OK, I am interested in your tool.

I can upload my backup somewhere too.

I hope some day we can decompress our 7518pw flash data (kernel, hidden web pages,...) with sp700ex tool.

(Last edited by jjb_wii on 2 May 2011, 14:32)

I'm not sure if I can do it today but I'll post it somewhere then.
It's already possible to deobfuscate the partitions, however I don't need it anymore (since I replaced brnboot with u-boot), see here:

http://www.ip-phone-forum.de/showthread … ost1683467

I checked that program and it works with my backup.

Project uploaded here:

http://code.google.com/p/brndumper/

It's a little bit rough but it worked here.

Edit: apart from the lazarus source, there's also a linux/gtk binary. Use it only if you trust me ;-)

(Last edited by pippolippi on 2 May 2011, 18:09)

Now, I have generated the brndumper.exe in windows 7 x64 and it seems to work ok.

I have had to patch all WIN32 definitions with WINDOWS and add the function "NormalizeHeader(Value: TStrings; var Index: Integer): string;" in synautil because this function had disappeared.

Related to the flash. Yesterday I made a full dump but I forgot to do a reset before (I can only play with the router one/two hours for day, on the night  )........ Today I will try another clean dump (without any personal VOIP data configuration, CPE data, etc...) for you.

About meaning of each section:

---------------------------------------

    Area            Address      Length 

---------------------------------------

[0] Boot            0xB0000000     128K     <---->  original brnboot

[1] Configuration   0xB0020000     256K     <-----> VOIP data, CPE, etc...

[2] None            0xB0060000      64K     <------> ??

[3] Special Area    0xB0070000      64K     <------> ??

[4] Primary Setting 0xB0080000      64K     <------> ??

[5] Code Image 0    0xB0090000    3776K     <------> arv7518pw_yacom_0.20.013b2-4.zip  +  arv7518pw_yacom_0.20.013b2-5.zip.  is it correct ?? What is this VxWorks S.O ?

[6] Code Image 1    0xB0440000    3776K     <------> arv7518pw_yacom_0.20.013b2-10.zip  +  arv7518pw_yacom_0.20.013b2-11.zip.  is it correct ?? What is this VxWorks S.O ?

[7] Boot Params     0xB07F0000      64K    <------> ??

[8] Flash Image     0xB0000000    8192K

---------------------------------------

I tried to do a split with sp700 but I can not identify exactly each file with each section. In addition, I did a backup of "Configuration" section with the original backup firmware Web page but I can not identify this file with one of this...(256K)

-----------------

 Directorio de C:\Documents and Settings\sjuan01\Escritorio\dump_flash\sp700ex

03/05/2011  10:06    <DIR>          .
03/05/2011  10:06    <DIR>          ..
02/12/2008  10:04             5.659 7zC.txt
07/08/2006  17:07             7.755 7zFormat.txt
18/11/2010  18:27           333.312 7zr.exe
03/05/2011  10:06         1.553.932 arv7518pw_yacom_0.20.013b2-1.bin
03/05/2011  10:06           174.146 arv7518pw_yacom_0.20.013b2-10.zip
03/05/2011  10:06           173.329 arv7518pw_yacom_0.20.013b2-11.zip
03/05/2011  10:06           316.099 arv7518pw_yacom_0.20.013b2-12.lzma
03/05/2011  10:06           497.424 arv7518pw_yacom_0.20.013b2-12_unpacked.bin
03/05/2011  10:06           992.256 arv7518pw_yacom_0.20.013b2-13.bin
03/05/2011  10:06           477.978 arv7518pw_yacom_0.20.013b2-2.bin
03/05/2011  10:06           241.582 arv7518pw_yacom_0.20.013b2-3.lzma
03/05/2011  10:06         1.438.697 arv7518pw_yacom_0.20.013b2-3_unpacked.bin
03/05/2011  10:06           174.146 arv7518pw_yacom_0.20.013b2-4.zip
03/05/2011  10:06           173.329 arv7518pw_yacom_0.20.013b2-5.zip
03/05/2011  10:06           316.099 arv7518pw_yacom_0.20.013b2-6.lzma
03/05/2011  10:06           497.424 arv7518pw_yacom_0.20.013b2-6_unpacked.bin
03/05/2011  10:06         1.553.932 arv7518pw_yacom_0.20.013b2-7.bin
03/05/2011  10:06           477.978 arv7518pw_yacom_0.20.013b2-8.bin
03/05/2011  10:06           241.582 arv7518pw_yacom_0.20.013b2-9.lzma
03/05/2011  10:06         1.438.697 arv7518pw_yacom_0.20.013b2-9_unpacked.bin
02/05/2011  23:21         8.388.608 arv7518pw_yacom_0.20.013b2.bin
03/05/2011  10:06               365 arv7518pw_yacom_0.20.013b2_unpack_parts.bat
10/03/2011  23:50    <DIR>          Asm
10/03/2011  23:50    <DIR>          C
10/03/2011  23:50    <DIR>          CPP
10/03/2011  23:50    <DIR>          CS
02/11/2010  18:23             7.371 history.txt
10/03/2011  23:50    <DIR>          Java
18/11/2010  18:27            73.216 lzma.exe
18/11/2010  18:08            20.398 lzma.txt
10/03/2011  23:50    <DIR>          lzma920
10/03/2011  23:35           534.077 lzma920.tar.bz2
05/10/2010  05:53             2.944 Methods.txt
06/01/2009  22:07             1.102 readme.txt
06/01/2009  22:15           126.976 SP700EX.exe

