Tabela de conteúdos

Huawei EchoLife HG8245Q2

Informações sobre o Huawei EchoLife HG8245Q2 Oi onu / modem / router / gateway. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.

Este modelo é fornecido pela Oi Fibra.

Disclaimer

Modifique o dispositivo somente se for o proprietário. A maioria destes são fornecidos pelo seu ISP em regime de comodato como parte do serviço de internet. Não faça modificações caso o aparelho não seja seu.

Todos os métodos de desbloqueio e material sobre modificações foram criados pelo O3 Labs e disponibilizados GRATUITAMENTE desde o dia de sua elaboração. Espalhem esta informação e ajudem a evitar que PICARETAS roubem e vendam estas informações por aí, seja no Mercado Livre ou por quaisquer outros meios.

Hardware

front_small.jpg

back_small.jpg

SoC HiSilicon SD5116
RAM H5TQ2G63GFR - SK Hynix 2 Gbit (256 MB) DDR3 SDRAM
Flash MX30LF1G18AC - Macronix 1 Gbit (128 MB) NAND
Switch Integrado
USB Sim
Wireless 2.4 GHz AR9381 - Atheros 3×3 802.11b/g/n
Wireless 5 GHz QCA9880 - Qualcomm Atheros 3×3 802.11ac
GPON Transceiver ?
FXS 2 ( W912552L SLLV6 )
HPNA Não
Serial Sim
JTAG Não

Bootlog

HuaWei StartCode 2012.02 (V300R017C10 Mar 19 2017 - 08:22:11)

NAND:  Nand ID: 0xC2 0xF1 0x80 0x95 0x02 0x00 0x00 0x00
ECC Match pagesize:2K, oobzie:64, ecctype:4bit
Nand(Hardware): 128 MiB
startcode select the uboot to load
the high RAM is :8080103c
startcode uboot boot count:-65537
use the main slave_param area from flash, the RAM data is not OK!!!
Use the UbootA to load first
Use the UbootA to load success


U-Boot 2010.03 (V300R018C10 Jan 11 2019 - 16:06:43)

Mbist flag = 0x0, ddr totoal size = 0x10000000 
DRAM:  256 MB
Boot From NAND flash
Chip Type is SD5116T
NAND:  Special Nand id table Version 1.23
Nand ID: 0xC2 0xF1 0x80 0x95 0x02 0x00 0x00 0x00
ECC Match pagesize:2K, oobzie:64, ecctype:4bit
Nand(Hardware): Block:128KB Page:2KB Chip:128MB*1 OOB:64B ECC:4bit 
128 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
PHY power down !!!
[main.c__6093]::CRC:0x3d80a8b4, Magic1:0x5a5a5a5a, Magic2:0xa5a5a5a5, count:0, CommitedArea:0x0, Active:0x0, RunFlag:0x0
Start from main system(0x0)!
CRC:0x3d80a8b4, Magic1:0x5a5a5a5a, Magic2:0xa5a5a5a5, count:1, CommitedArea:0x0, Active:0x0, RunFlag:0x0
0x000000100000-0x000008000000 : "mtd=1"
attaching mtd1 to ubi0
Main area (A) is OK!
CRC:0x93e83925, Magic1:0x5a5a5a5a, Magic2:0xa5a5a5a5, count:1, CommitedArea:0x0, Active:0x0, RunFlag:0x0
doublecore not found!
Unmounting UBIFS volume file_system!
Unmount ubifs success!
UBI start Addr:0x100000! 
Bootcmd:ubi read 0x80907f6c kernelA 0x1b83bc; bootm 0x80907fc0
BootArgs:noalign mem=247M console=ttyAMA1,115200 ubi.mtd=1 root=/dev/mtdblock11 rootfstype=squashfs mtdparts=hinand:0x100000(startcode),0x7f00000(ubifs),-(reserved) pcie0_sel=x1 maxcpus=2 l2_cache=l2x0 coherent_pool=4M user_debug=0x1f panic=1 skb_priv=128 debug_ll=on
U-boot Start from NORMAL Mode!
## Booting kernel from Legacy Image at 80907fc0 ...
   Image Name:   Linux-3.10.53-HULK2
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1803048 Bytes =  1.7 MB
   Load Address: 80e08000
   Entry Point:  80e08000

Match the dtb file index : 3!
   Memory Start: 80900000
   Loading Kernel Image ... OK
OK
   kernel loaded at 0x80908000, end = 0x80abdffa

Starting kernel ...

