====== Huawei EchoLife HG8245Q2 ====== {{description>Informações sobre o Huawei EchoLife HG8245Q2 Oi onu / modem / router / gateway. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}} Este modelo é fornecido pela Oi Fibra. ===== Disclaimer ===== Modifique o dispositivo **somente** se for o proprietário. A maioria destes são fornecidos pelo seu ISP em regime de comodato como parte do serviço de internet. **Não** faça modificações caso o aparelho não seja seu. Todos os métodos de desbloqueio e material sobre modificações foram criados pelo O3 Labs e disponibilizados **GRATUITAMENTE** desde o dia de sua elaboração. Espalhem esta informação e ajudem a evitar que **PICARETAS** roubem e vendam estas informações por aí, seja no Mercado Livre ou por quaisquer outros meios. ===== Hardware ===== [[https://www.tripleoxygen.net/files/devices/huawei/hg8245q2/front.jpg |{{ https://www.tripleoxygen.net/files/devices/huawei/hg8245q2/front_small.jpg }}]] [[https://www.tripleoxygen.net/files/devices/huawei/hg8245q2/back.jpg |{{ https://www.tripleoxygen.net/files/devices/huawei/hg8245q2/back_small.jpg }}]] ^ SoC | HiSilicon SD5116 | ^ RAM | H5TQ2G63GFR - SK Hynix 2 Gbit (256 MB) DDR3 SDRAM | ^ Flash | MX30LF1G18AC - Macronix 1 Gbit (128 MB) NAND | ^ Switch | Integrado | ^ USB | Sim | ^ Wireless 2.4 GHz| AR9381 - Atheros 3x3 802.11b/g/n| ^ Wireless 5 GHz| QCA9880 - Qualcomm Atheros 3x3 802.11ac | ^ GPON Transceiver | ? | ^ FXS | 2 ( W912552L SLLV6 ) | ^ HPNA | Não | ^ Serial | Sim | ^ JTAG | Não | ===== Bootlog ===== HuaWei StartCode 2012.02 (V300R017C10 Mar 19 2017 - 08:22:11) NAND: Nand ID: 0xC2 0xF1 0x80 0x95 0x02 0x00 0x00 0x00 ECC Match pagesize:2K, oobzie:64, ecctype:4bit Nand(Hardware): 128 MiB startcode select the uboot to load the high RAM is :8080103c startcode uboot boot count:-65537 use the main slave_param area from flash, the RAM data is not OK!!! Use the UbootA to load first Use the UbootA to load success U-Boot 2010.03 (V300R018C10 Jan 11 2019 - 16:06:43) Mbist flag = 0x0, ddr totoal size = 0x10000000 DRAM: 256 MB Boot From NAND flash Chip Type is SD5116T NAND: Special Nand id table Version 1.23 Nand ID: 0xC2 0xF1 0x80 0x95 0x02 0x00 0x00 0x00 ECC Match pagesize:2K, oobzie:64, ecctype:4bit Nand(Hardware): Block:128KB Page:2KB Chip:128MB*1 OOB:64B ECC:4bit 128 MiB Using default environment In: serial Out: serial Err: serial PHY power down !!! [main.c__6093]::CRC:0x3d80a8b4, Magic1:0x5a5a5a5a, Magic2:0xa5a5a5a5, count:0, CommitedArea:0x0, Active:0x0, RunFlag:0x0 Start from main system(0x0)! CRC:0x3d80a8b4, Magic1:0x5a5a5a5a, Magic2:0xa5a5a5a5, count:1, CommitedArea:0x0, Active:0x0, RunFlag:0x0 0x000000100000-0x000008000000 : "mtd=1" attaching mtd1 to ubi0 Main area (A) is OK! CRC:0x93e83925, Magic1:0x5a5a5a5a, Magic2:0xa5a5a5a5, count:1, CommitedArea:0x0, Active:0x0, RunFlag:0x0 doublecore not found! Unmounting UBIFS volume file_system! Unmount ubifs success! UBI start Addr:0x100000! Bootcmd:ubi read 0x80907f6c kernelA 0x1b83bc; bootm 0x80907fc0 BootArgs:noalign mem=247M console=ttyAMA1,115200 ubi.mtd=1 root=/dev/mtdblock11 rootfstype=squashfs mtdparts=hinand:0x100000(startcode),0x7f00000(ubifs),-(reserved) pcie0_sel=x1 maxcpus=2 l2_cache=l2x0 