-----------------

Inside zip:  arv7518pw_yacom_0.20.013b2-4.zip --> DANUBE_2.1.2.15.0.1.bin

Inside zip: arv7518pw_yacom_0.20.013b2-5.zip   --> 2_1_2_D_0_2B.bin

Inside zip: arv7518pw_yacom_0.20.013b2-10.zip --> DANUBE_2.1.2.15.0.1.bin

Inside zip: arv7518pw_yacom_0.20.013b2-11.zip --> 2_1_2_D_0_2B.bin

I don't know in which file I should apply a descramble Xor.... [ZIP3]?

(Last edited by jjb_wii on 3 May 2011, 11:03)

Strange, I use extensively synapse under both windows and linux and never had any problem. Maybe because I'm using an older version

All user configuration is in [1] Configuration, so just omitting this one should be enough not to disclose any personal information, anyway:

About meaning of each section:

---------------------------------------

    Area            Address      Length 

---------------------------------------

[0] Boot            0xB0000000     128K     <---->  original brnboot

yes

[1] Configuration   0xB0020000     256K     <-----> VOIP data, CPE, etc...

This is your personal data (i.e what you configure in the web interface, asdl, voip, passwords, etc.).

[2] None            0xB0060000      64K     <------> ??

[3] Special Area    0xB0070000      64K     <------> ??

[4] Primary Setting 0xB0080000      64K     <------> ??

No idea about these previous sections

[5] Code Image 0    0xB0090000    3776K     <------> arv7518pw_yacom_0.20.013b2-4.zip  +  arv7518pw_yacom_0.20.013b2-5.zip.  is it correct ?? What is this VxWorks S.O ?

[6] Code Image 1    0xB0440000    3776K     <------> arv7518pw_yacom_0.20.013b2-10.zip  +  arv7518pw_yacom_0.20.013b2-11.zip.  is it correct ?? What is this VxWorks S.O ?

These are the firmware, yes, in my unit they're the same, I suppose that if you upgrade one is kept as a backup.
This is the section you have to run sp700ex to get the parts, then use the decrypter on the kernel and the webinterface.
Sorry, I don't know about those files, I'm not a customer of yacom so I don't have access to updates (not that I care ;-))

[7] Boot Params     0xB07F0000      64K    <------> ??

This is where the mac address is stored, as well as the ath9k pci fixup data and the calibration data. I think it's different for each unit but, who knows, maybe arcadyan just uses the same calibration data over and over.

[8] Flash Image     0xB0000000    8192K

This is the complete flash

IIRC the "descrambler" (http://www.ip-phone-forum.de/showthread … ost1683467) has to be used on the -1.bin and -2.bin.
-1.bin is the kernel/os (not linux, they use a propietary os), -2.bin is the web interface (which, once deobfuscated, can be decoded by sp700ex).
Not really useful for me (I got rid of the original firmware a while ago), maybe it is for you.

