doc:appunti:hardware:technicolor_tg789vac_v2
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
doc:appunti:hardware:technicolor_tg789vac_v2 [2020/03/12 18:03] – [The Tiscali Backdoor] niccolo | doc:appunti:hardware:technicolor_tg789vac_v2 [2020/03/18 17:02] – [Router Bircked] niccolo | ||
---|---|---|---|
Line 80: | Line 80: | ||
===== Router Bircked ===== | ===== Router Bircked ===== | ||
- | I succeeded in bricking this router, may be after I installed the **openvpn** package, which required the **kmod-tun** one. I mixed packages from different architectures and sources, so probably I got some unworkable mix. It is probable that my customization went into the overlay partition and the boot partition is still good, but unfortunately I don't know any method to hard-reset | + | I succeeded in bricking this router, may be after I installed the **openvpn** package, which required the **kmod-tun** one. I mixed packages from different architectures and sources, so probably I got some unworkable mix. It is probable that my customization went into the overlay partition and the boot partition is still good, but unfortunately I don't know any method to clean or format |
- | There are two reset methods possibile: | + | I tried some recovery procedures, wihtout success. |
- | * **Power-off**, | + | === Flash a new firmare via TFTP === |
- | * Once the router | + | |
+ | **Power-off**, | ||
+ | |||
+ | === Factory reset === | ||
+ | |||
+ | With the router powered-on | ||
+ | |||
+ | === Accessing the serial line === | ||
I tried also to connect a serial adapter to the **J5** tag, soldering three wires to it. **TX** and **RX** lines should correspond to **R327** and **R328** resistors, according to some posts. But I did not get any serial signal. | I tried also to connect a serial adapter to the **J5** tag, soldering three wires to it. **TX** and **RX** lines should correspond to **R327** and **R328** resistors, according to some posts. But I did not get any serial signal. | ||
+ | |||
+ | === Forcing a bank switch === | ||
+ | |||
+ | Someone says that this Technicolor router has **two memory banks** to store (flash) the firmware. | ||
+ | |||
+ | * In normal condition, the router boot from bank_1. | ||
+ | * Flashing via **TFTP** will write to **bank_1** only. It will do so even if the active bank is currently bank_2. It will never set bank_1 as active. | ||
+ | * If something goes bad during the kernel load, the router automatically tries to reboot from the other bank. | ||
+ | * You can see what bank is active by reading **/ | ||
+ | * FIXME Is there a software command to switch from bank_1 to bank_2? | ||
+ | |||
+ | So I immagine at least two methods to force the router to boot from the other bank: | ||
+ | |||
+ | - Load a bad image via TFTP flashing (e.g. by disconnecting the cable during the upload, or powering the router off during the flash. I did not tried it. | ||
+ | - Force some **memory read errors** during bootstrap. This can be accomplished by connecting the **RE#** line (pin 8) of the TSOP chip to ground for some short times during bootstrap. This was **[[https:// | ||
+ | |||
+ | {{tg789vac_v2_tsop-pinout.jpg? | ||
===== Credits and Web References ===== | ===== Credits and Web References ===== | ||
Line 94: | Line 118: | ||
* **[[https:// | * **[[https:// | ||
* **[[https:// | * **[[https:// | ||
+ | * **[[https:// | ||
+ | * **[[https:// | ||
+ | * **[[https:// |
doc/appunti/hardware/technicolor_tg789vac_v2.txt · Last modified: 2020/03/23 18:52 by niccolo