coherent_pool=4M user_debug=0x1f panic=1 skb_priv=128 debug_ll=on U-boot Start from NORMAL Mode! ## Booting kernel from Legacy Image at 80907fc0 ... Image Name: Linux-3.10.53-HULK2 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1803048 Bytes = 1.7 MB Load Address: 80e08000 Entry Point: 80e08000 Match the dtb file index : 3! Memory Start: 80900000 Loading Kernel Image ... OK OK kernel loaded at 0x80908000, end = 0x80abdffa Starting kernel ... Uart base = 0x1010F000 dtb addr = 0x80F58008 Uncompressing Linux... done, booting the kernel. Booting Linux on physical CPU 0x0 Initializing cgroup subsys cpuset Initializing cgroup subsys cpu Initializing cgroup subsys cpuacct Linux version 3.10.53-HULK2 (ci@SZX1000044441) (gcc version 4.7.1 (SDK V100R005C00SPC030B050) ) #1 SMP Fri Oct 20 01:08:58 CST 2017 CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=18c53c7d CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache Machine: Hisilicon A9, model: HISI-CA9 skbuff priv len is 128. Memory policy: ECC disabled, Data cache writealloc On node 0 totalpages: 63232 free_area_init_node: node 0, pgdat c049e440, node_mem_map c065b800 Normal zone: 618 pages used for memmap Normal zone: 0 pages reserved Normal zone: 63232 pages, LIFO batch:15 [dts]:cpu type is 5115 PERCPU: Embedded 7 pages/cpu @c08ca000 s7424 r8192 d13056 u32768 pcpu-alloc: s7424 r8192 d13056 u32768 alloc=8*4096 pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 62614 Kernel command line: noalign mem=247M console=ttyAMA1,115200 ubi.mtd=1 root=/dev/mtdblock11 rootfstype=squashfs mtdparts=hinand:0x100000(startcode),0x7f00000(ubifs),-(reserved) pcie0_sel=x1 maxcpus=2 l2_cache=l2x0 coherent_pool=4M user_debug=0x1f panic=1 skb_priv=128 debug_ll=on PID hash table entries: 1024 (order: 0, 4096 bytes) Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) allocated 505856 bytes of page_cgroup please try 'cgroup_disable=memory' option if you don't want memory cgroups Memory: 247MB = 247MB total Memory: 244672k/244672k available, 8256k reserved, 0K highmem Virtual kernel memory layout: vector : 0xffff0000 - 0xffff1000 ( 4 kB) fixmap : 0xffe00000 - 0xfffe0000 (1920 kB) vmalloc : 0xcf800000 - 0xff000000 ( 760 MB) lowmem : 0xc0000000 - 0xcf700000 ( 247 MB) modules : 0xbf000000 - 0xc0000000 ( 16 MB) .text : 0xc0008000 - 0xc042edf4 (4252 kB) .init : 0xc042f000 - 0xc045bd00 ( 180 kB) .data : 0xc045c000 - 0xc04a23d0 ( 281 kB) .bss : 0xc04a23d0 - 0xc04caf48 ( 163 kB) SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 Hierarchical RCU implementation. NR_IRQS:512 sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms [DTS][LED]-->WARN:Cannot find led info in dtb,make sure there is no led on board Calibrating delay loop... 1594.16 BogoMIPS (lpj=7970816) pid_max: default: 32768 minimum: 301 Security Framework initialized Mount-cache hash table entries: 512 Initializing cgroup subsys memory Initializing cgroup subsys devices Initializing cgroup subsys freezer Initializing cgroup subsys blkio CPU: Testing write buffer coherency: ok Setting up static identity map for 0xc0313d20 - 0xc0313d54 SD511x chip id:0x51162100 sd511x_core_reset cpu : 1 mask=200 CPU1: Booted secondary processor Brought up 