小R科技-WIFI机器人网·机器人创意工作室

 找回密码
 立即注册
查看: 16490|回复: 11

转载的TP-Link Wr703 内部和TTL By onionismine@不小心刷坏、船长@估算ttl

[复制链接]
发表于 2012-9-17 22:35:31 | 显示全部楼层 |阅读模式
Posted 2012/03/23
由onionismine发来的Wr703刷坏固件已经到达,让我们看看WR703N里面的样子,它小巧精致,甚至外壳都有苹果的感觉,它的造价售价到也不高,100之内,只是路由器来看,并不低,但是刷上openwrt后生龙活虎。

WR703 OpenWrt官方最新固件文件,不带界面哦:
从TPLINK官方固件刷:http://downloads.openwrt.org/snapshots/trunk/ar71xx/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin
从已刷好OPENWRT固件升级:http://downloads.openwrt.org/snapshots/trunk/ar71xx/openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin
包裹收到,包装的很细致

包裹收到,包装的很细致

用螺丝刀拆开包装,看到包好的电路板。

展开

这就是电路板了,真小巧。

正明:硬件版本V1.1

背面,有个大标签634

跟Mr11u的大小对比

再次背面

侧面,很平凡

细节LED,注意有LED2,LED3的位置,LED2应该是电源灯吧,这种小灯的耗电肯定低

8M的FLASH:MX25L6445EM2I 和 自带的FL032P1F

盖上去试试,真的是同样的尺寸

看起来真是一样大

神奇的芯片

对比完了,送回去

这里是关键点,Tp_IN,TP_OUT对应TX,RX,入和出

这三个点也有可能可以做GND,但是万用表测试后并不通

芯片的一家子

小芯片

芯片真小

朦胧的灯

灯亮的很严重

连上网线

一会断一会连,看来系统挂了

一个包也到不了,准备焊接ttl线

准备焊接台

准备足够细的线

焊上最关键的入和出,rx,tx

焊上去了

置入对面:小时候最容易断的线就是这样的小线,然后郁闷自己没办法接回去。

这是GND,焊在USB铁壳上,为什么不呢?

焊接在大焊点上

找到一个排线,看起来挺配的

拆下三个

非常不容易焊上去了,因为这小排插不吸锡(念xixi:))

这东西终于不容易上去了,但是。。。

才插上去ttl线就掉了两根,我X

恼火,但是恼火是解决不了问题的,想到了最简单的方案,拿电容脚来做插针,电容为一直不知道拿来做啥用

插进去还是可以的,最长的针对应GND,短黑线对应TP—OUT,红线对应TP-IN,TX: transmit 传送RX: receive

U-Boo
t 1.1.4 (Sep 26 2011 – 1
这玩意不争气,我还能拿你做什么用呢?

1:13:45)


回复

使用道具 举报

 楼主| 发表于 2012-9-17 22:43:51 | 显示全部楼层
U-Boot 1.1.4 (Sep 26 2011 – 11:13:45)
AP121-2MB (ar9330) U-boot
DRAM: 32 MB
led turning on for 1s…
id read 0x100000ff
flash size 4194304, sector count = 64
Flash: 4 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize…
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0×5 cfg2 0×7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0×7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
## Booting image at 9f020000 …
Uncompressing Kernel Image … ERROR: LzmaDecode.c, 543
Decoding error = 1
LZMA ERROR 1 – must RESET 崱Hㄕ浇褋1.1.4 (Sep 26 2011 – 11:13:45)
AP121-2MB (ar9330) U-boot
DRAM: 32 MB
led turning on for 1s…
id read 0x100000ff
flash size 4194304, sector count = 64
Flash: 4 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize…
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0×5 cfg2 0×7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0×7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
## Booting image at 9f020000 …
Uncompressing Kernel Image … ERROR: LzmaDecode.c, 543
Decoding error = 1
LZMA ERROR 1 – must RESET
U-Boot 1.1.4 (Sep 26 2011 – 11:13:45)
AP121-2MB (ar9330) U-boot
DRAM: 32 MB
led turning on for 1s…
id read 0x100000ff
flash size 4194304, sector count = 64
Flash: 4 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize…
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0×5 cfg2 0×7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0×7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
## Booting image at 9f020000 …
Uncompressing Kernel Image … ERROR: LzmaDecode.c, 543
Decoding error = 1
LZMA ERROR 1 – must RESET
U-Boot 1.1.4 (Sep 26 2011 – 11:13:45)
AP121-2MB (ar9330) U-boot
DRAM: 32 MB
led turning on for 1s…
接着就是TTL线的故事了,折腾了四五个小时了,真不容易,但是很有收获。
连接TTL测试