Thanks for the info:

arv7518pw_yacom_0.20.013b2-2_bin , after descramble.exe and lzma contains --> WebUI

Inside WebUI I have found "www\cgi-bin\Bootparams_hid.bin"

I am investigating the other files but I don't know in which files and sections I have my personal data and your calibration data.

For example:

The "Boot Params" section, where is it?

I have found some information about:
   
    MAC and Wifi band....  Bad pdadc table!!!!!  Try recalibration

If you want I can send you and email with the file "arv7518pw_yacom_0.20.013b2-3_unpacked.bin" but I don't know if my personal data will be inside..... How could I split this data?

Synaser and synaptic have not support for windows x64... because of this it is necessary to patch "WIN32" defines with "WINDOWS" ( windows x64="WIN64" and windows x32="WIN32" ).

Edit:  I have been reviewing all files but I don't find personal data and MAC calibration.

First sp700ex on the dump file:

arv7518pw_020_b2.bin - 8192KB

1  (arv7518pw_020_b2-1.bin - 1518Kb)          -> xor with FF. Kernel VxWorks. Some data.
2  (arv7518pw_020_b2-2.bin - 467Kb)           -> descramble and lzma. WebUI pages
3  (arv7518pw_020_b2-3_unpacked.bin - 1405Kb) -> File with interpretable data
4  (arv7518pw_020_b2-4.zip - 171Kb)           -> DANUBE_2.1.2.15.0.1
5  (arv7518pw_020_b2-5.zip - 170Kb)           -> 2_1_2_D_0_2B.bin
6  (arv7518pw_020_b2-6_unpacked.bin 486Kb)    -> ???  (XOR with FF) no interpretable data
7  (arv7518pw_020_b2-7.bin - 1518Kb)          -> (BRNDA7519) I think already unpacked and Decrypted
8  (arv7518pw_020_b2-8.bin -  467)            -> ??
9  (arv7518pw_020_b2-9.lzma-  236)            -> lzma. ok.
10 (arv7518pw_020_b2-10.zip - 171Kb)          -> DANUBE_2.1.2.15.0.1
11 (arv7518pw_020_b2-11.zip - 170Kb)          -> 2_1_2_D_0_2B.bin
12 (arv7518pw_020_b2-12.lzma- 309Kb)          -> lzma. but no interpertable data.
13 (arv7518pw_020_b2-13.bin - 969Kb)          -> (BRNDA7519) some interpretable data

(Last edited by jjb_wii on 3 May 2011, 19:02)

It's the one starting at 0xB07F0000 and ending at 0xB0800000 (actually 0xB07FFFFF).
It contains the mac address and the calibration data for the wifi.

Edit: anyway, it won't do me too much good since it's not documented and I had no feedback on the ath9k and openwrt mailing lists.

(Last edited by pippolippi on 3 May 2011, 18:09)

I have done the dump.  starting at 0xB07F0000 and ending at 0xB0800000.

I don't know how attach files here.... below, you can see some related data:

Atheros Communications, Inc.  AR5001-0000-0000 Wireless LAN Reference Card  MB5522D_0135a00-ÿÿÿÿÿÿÿÿÿÿ

Yesterday ,I have begun to understand the Flash data. it is better to dump section by section. Now I have identificated in "Configuration" data, web user password(admin), superuser, etc...  I change my web user password but here appears "admin"...it is curious...

Beginning on Friday,I start to install and test packages for the DSL, VOIP and SIP.  The VOIP and SIP(Phone1 and Phone2 ports) functionalities are mandatory for me. I hope the SIP client works with yacom

(Last edited by jjb_wii on 4 May 2011, 11:15)

It should work, provided you know the username/authname/password.
I tested it with ekiga and with jusvoip (betamax group). With justvoip I had to use the G729 codec (if I left enabled all the codecs I couldn't hear anything, maybe it was a momentary glitch.
Oh, and I tested behind another router (i.e. with NAT), but I think it should work even better with a direct connection.
Beware that channel 1 is Phone 2 and channel 2 is Phone 1 (and internally the channels are 0,1 instead of 1,2, and it's possible that in debug messages the internal numbers are used).
I don't know how to activate the leds for voip (they're not controlled by a normal GPIO).
And don't install tapidemo (or make sure it doesn't start at boot), otherwise svd cannot start (only one program can use the channels at once).

data received from Netgear DGN3500 on official firmware

u-boot/amazon_s_ref_ddr111.conf content 

u-boot/model_config_spi_16M.sh

Anyone that knows for what SFLASH boot configuration is used?