2 CPUs SMP: Total of 2 processors activated (3188.32 BogoMIPS). CPU: All CPU(s) started in SVC mode. NET: Registered protocol family 16 DMA: preallocated 4096 KiB pool for atomic coherent allocations L310 cache controller enabled l2x0: 16 ways, CACHE_ID 0x410000c9, AUX_CTRL 0x02450001, Cache size: 524288 B bio: create slab at 0 Switching to clocksource arm,sp804 cfg80211: Calling CRDA to update world regulatory domain NET: Registered protocol family 2 TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 3, 32768 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP: reno registered UDP hash table entries: 256 (order: 1, 12288 bytes) UDP-Lite hash table entries: 256 (order: 1, 12288 bytes) NET: Registered protocol family 1 PCI: CLS 0 bytes, default 64 squashfs: version 4.0 (2009/01/31) Phillip Lougher jffs2: version 2.2. © 2001-2006 Red Hat, Inc. fuse init (API version 7.22) msgmni has been set to 477 io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) brd: module loaded mtdoops: mtd device (mtddev=name/number) must be supplied Spi id table Version 1.22 Special nand id table Version 1.33 Hisilicon Nand Flash Controller V301 Device Driver, Version 1.10 Nand ID: 0xC2 0xF1 0x80 0x95 0x02 0x00 0x00 0x00 Nand(Hardware): Block:128KB Page:2KB Chip:128MB OOB:64B ECC:4bit NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (Macronix MX30LF1G18AC), 128MiB, page size: 2048, OOB size: 64 NAND_ECC_NONE selected by board driver. This is not recommended! 3 cmdlinepart partitions found on MTD device hinand Creating 3 MTD partitions on "hinand": 0x000000000000-0x000000100000 : "startcode" 0x000000100000-0x000008000000 : "ubifs" 0x000008000000-0x000008000000 : "reserved" mtd: partition "reserved" is out of reach -- disabled softdog: Software Watchdog Timer: 0.08 initialized. soft_noboot=0 soft_margin=60 sec soft_panic=0 (nowayout=0) TCP: cubic registered NET: Registered protocol family 17 ThumbEE CPU extension supported. mapp kbox ddrram_address=0, ddrram_size=0 fail[WARNNING]:Kbox device descriptor struct kbox_dev_des Intialization Failed kbox: init ddrram fail ret=-99 kbox: load OK UBI: attaching mtd1 to ubi0 UBI: scanning is finished UBI: attached mtd1 (name "ubifs", size 127 MiB) to ubi0 UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 UBI: VID header offset: 2048 (aligned 2048), data offset: 4096 UBI: good PEBs: 1016, bad PEBs: 0, corrupted PEBs: 0 UBI: user volume: 14, internal volumes: 1, max. volumes count: 128 UBI: max/mean erase counter: 9/3, WL threshold: 512, image sequence number: 971853262 UBI: available PEBs: 288, total reserved PEBs: 728, PEBs reserved for bad PEB handling: 20 UBI: background thread "ubi_bgt0d" started, PID 255 Warning: unable to open an initial console. squashfs_cache_init: sqcachesize=8. VFS: Mounted root (squashfs filesystem) readonly on device 31:11. Freeing unused kernel memory: 176K (c042f000 - c045b000) ******** Total Boot time: 1120 ms, uncompress initrd cost 0 ms ******** Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled 1010e000.uart: ttyAMA0 at MMIO 0x1010e000 (irq = 77) is a 16550A == Agradecimentos == Pessoas envolvidas em discussões, dicas ou bate papo em geral. Lista em ordem alfabética.