没有输出,困惑。。。难倒线反了


反过来接,正常了,短黑:GND,红:TX接到TTL的RX,长黑,RX接到TTL的TX。


有输出了,故障原因是FLASH不匹配,一直只能重启。

无法直接进入安全模式,这比较无奈。。。Uboot损坏。
1:41am次日,太晚了,先休息吧。
神奇的平淡哥,告知了一个进入的大门,终于,门开了

11:42ap次日,困惑于只能刷机的时候,伟大的平淡哥,提出了Uboot完全没问题的看法。
另外一种方式快速用tpl来获得控制权


ubbot的帮助,里面很多东西呢

回复 支持 反对

使用道具 举报

 楼主| 发表于 2012-9-17 22:45:53 | 显示全部楼层
bootm 好酷的命令啊,启动程序从内存里
tftpboot就是远程从tftp启动咯
这内存测试半小时了,看来死了


设置下环境

回复 支持 反对

使用道具 举报

 楼主| 发表于 2012-9-17 22:46:50 | 显示全部楼层


全过程参考来自tuoniao,来自http://www.buynetge.net/read.php?tid=2223
此时按小写tpl进入uboot,我的情况是按tp就进入了。
ar7240> printenv
显示
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NVRAM),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0×00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.123
serverip=192.168.1.100
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
Environment size: 359/65532 bytes
接着
ar7240> setenv ipaddr 192.168.1.2
ar7240> setenv serverip 192.168.1.100 备注:这个是台机或本子的固定IP(255.255.255.0,192.168.1.1)
ar7240> printenv
显示
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),2752k(rootfs),896k(uImage),64k(NVRAM),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0×00:0xaa:0xbb:0xcc:0xdd:0xee
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
ipaddr=192.168.1.2
serverip=192.168.1.100
Environment size: 357/65532 bytes
接着:
ar7240> tftpboot 0×80000000 741.bin 备注:在这个命令之前要把741的固件放到tftp32的文件夹中,并打开tftp32!
显示
eth0 link down
dup 1 speed 1000
Using eth1 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.2
Filename ’7.bin’.
Load address: 0×80000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################
done
Bytes transferred = 3932160 (3c0000 hex)
看到这个就说明固件已经传入路由的内存中了。
接着
ar7240> erase 0x9f020000 +0x3c0000 备注:+号前有空格
8M flash 是: 刷uboot:
tftp 0×80000000 uboot.bin
erase 0x9f020000 +0x7c0000 erase 0x9f000000 +0×20000
cp.b 0×80000000 0x9f020000 0x7c0000 cp.b 0×80000000 0x9f000000 0×20000
显示
First 0×2 last 0x3d sector size 0×10000
61
Erased 60 sectors
ar7240> cp.b 0×80000000 0x9f020000 0x3c0000备注:两个地址前有空格
显示
Copy to Flash… write addr: 9f020000
Done
到这拯救基本就结束了。
接着输入命令启动路由
ar7240> bootm 0x9f020000
显示
## Booting image at 9f020000 …
Uncompressing Kernel Image … OK
Starting kernel …
Booting AR7240(Python)…
Linux version 2.6.15–LSDK-7.3.0.300 gcc version 3.4.4 #18 Wed Feb 10 10:33:56 CST 2010
flash_size passed from bootloader = 4
CPU revision is: 00019374
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init mtdparts=ar7100-nor0:128k(u-boot),1024k(kernel),2816k(rootfs),64k(config),64k(art) mem=32M
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 256 (order: 8, 4096 bytes)
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 30548k/32768k available (1368k kernel code, 2204k reserved, 292k data, 128k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for ‘wait’ instruction… available.
NET: Registered protocol family 16
Reset button pressed.
Returning IRQ 48
AR7240 GPIOC major 0
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
Serial: 8250/16550 driver $Revision: #1 $ 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0×0 (irq = 19) is a 16550A
RAMDISK driver initialized: 1 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
NET: Registered protocol family 24
cmdlinepart partition parsing not available
Searching for RedBoot partition table
5 RedBoot partitions found on MTD device ar7240-nor0
Creating 5 MTD partitions on “ar7240-nor0″:
0×00000000-0×00020000 : “boot”
0×00020000-0×00120000 : “kernel”
0×00120000-0x003e0000 : “rootfs”
0x003e0000-0x003f0000 : “config”
0x003f0000-0×00400000 : “art”
->Oops: flash id 0xef4016 .
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 128k freed
