibration 

==================================================================

DQS loop = 15, cmp_err_1 = ffff0000 

dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 

dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 

DQ loop=15, cmp_err_1 = ffff0000

dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1 

dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2 

byte:0, (DQS,DQ)=(8,8)

byte:1, (DQS,DQ)=(8,8)

DRAMC_DQODLY1[200]=88888888

DRAMC_DQODLY2[204]=88888888

20,data:88

[EMI] DRAMC calibration passed




===================================================================

            MT7621   stage1 code done 

            CPU=500000000 HZ BUS=166666666 HZ

===================================================================



U-Boot 1.1.3 (Oct 20 2016 - 14:48:59)


Board: Ralink APSoC DRAM:  128 MB

relocate_code Pointer at: 87fb8000


Config XHCI 40M PLL 

******************************

Software System Reset Occurred

******************************

flash manufacture id: c2, device id 20 19

find flash: MX25L25635E

*** Warning - bad CRC, using default environment


============================================ 

Ralink UBoot Version: 4.3.0.0

-------------------------------------------- 

ASIC MT7621A DualCore (MAC to MT7530 Mode)

DRAM_CONF_FROM: Auto-Detection 

DRAM_TYPE: DDR3 

DRAM bus: 16 bit

Xtal Mode=5 OCP Ratio=1/3

Flash component: SPI Flash

Date:Oct 20 2016  Time:14:48:59

============================================ 

icache: sets:256, ways:4, linesz:32 ,total:32768

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 880 MHZ #### 

 estimate memory size =128 Mbytes

#Reset_MT7530


Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial. 

   9: Load Boot Loader code then write to Flash via TFTP. 

 4  3  2  1  0 



3: System Boot system code via Flash[1st image].

## Booting image at bc050000 ...

Skip checking image magic number

   Image Name:   

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    9748152 Bytes =  9.3 MB

   Load Address: 80001000

   Entry Point:  8000d210

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 8000d210) ...

## Giving linux memsize in MB, 128


Starting kernel ...




LINUX started...

 THIS IS ASIC
Linux version 2.6.36 (root@pesi-xian) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP PREEMPT Thu Dec 15 16:55:50 CST 2016

 The CPU feqenuce set to 880 MHz
GCMP present
CPU revision is: 0001992f (MIPS 1004Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 08000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00008000
Detected 3 available secondary CPU(s)
PERCPU: Embedded 7 pages/cpu @81103000 s7424 r8192 d13056 u65536
pcpu-alloc: s7424 r8192 d13056 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0 console=ttyS1,57600 root=/dev/ram0 rootfstype=squashfs,jffs2 isolcpus=1
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Writing ErrCtl register=00008001
Readback ErrCtl register=00008001
Memory: 115720k/131072k available (4558k kernel code, 15352k reserved, 1583k data, 7568k init, 0k highmem)
Hierarchical RCU implementation.
    Verbose stalled-CPUs detection is disabled.
NR_IRQS:128
Trying to install interrupt handler for IRQ24
Trying to install interrupt handler for IRQ25
Trying to install interrupt handler for IRQ22
Trying to install interrupt handler for IRQ9
Trying to install interrupt handler for IRQ10
Trying to install interrupt handler for IRQ11
Trying to install interrupt handler for IRQ12
Trying to install interrupt handler for IRQ13
Trying to install interrupt handler for IRQ14
Trying to install interrupt handler for IRQ16
Trying to install interrupt handler for IRQ17
Trying to install interrupt handler for IRQ18
Trying to install interrupt handler for IRQ19
Trying to install interrupt handler for IRQ20
Trying to install interrupt handler for IRQ21
Trying to install interrupt handler for IRQ23
Trying to install interrupt handler for IRQ26
Trying to install interrupt handler for IRQ27
Trying to install interrupt handler for IRQ28
Trying to install interrupt handler for IRQ15
Trying to install interrupt handler for IRQ8
Trying to install interrupt handler for IRQ29
Trying to install interrupt handler for IRQ30
Trying to install interrupt handler for IRQ31
console [ttyS1] enabled
Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
launch: starting cpu1
launch: cpu1 gone!
CPU revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
launch: starting cpu2
launch: cpu2 gone!
CPU revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
launch: starting cpu3
launch: cpu3 gone!
CPU revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Brought up 4 CPUs
Synchronize counters across 4 CPUs: done.
NET: Registered protocol family 16
release PCIe RST: RALINK_RSTCTRL = 7000000
PCIE PHY initialize
***** Xtal 40MHz *****
start MT7621 PCIe register access
RALINK_RSTCTRL = 7000000
RALINK_CLKCFG1 = 77ffeff8

*************** MT7621 PCIe RC mode *************
PCIE0 no card, disable it(RST&CLK)
PCIE1 no card, disable it(RST&CLK)
PCIE2 no card, disable it(RST&CLK)
pcie_link status = 0x0
RALINK_RSTCTRL= 0
bio: create slab <bio-0> at 0
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource Ralink Systick timer
usbcore: registered new interface driver huawei_ether
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
cu: Got hangup signal
Connected.
Connected.

Disconnected.

Do I stop boot at a certain point, by pointing a voltage or ground to the pins of the flash memory? Soldering the flash memory off the board is also an option but way too extreme for me to attempt this early on.