ROM VER: 1.0.3
CFG 05
Read EEPROMX
 X
SFLASH

I assume that sflash means serial flash but dunno how that can be used to load images back to flash in case that I erase primary bootloader, because I cannot find UART pin on my board.

Hello all,

Finaly, I got to extract my SIP data by checking my dump backup (thanxs pippolippi).

On the other hand, I do not get the "DSL / WAN" working.

I have the ya.com  ISP provider with this settings:

- MAC Encapsulated. LLC VPI / VCI 8 / 32
- DHCP activated.

I tried to configure the file "/etc/config/networks" with this settings:

config atm-bridge
    option unit 0
    option encaps llc
    option vpi 8
    option vci 32
    option payload bridged

config interface wan
    option ifname nas0
    option proto pppoe
    option username "pepe@ya.com"
    option password "password"
    MACADDR option 00: XX: XX: XX: XX: XX

I have also tried to set the wan interface as:

config interface wan
    option ifname nas0
    option proto dhcp
    MACADDR option 00: XX: XX: XX: XX: XX

But no lucky. Maybe I need to configure the ATM QoS UBR. I Keep trying ....

(Last edited by jjb_wii on 12 May 2011, 11:26)

I don't know about anyone that managed to get DSL working with MER (MAC Encapsulated routing) for Yacom. MER is similar to RFC1483/2684 but has some changes that makes it different.

Here I have some kind of explanation, I hope it helps: "#MAC Encapsulated Routing - RFC1483/2684 bridged encapsulation in routing mode. MER uses the same encapsulation as 1483 Bridging but with bridging function disabled. DHCP client function can also be enabled to obtain an IP address dynamically."

Long time ago I tried to find out how to set it up in linux, but I couldn't :-(

PD: What about removing bridged mode or changing it for routed?

Greetings!

(Last edited by sblanco on 13 May 2011, 09:47)

BUMP

This is bootlog from that router with problem usb:

dwc_otg: version 2.60a 22-NOV-2006
DWC_otg: Using DMA mode
dwc_otg dwc_otg.0: DWC OTG Controller
dwc_otg dwc_otg.0: new USB bus registered, assigned bus number 1
dwc_otg dwc_otg.0: irq 62, io mem 0xffffffffbe101000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
DISCONNECTED PORT

Can anybody help?

(Last edited by vpritiskovic on 15 May 2011, 17:19)

I could be wrong, but I think that "xway_register_dwc(29)"  (or maybe 30 instead of 29, I'm not sure gpio numbering starts from 0 or 1) should activate power to your usb.

We managed to get power, the problem was in ifxmips_w32(0x8b87, IFXMIPS_GPIO_P1_ALTSEL0);.... that needs to be added to dwc_otg_ifx.c. I think why it is like that on sx763 is because it has a 500mA or 100mA selection (in original fw) and operational amplifier on usb port.

At the moment I have not achieved to get the DSL working.

http://wiki.openwrt.org/doc/uci/network … r.atm.aal5

I am investigating the way of config the ATM with 'routed'  (thanks sblanco.).. with IP, netmask, gateway..macaddr defined(static) but by the moment, no lucky.  Perhaps the problem it is related to the 'cloned mac' and the server arp cache...

Also, I'm checking that all drivers are working ok. I have seen some problem related to the DSL CPE driver (when I reload the daemon). It seems a missed file '/lib/firmware/ModemHWE.bin'.    ¿Do I need this file?

On the other hand, I have been using the Web UI Luci interface and when I change the ATM VPI/VCI configuration it does not propagate the changes to the br2684ctl process config parameters.... anyway, no problem... I restart it manually.

Regards.