init started: BusyBox v1.01 (2009.12.10-12:12+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5
ip_conntrack version 2.4 (256 buckets, 5120 max) – 244 bytes per conntrack
insmod: cannot open module `/lib/modules/2.6.15/kernel/flashid.ko’: No such file or directory
insmod: cannot open module `/lib/modules/2.6.15/kernel/harmony.ko’: No such file or directory
Now flash open!
Now flash open!
Now flash open!
Now flash open!
Now flash open!
Erase from 0X3E0000 to 0X3EBFB0:.
Program from 0X3E0000 to 0X3EBFB0:
write successfully
Now flash open!
Erase from 0X3E0000 to 0X3EBFB0:.
Program from 0X3E0000 to 0X3EBFB0:
write successfully
(none) mips #18 Wed Feb 10 10:33:56 CST 2010 (none)
(none) login: sys_mode=0 mac:8106c000 ag7240_macs[0]:00000000 ag7240_macs[1]:8106c000
2
sys_mode=0 mac:81c08000 ag7240_macs[0]:81c08000 ag7240_macs[1]:8106c000
1
sys_mode 0 PHY4 auto-negotiation enable
Attention: PHY4 Class A setting in debug 5 register which is not described in DS
phy_setup ethUnit:0 phyUnit:4
Port 4, Neg Success
ATHRS26: resetting s26
ATHRS26: s26 reset done
sys_mode 0 PHY0 auto-negotiation enable
Attention: PHY 0 Class A setting in debug 5 register which is not described in DS
sys_mode 0 PHY1 auto-negotiation enable
Attention: PHY 1 Class A setting in debug 5 register which is not described in DS
sys_mode 0 PHY2 auto-negotiation enable
Attention: PHY 2 Class A setting in debug 5 register which is not described in DS
sys_mode 0 PHY3 auto-negotiation enable
Attention: PHY 3 Class A setting in debug 5 register which is not described in DS
phy_setup ethUnit:1 phyUnit:0
phy_setup ethUnit:1 phyUnit:1
phy_setup ethUnit:1 phyUnit:2
phy_setup ethUnit:1 phyUnit:3
Port 0, Neg Success
Port 1, Neg Success
Port 2, Neg Success
Port 3, Neg Success
device eth0 entered promiscuous mode
phy_setup ethUnit:1 phyUnit:0
phy_setup ethUnit:1 phyUnit:1
phy_setup ethUnit:1 phyUnit:2
phy_setup ethUnit:1 phyUnit:3
Port 0, Neg Success
Port 1, Neg Success
Port 2, Neg Success
Port 3, Neg Success
++++ phy_up is 1, fdx is 1, speed is 1
AG7240: enet unit:1 phy:2 is up…Mii 100Mbps full duplex
AG7240: enet unit 1 phy 2 mode 0x4c04
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
ath_hal: module license ‘Proprietary’ taints kernel.
ath_hal: 0.9.17.1 (AR5416, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
wlan: 0.8.4.2 (Atheros/multi-bss)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_pci: 0.9.4.5 (Atheros/multi-bss)
wifi0: Atheros 9285: mem=0×10000000, irq=48 hw_base=0xb0000000
wlan_me: Version 0.1
Copyright (c) 2008 Atheros Communications, Inc. All Rights Reserved
wlan: mac acl policy registered
TP_Flags:6****
ap_start_405:Test by Songwei!
The selected channel is 1
Country ie is CN
Country ie is CN
maxrate = 150000
Country ie is CN
br0: port 1(eth0) entering disabled state
phy_setup ethUnit:1 phyUnit:0
phy_setup ethUnit:1 phyUnit:1
phy_setup ethUnit:1 phyUnit:2
phy_setup ethUnit:1 phyUnit:3
Port 0, Neg Success
Port 1, Neg Success
Port 2, Neg Success
Port 3, Neg Success
device ath0 entered promiscuous mode
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
br0: port 2(ath0) entering disabled state
Country ie is CN
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
++++ phy_up is 1, fdx is 1, speed is 1
AG7240: enet unit:1 phy:2 is up…Mii 100Mbps full duplex
AG7240: enet unit 1 phy 2 mode 0x4c04
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
br0: port 2(ath0) entering disabled state
TP_Flags:6****
TP_Flags:0****
Country ie is CN
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
+++ GE0 RX DMA ENABLE
这时路由就活过来了

