Kitz ADSL Broadband Information
adsl spacer  
Support this site
Home Broadband ISPs Tech Routers Wiki Forum
 
     
   Compare ISP   Rate your ISP
   Glossary   Glossary
 
Please login or register.

Login with username, password and session length
Advanced search  

News:

Pages: 1 2 [3]

Author Topic: Boot log - HG658c with BCM63168 SoC  (Read 31120 times)

dmcdonnell

  • Member
  • **
  • Posts: 93
Re: Boot log - HG658c with BCM63168 SoC
« Reply #30 on: March 27, 2015, 10:57:53 AM »

I modified the .conf file to get telnet working, with shell access, on the HG658c with the O2 firmware.

Username: !!Huawei
Password: @HuaweiHgw

type shell to get the busybox shell.

HG658c_Telnet.conf - https://drive.google.com/file/d/0B8w9evGfsK03S3RzNVpsLTBmTzA/view?usp=sharing
Logged

avrg_andy

  • Just arrived
  • *
  • Posts: 2
Re: Boot log - HG658c with BCM63168 SoC
« Reply #31 on: April 23, 2015, 08:01:36 AM »

I'd like to un-brick a HG658 using JTAG to flash CFE, then use serial to flash the O2 firmware with tftp.

It looks like JTAG port is marked J13 (next to NAND chip). Can anyone confirm the JTAG pinout?
Hauwei 10-pin JTAG port pins ( http://wiki.openwrt.org/doc/hardware/port.jtag ) are usually:
1 TCK (square pad)
3 TDO
5 TMS
7 -
9 TDI

However, HG622 (similar chipset) has JTAG on J5 pins in a different order
( http://wiki.openwrt.org/toh/huawei/hg622#jtag ) :
1 TDI
2 TMS
3 TDO
4 (Trst)
5 TCK

Tried both layouts using a DLC5 Cable with 100Ohm resistors... No luck.
( http://wiki.openwrt.org/doc/hardware/port.jtag.cable.unbuffered

Seems I could be using wrong JTAG pin header? :(
If anyone has been successful, please advise.
« Last Edit: April 23, 2015, 08:14:56 AM by avrg_andy »
Logged

burakkucat

  • Respected
  • Senior Kitizen
  • *
  • Posts: 38300
  • Over the Rainbow Bridge
    • The ELRepo Project
Re: Boot log - HG658c with BCM63168 SoC
« Reply #32 on: April 23, 2015, 04:40:25 PM »

Hi Andy, welcome to the Kitz forum.  :)

Unfortunately I do not know of the JTAG pin-outs that you require but I do recall that in one of his Wordpress blogs Asbokid described a method to discover JTAG pin-outs. Perhaps you could make use of that method?  :-\
Logged
:cat:  100% Linux and, previously, Unix. Co-founder of the ELRepo Project.

Please consider making a donation to support the running of this site.

avrg_andy

  • Just arrived
  • *
  • Posts: 2
Re: Boot log - HG658c with BCM63168 SoC
« Reply #33 on: April 25, 2015, 03:55:07 AM »

Hey thanks for the tip, I'll have a go. Hoping others give it a go too - it could be that my HG658 is bricked due to HW issues, so I'd be interested to know how anyone with a functional unit goes at JTAG'ing it. Cheers!
Logged

chriz74

  • Just arrived
  • *
  • Posts: 1
Re: Boot log - HG658c with BCM63168 SoC
« Reply #34 on: March 07, 2016, 08:38:07 AM »

Well done! Woud you be so kind as to post a generic HG658c config, pleasse? The O2 config is curtailed, I can telnet, login and get the ASP> prompt but not the busybox shell.

Greatly appreciate your excellent work.

I did some testing on the O2 firmware and it seems that you also have to change ConsoleEnable="" to
ConsoleEnable="HG658A6da668BbDFC2F889a805469AcE" in order to access the
busybox shell. Also, the telnet port was still blocked so i had to start telnetd on a different port using
the traceroute exploit.


Hello, I read your post regarding the HG685 where you say you had to put ConsoleEnable="HG658A6da668BbDFC2F889a805469AcE" in the conf file to enable busybox access. I have an HG532s, I decrypted the conf and this is the part regarding telnet:

Code: [Select]
<X_ServiceManage TelnetEnable="0" TelnetPort="23" QuickConfigured="1" ManufactureConfigured="0" FirstBoot="0" ConsoleEnable="" WanManagementEnable="1">
<ObjExtention>
<QuickConfigured Notify="0" AccList="65535" Resv="0" HideBits="65534"/>
</ObjExtention>

I tried to modify TelnetEnable="1" but it doesn't work. My question is, where did you find that string to put in ConsoleEnable?
Logged
Pages: 1 2 [3]
 

anything