(Last edited by jjb_wii on 16 May 2011, 21:40)

In my case i also had problem with DSL CPE and missing ModemHWE.bin (is this a bug, because i looked into dl folder and FW is properly downloaded?!? why then it is not in compiled image?) Without correct ModemHWE.bin i was unable to connect, but when it is in place, adsl works fine.

thanks for the info angrybb,

I have been investigating on the DSL firmware image "ModemHWE.bin". I have found this files:

Extracted from my dump flash (I don't know if it applies here)

16/07/2007  11:13           299.832 2_1_2_D_0_2B.bin
13/07/2007  18:06           300.880 DANUBE_2.1.2.15.0.1.bin

Downloaded to my dl folder, but not in my generated uimage:

30/09/2009  10:39           328.920 dsl_danube_firmware_adsl_a_244001.bin
19/05/2009  12:04           325.464 dsl_danube_firmware_adsl_b_241702.bin

About downloaded folder files (dl), Which is the correct binary? version 'a' or 'b'.

Regards.

Those from your original fw are old adsl firmwares, use the one downloaded by openwrt.
If you use "annex A" use A image for "annex B" use B image.

Thank you very much!!! (especially angrybb, Delboy, sblanco, pippolippi and Co.)

I am very happy. Finally, ADSL (yacom) conection is working. When I saw that the server gave me  'ip' and 'dns' address I could not believe what I was seeing.

I renamed the "dsl_danube_firmware_adsl_a_244001.bin" to "ModemHWE.bin" and I uploaded to the /lib/firmware directory.

root@OpenWrt:/lib/firmware# tftp -g -r ModemHWE.bin 192.168.1.101 69
ModemHWE.bin         100% |*******************************|   321k --:--:-- ETA
root@OpenWrt:/lib/firmware# ls
ModemHWE.bin
root@OpenWrt:/lib/firmware# cd /etc
root@OpenWrt:/etc# cd /lib
root@OpenWrt:/lib# cd firmware
root@OpenWrt:/lib/firmware# l
/bin/ash: l: not found
root@OpenWrt:/lib/firmware# ls -lart
-rw-r--r--    1 root     root        328920 Mar 27 03:00 ModemHWE.bin
drwxr-xr-x    2 root     root             0 Mar 27 03:00 .
drwxr-xr-x   13 root     root             0 May 18  2011 ..
root@OpenWrt:/lib/firmware# chmod 777 ModemHWE.bin

root@OpenWrt:/etc/init.d# ./ifx_cpe_control_init.sh stop
root@OpenWrt:/etc/init.d# ./ifx_cpe_control_init.sh start
DSL_CPE: using 1st firmware file - /lib/firmware/ModemHWE.bin
DSL_CPE: Device /dev/dsl_cpe_api opened successfully
Start of dsl_cpe_control failed!!!
root@OpenWrt:/etc/init.d# DSL_CPE: Could not unmask event(18) for device 0 (0)!
DSL_CPE: ADSL Firmware WHAT String 2.4.4.0.0.1
DSL_CPE: Already initialized - ignoring '-i' option!


DSL_CPE: drvStaticMemUsage=1024 drvDynamicMemUsage=5864
DSL_CPE:
DSL_CPE: *****************************************************
DSL_CPE:  DSL CPE Control Application version: 3.24.4.4
DSL_CPE: *****************************************************
DSL_CPE:  Global Context static memory usage
DSL_CPE:    context structure            :        156 bytes
DSL_CPE:  Auxiliary data static memory usage
DSL_CPE:    initial configuration data   :         76 bytes
DSL_CPE:    help screen/startup options  :       1187 bytes
DSL_CPE:                                  --------------
DSL_CPE:  Total static memory usage      :       1419 bytes
DSL_CPE:
DSL_CPE:  Debug tool dynamic memory usage:          0 bytes
DSL_CPE:                                  --------------
DSL_CPE:  Total dynamic memory usage     :          0 bytes
DSL_CPE:
DSL_CPE: appStaticMemUsage=1419 appDynamicMemUsage=0

root@OpenWrt:/etc/init.d# [DSL_BSP_Showtime 900]: Datarate US intl = 320000, fas
t = 0
Sending select for 89.xxx.xx.xxx...
Lease of 89.xxx.xx.xxx obtained, lease time 3456000
udhcpc: ifconfig nas0 89.xxx.xx.xxx netmask 255.xxx.xxx.0 broadcast +
udhcpc: setting default routers: 89.xxx.xx.x
udhcpc: setting dns servers: 85.62.229.131 85.62.229.132
0.openwrt.pool.ntp.org: Unknown host
1.openwrt.pool.ntp.org: Unknown host
uci: Entry not found
root@OpenWrt:/etc/init.d#
root@OpenWrt:/etc/init.d# ping www.google.es
PING www.google.es (209.85.146.99): 56 data bytes
64 bytes from 209.85.146.99: seq=0 ttl=54 time=76.285 ms
64 bytes from 209.85.146.99: seq=1 ttl=54 time=72.227 ms
64 bytes from 209.85.146.99: seq=2 ttl=53 time=76.785 ms