Any and all help is appreciated.

Improve this question
4
  • Your best bet is probably to desolder the flash and create a copy on another chip with a cleanly built u-boot from source or at least a patched kernel command line. You could also consider changing the root partition or squashfs that becomes it or whatever.
    – Chris Stratton
    Sep 3, 2019 at 21:10
  • Will do as soon as I can get my hands on the bus pirate. I didn't get your last sentence though. Squashfs? @ChrisStratton
    – rddead
    Sep 4, 2019 at 0:48
  • A bus pirate is hardly the only suitable tool. squashfs is something you'll need to be familiar with if you want to get anywhere in modifying embedded Linux systems.
    – Chris Stratton
    Sep 4, 2019 at 1:17
  • Noted, any other tools I should familiarize myself with? @ChrisStratton
    – rddead
    Sep 4, 2019 at 10:11

2 Answers 2

Reset to default
3

I hope you could already solve your problem. Just in case that you are still struggling I want to share my ideas with you.

I just want to point out that I am not 100% sure.

As Gogeta70 already said you can connect directly to your flash chip's I/O pins. The Bus Pirate is a good option to do so since it's not so expensive and it seems that you're lucky. You already found out that your flash is the MX25L25635EF from Macronix. You can check out on the flashrom webpage that this device is part of the supported devices list. https://flashrom.org/Supported_hardware

However if you decide to go for that you have to keep in mind that it is possible to get a few problems if you don't desolder it. I just wanted to point this out so that you don't get frustrated if you connect it while it is still soldered to the board and you don't reveive the result that you want. On flashroms webpage there is a troubleshooting section for such a case. If nothing else works you can still try to desolder the flash from the board. https://flashrom.org/ISP

There is an other thing that you can try to do. I did this with a NAND flash that I worked with a month ago to get access to the busybox. You will still need access to your flash for that because you have to access the Chip Select Pin. I would only recommend doing this if you can afford to destroy the device.

I think the interesting part is where he asks you to choose an option. Right after this the bootloader starts to boot the system via flash.

    Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial. 

   9: Load Boot Loader code then write to Flash via TFTP. 

 4  3  2  1  0 



3: System Boot system code via Flash[1st image].

## Booting image at bc050000 ...

I would try to pull CS towards GND right before the counter hits zero. In my case I had a counter like yours and at the end the bootloader started to boot from the flash. When I pulled CS towards ground he couldn't access the flash anymore and I got directly into busybox console where I could explore the file system.

Improve this answer
4
  • Thank you so much! I've lost my current TTL -> USB converter to stupidity and I'm waiting on a new one + a bus pirate to ship, but this gives me some ideas. The device is disposable, yes. I'll edit the question once the bus pirate arrives.
    – rddead
    Oct 11, 2019 at 15:39
  • Alright. I am curious how it goes. I hope everything works out fine for you.
    – Ramazuri
    Oct 15, 2019 at 5:22
  • @rddead These shipping times are killing me!
    – Himal
    Sep 18, 2020 at 2:05
  • @Himal haha! I completely forgot about updating this. Ramazuri's answer is now accepted.
    – rddead
    Sep 21, 2020 at 10:24
2

So you're trying to get a boot shell. To do what? Are you trying to dump the flash memory?

In any case, you say that you don't have the option to boot into shell, but the text from your dump says otherwise:

Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial. 

   9: Load Boot Loader code then write to Flash via TFTP.

If you press '4', you should get a boot shell. Have you tried this?

If you are pressing a number (followed by enter) and it doesn't seem to respond, I'd double check that your UART bridge is actually sending your keypresses over.

Failing that, you have a few other avenues you can take. You could try connecting directly to the flash chip's I/O pins and using something like a Bus Pirate with flashrom to read the firmware straight off the chip. From there, you can start reverse engineering the firmware a bit to understand the boot process. You may even be able to modify the firmware to give you a boot shell.

Another thing could try is finding a JTAG connection on the board. If you do, you can try talking to the microprocessor with OpenOCD and from there you can do pretty much whatever you want - you control the processor.

Also, I'm not sure how you're jumpering VCC to your flash memory chip, but I'd be careful doing anything to the flash chip that it wasn't designed for - you don't want to fry it, right?

Improve this answer
4
  • I have tried to press 4, using both cu and minicom (connecting from Linux terminal) but it's not being sent. I think it's related to a "Interface doesn't accept private ioctl" message I get on boot. I think I'll go with the bus pirate idea. There is no JTAG connection on this specific board. It's relatively inexpensive, but you're right, I'll try to not fry it, at least not unintentionally :)
    – rddead
    Sep 1, 2019 at 19:03
  • If this is anything like the published MediaTek (ex-Ralink) U-Boots, the input from that menu is most likely actually disabled in the code.
    – Chris Stratton
    Sep 3, 2019 at 21:07
  • I guess it is, yeah. Anti-reverse engineering measure? @ChrisStratton
    – rddead
    Sep 4, 2019 at 0:50
  • No, just laziness in customizing the behavior by the most readily visible means, rather than the means designed into U-Boot. Remember the license of the code in question creates a legal requirement that it be published, and it actually is in at least some variants.
    – Chris Stratton
    Sep 4, 2019 at 1:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.