回复 支持 反对

使用道具 举报

 楼主| 发表于 2012-9-17 22:47:25 | 显示全部楼层
参考:
1. chao1414 的〈迅捷FW150R V2拆解〉,http://www.right.com.cn/forum/vi … mp;highlight=fw150r
2.linlin911911 的〈TP-LINK 841N V7 变砖后,TTL挽救过程总结〉http://www.right.com.cn/forum/vi … 6&highlight=ttl
3. bsctv , 《tp741n刷DD-WRT 14929, 15279,15314后Wireless无线部份的问题》,http://www.right.com.cn/forum/vi … 0975&highlight=
在MAC上终端里内置的tftp非常的郁闷,完全不工作


这个卖2美刀的玩意也是一样不争气


MAC无法做到,那么只能让比尔盖茨的窗口来试试了


换到windows上,最终tftp32完成了!

太好了,已经耗时24小时了,太累了,刷更新固件,重置网络,安装luci,完工。
配置dns,网关,安装luci

再装个语言包
最终的中文界面。。。

所有完成!
————————————————————————————————————————————————————————————————————————————————————

————————2012-03-23 参考接法
来自于伟大的vbye,来源地址:http://right.com.cn/forum/thread-75606-1-1.html

————————2012-03-18
关于ttl的接线,网上有很多爱好者折腾后留下的图片,很多,大概来说,wr703对ttl来说并不够友好,rx,tx在内存ram的右下角,gnd有点费心思,它在板后面,可以接一团,如果你更懒得寻找,那么接到usb的铁片上罢。
抱歉找不到来源了,这里是接地线的位置,地线=GND


这些TX和RX,注意和你TTL线的出口相反。


这是星星翘出来的路由器,他表示线很小,很细很难焊接,对应硬件版本是V1.2


老外的原材料,将3.5插口置入到路由器


回复 支持 反对

使用道具 举报

发表于 2012-9-18 12:10:37 | 显示全部楼层
很详细  楼主真有耐心
回复 支持 反对

使用道具 举报

发表于 2012-9-18 14:24:00 | 显示全部楼层
强烈支持!!!!!!!!!!
回复 支持 反对

使用道具 举报

发表于 2012-9-19 20:56:35 | 显示全部楼层
提示: 作者被禁止或删除 内容自动屏蔽
回复 支持 反对

使用道具 举报

发表于 2012-10-28 15:38:30 | 显示全部楼层
楼主好有耐心,加油
回复 支持 反对

使用道具 举报

发表于 2012-11-28 09:47:36 | 显示全部楼层
支持   ~~~~~~~~~顶起
回复 支持 反对

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

关闭

新品特惠推荐上一条 /2 下一条

QQ|QQ技术咨询1|QQ技术咨询2|商务合作微信1:xiaorgeek001|商务合作微信2:XiaoRGEEK|诚聘英才|Archiver|手机版|小R科技-WIFI机器人网·机器人创意工作室 ( 粤ICP备15000788号-6 )

GMT+8, 2024-11-23 05:12 , Processed in 1.155427 second(s), 20 queries .

Powered by XiaoR GEEK X3.4

© 2014-2021 XiaoR GEEK

快速回复 返回顶部 返回列表