In addition, my yacom LLC encapsulated settings (/etc/config/network) were :

root@OpenWrt:/etc/config# cat network

config 'interface' 'loopback'
        option 'ifname' 'lo'
        option 'proto' 'static'
        option 'ipaddr' '127.0.0.1'
        option 'netmask' '255.0.0.0'

config 'interface' 'lan'
        option 'ifname' 'eth0'
        option 'type' 'bridge'
        option 'proto' 'static'
        option 'ipaddr' '192.168.1.1'
        option 'netmask' '255.255.255.0'

config 'atm-bridge'
        option 'unit' '0'
        option 'encaps' 'llc'
        option 'vci' '32'
        option 'payload' 'bridged'
        option 'vpi' '8'

config 'interface' 'wan'
        option 'ifname' 'nas0'
        option 'unit' '0'
        option 'proto' 'dhcp'
        option 'mtu' '1400'
        option 'macaddr' 'XX:XX:XX:XX:XX:XX'

I think step by step, the things begin working ok.

Now I am focused on the voip danube application suggested by pipollini (sofia-sip....VXS ports: phone1, phone 2)

root@OpenWrt:/tmp# mkdir overlay2
root@OpenWrt:/# ln -s /tmp/overlay2 /overlay  (needed for writing permissions...)
root@OpenWrt:/tmp# opkg install svd_1-1_lantiq.ipk sofia-sip_1.12.11-1_lantiq.ip

Installing svd (1-1) to root...
Installing sofia-sip (1.12.11-1) to root...
Configuring sofia-sip.
Collected errors:
 * satisfy_dependencies_for: Cannot satisfy the following dependencies for svd:
 *      libconfig *     kmod-ltq-tapi *         kmod-ltq-vmmc *
 * opkg_install_cmd: Cannot install package svd.
root@OpenWrt:/tmp#

This weekend, I will try to install/test these packages:

kmod-ltq-dsl_2.6.37.6+3.24.4.4-2_lantiq.ipk  (???)
kmod-ltq-tapi_2.6.37.6+3.13.0-3_lantiq.ipk   (kmod-ltq-tapi )
kmod-ltq-ifxos_2.6.37.6+1.5.12-2_lantiq.ipk  (???)

and I will search these:

libconfig *    (???)
kmod-ltq-vmmc * (???)

(Last edited by jjb_wii on 19 May 2011, 22:29)

That's a packaging error on my part: it was needed in my first experiments but it isn't anymore (now it's using libuci). I don't have time to build a fixed package right now, maybe there's a way for ipkg to ignore the dependency?

Edit: I uploaded a new (untested) binary package with the dependency on libconfig removed and the dependency on libuci added.

The source is here:
https://dev.openwrt.org/browser/trunk/package/ltq-vmmc
but I don't see a corresponding binary (never looked for it since I build from source).
I added it to the downloads here: http://code.google.com/p/danube-voip/downloads/

(Last edited by pippolippi on 19 May 2011, 23:14)

Is there any app that show ADSL status ( speed,link quality...) for ltq-dsl, I looked at "DSL CPE Control Application", but it looks like that option isn't there.

Hi
I need a uboot that works for arv4518pw-A-LF-L3(Tele2). I've already erased brnboot.
The only uboot that  boots is this one http://downloads.openwrt.org/snapshots/ … 2_DDR166M/, but it doesn't let me do saveenv and it doesn't find the kernel when I write it or it gives a kernel panic.
I don't need dsl and voice for it anymore. I want to use this router to connect to the internet using the first lan port.

I look forward to your reply.

Thanks
Ady

(Last edited by adi65 on 22 May 2011, 14:21)

If i use the uboot.asc that I got from jokinen I can save the environment and i can boot openwrt using run flash_flash, but I cannot save any modification that I do to /etc/config/netowrk.
I hope I explained the things well.

If you want further information please send me a pm.