Uart base = 0x1010F000
dtb addr = 0x80F58008
Uncompressing Linux... done, booting the kernel.
Booting Linux on physical CPU 0x0
Initializing cgroup subsys cpuset
Initializing cgroup subsys cpu
Initializing cgroup subsys cpuacct
Linux version 3.10.53-HULK2 (ci@SZX1000044441) (gcc version 4.7.1 (SDK V100R005C00SPC030B050) ) #1 SMP Fri Oct 20 01:08:58 CST 2017
CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=18c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: Hisilicon A9, model: HISI-CA9
skbuff priv len is 128.
Memory policy: ECC disabled, Data cache writealloc
On node 0 totalpages: 63232
free_area_init_node: node 0, pgdat c049e440, node_mem_map c065b800
  Normal zone: 618 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 63232 pages, LIFO batch:15
[dts]:cpu type is 5115
PERCPU: Embedded 7 pages/cpu @c08ca000 s7424 r8192 d13056 u32768
pcpu-alloc: s7424 r8192 d13056 u32768 alloc=8*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 62614
Kernel command line: noalign mem=247M console=ttyAMA1,115200 ubi.mtd=1 root=/dev/mtdblock11 rootfstype=squashfs mtdparts=hinand:0x100000(startcode),0x7f00000(ubifs),-(reserved) pcie0_sel=x1 maxcpus=2 l2_cache=l2x0 coherent_pool=4M user_debug=0x1f panic=1 skb_priv=128 debug_ll=on
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
allocated 505856 bytes of page_cgroup
please try 'cgroup_disable=memory' option if you don't want memory cgroups
Memory: 247MB = 247MB total
Memory: 244672k/244672k available, 8256k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffe00000 - 0xfffe0000   (1920 kB)
    vmalloc : 0xcf800000 - 0xff000000   ( 760 MB)
    lowmem  : 0xc0000000 - 0xcf700000   ( 247 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc042edf4   (4252 kB)
      .init : 0xc042f000 - 0xc045bd00   ( 180 kB)
      .data : 0xc045c000 - 0xc04a23d0   ( 281 kB)
       .bss : 0xc04a23d0 - 0xc04caf48   ( 163 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:512
sched_clock: 32 bits at 100MHz, resolution 10ns, wraps every 42949ms
[DTS][LED]-->WARN:Cannot find led info in dtb,make sure there is no led on board
Calibrating delay loop... 1594.16 BogoMIPS (lpj=7970816)
pid_max: default: 32768 minimum: 301
Security Framework initialized
Mount-cache hash table entries: 512
Initializing cgroup subsys memory
Initializing cgroup subsys devices
Initializing cgroup subsys freezer
Initializing cgroup subsys blkio
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0xc0313d20 - 0xc0313d54
SD511x chip id:0x51162100
sd511x_core_reset cpu : 1  mask=200
CPU1: Booted secondary processor
Brought up 2 CPUs
SMP: Total of 2 processors activated (3188.32 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
NET: Registered protocol family 16
DMA: preallocated 4096 KiB pool for atomic coherent allocations
L310 cache controller enabled
l2x0: 16 ways, CACHE_ID 0x410000c9, AUX_CTRL 0x02450001, Cache size: 524288 B
bio: create slab <bio-0> at 0
Switching to clocksource arm,sp804
cfg80211: Calling CRDA to update world regulatory domain
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 12288 bytes)
UDP-Lite hash table entries: 256 (order: 1, 12288 bytes)
NET: Registered protocol family 1
PCI: CLS 0 bytes, default 64
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. © 2001-2006 Red Hat, Inc.
fuse init (API version 7.22)
msgmni has been set to 477
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
brd: module loaded
mtdoops: mtd device (mtddev=name/number) must be supplied
Spi id table Version 1.22
Special nand id table Version 1.33
Hisilicon Nand Flash Controller V301 Device Driver, Version 1.10
Nand ID: 0xC2 0xF1 0x80 0x95 0x02 0x00 0x00 0x00
Nand(Hardware): Block:128KB Page:2KB Chip:128MB OOB:64B ECC:4bit 
NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (Macronix MX30LF1G18AC), 128MiB, page size: 2048, OOB size: 64
NAND_ECC_NONE selected by board driver. This is not recommended!
3 cmdlinepart partitions found on MTD device hinand
Creating 3 MTD partitions on "hinand":
0x000000000000-0x000000100000 : "startcode"
0x000000100000-0x000008000000 : "ubifs"
0x000008000000-0x000008000000 : "reserved"
mtd: partition "reserved" is out of reach -- disabled
softdog: Software Watchdog Timer: 0.08 initialized. soft_noboot=0 soft_margin=60 sec soft_panic=0 (nowayout=0)
TCP: cubic registered
NET: Registered protocol family 17
ThumbEE CPU extension supported.
mapp kbox ddrram_address=0, 			ddrram_size=0 fail[WARNNING]:Kbox device descriptor struct kbox_dev_des 		Intialization Failed
kbox: init ddrram fail ret=-99
kbox: load OK
UBI: attaching mtd1 to ubi0
UBI: scanning is finished
UBI: attached mtd1 (name "ubifs", size 127 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 1016, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 14, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 9/3, WL threshold: 512, image sequence number: 971853262
UBI: available PEBs: 288, total reserved PEBs: 728, PEBs reserved for bad PEB handling: 20
UBI: background thread "ubi_bgt0d" started, PID 255
Warning: unable to open an initial console.
squashfs_cache_init: sqcachesize=8.
VFS: Mounted root (squashfs filesystem) readonly on device 31:11.
Freeing unused kernel memory: 176K (c042f000 - c045b000)
******** Total Boot time: 1120 ms, uncompress initrd cost 0 ms ********
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
1010e000.uart: ttyAMA0 at MMIO 0x1010e000 (irq = 77) is a 16550A
Agradecimentos

Pessoas envolvidas em discussões, dicas ou bate papo em geral. Lista em ordem alfabética.