Posted: Wed Nov 04, 2009 16:11 Post subject: How to flash Senao Engenius ECB9500
According the supported devices Wiki the Senao Engenius ECB9500 (rebadged ECB9750???) needs the ECB9750 build - 25.12.08 DD-WRT version. So far so good. I bought the DD-WRT Professional License and downloaded the two .bin files frimware.bin and Senao-ESR9752SC-webflash.bin
How do I install either one of these files? The GUI says I need .dlf files for input. E.g. the App .dlf and the Kernel .dlf
Is there a workaround to flash this device? Or did I trow €20,00 away?
Posted: Tue Apr 06, 2010 4:16 Post subject: Any New Developments?
I have four ecb-9500's and the stock firmware is driving me crazy. Are there any new developments concerning this unit? I am willing to do a serial flash but I am unable to find the image for the ecb-9750 (same unit)
Sash, Thanks for the reply. Sorry I am dense but I cannot seem to find "beta releases" in the download section any longer. Can you possibly send me a link?
AMD Read Mode, flash reset,triger at BC000000
flash_protect ON: from 0xBC400000 to 0xBC42522F
protect on 64
protect on 65
protect on 66
monitor protection ON by default,monitor_flash_len = 152112
ENV protection ON by default !!
flash_protect ON: from 0xBC430000 to 0xBC43FFFF
protect on 67
D-CACHE set to 4 way
I-CACHE set to 4 way
##### The CPU freq = 266 MHZ ####
SDRAM bus set to 32 bit
SDRAM size =32 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
5: Load ucos code to SDRAM via TFTP.
AMD Read Mode, flash reset,triger at BC000000
flash_protect ON: from 0xBC400000 to 0xBC42522F
protect on 64
protect on 65
protect on 66
monitor protection ON by default,monitor_flash_len = 152112
ENV protection ON by default !!
flash_protect ON: from 0xBC430000 to 0xBC43FFFF
protect on 67
D-CACHE set to 4 way
I-CACHE set to 4 way
##### The CPU freq = 266 MHZ ####
SDRAM bus set to 32 bit
SDRAM size =32 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
5: Load ucos code to SDRAM via TFTP.
0
3: System Boot system code via Flash.
## Booting image at bc450000 ...
Image Name: DD-WRT v24 Linux Kernel Image
Created: 2010-03-24 10:26:15 UTC
System Control Status = 0x02910084
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 887874 Bytes = 867.1 kB
Load Address: 88000000
Entry Point: 8829d000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8829d000) ...
## Giving linux memsize in MB, 32
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.23.17 (root@dd-wrt) (gcc version 4.1.2) #2412 Wed Mar 24 11:23:01 CET 2010
The CPU frequency set to 266 MHz
32M RAM Detected!
CPU revision is: 0001906c
Determined physical RAM map:
memory: 02000000 @ 08000000 (usable)
Wasting 1048576 bytes for tracking 32768 unused pages
Built 1 zonelists in Zone order. Total pages: 40640
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 rootfstype=squashfs noinitrd
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
cause = 10800000, status = 1000ff00
PID hash table entries: 1024 (order: 10, 4096 bytes)
calculating r4koff... 0028b0aa(2666666)
CPU frequency 266.67 MHz
Using 133.333 MHz high precision timer.
console [ttyS1] enabled
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 28032k/32768k available (2353k kernel code, 4680k reserved, 318k data, 124k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
Load RT2880 Timer Module(Wdg/Soft)
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xa0300500 (irq = 9) is a 16550A
serial8250: ttyS1 at I/O 0xa0300c00 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ralink flash device: 0x800000 at 0xbf000000
Ralink SoC physically mapped flash bank 1: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
Ralink SoC physically mapped flash bank 1: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
found squashfs at 529000
Creating 6 MTD partitions on "Ralink SoC physically mapped flash bank 1":
0x00400000-0x00430000 : "uboot"
0x00430000-0x00440000 : "uboot-config"
0x00440000-0x00450000 : "factory-defaults"
0x00450000-0x007e0000 : "linux"
0x00529000-0x007e0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x007e0000-0x007f0000 : "nvram"
u32 classifier
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
IPP2P v0.8.2 loading
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <deri@ntop.org>
NET: Registered protocol family 27
PF_RING: bucket length 128 bytes
PF_RING: ring slots 4096
PF_RING: sample rate 1 [1=no sampling]
PF_RING: capture TX No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.00 256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 256, Rx Ring = 256
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43288029
PROC INIT OK!
raeth: link up.
raeth: AN completed.
raeth: timeout for AN
mdio.wb addr[00000000] value[0x0000FFFF]
mdio.wb addr[0x0] value[0xFFFF]
decode /dev/mtdblock4
attempt to access beyond end of device
mtdblock4: rw=0, want=10940, limit=5560
SQUASHFS error: sb_bread failed reading block 0x155d
SQUASHFS error: unable to read uid/gid table
List of all partitions:
1f00 192 mtdblock0 (driver?)
1f01 64 mtdblock1 (driver?)
1f02 64 mtdblock2 (driver?)
1f03 3648 mtdblock3 (driver?)
1f04 2780 mtdblock4 (driver?)
1f05 64 mtdblock5 (driver?)
No filesystem could mount root, tried: squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)
Rebooting in 1 seconds..
I now have serial access and have flashed the unit, but there appears to be some strange flash config by default. Sectors 64, 65,
& 66. And the kernel image starts at 69. The issue is that It won't properly flash an image larger than ~4mb.
Any chance you could post the serial pinouts for this unit here? I have put the unit in "developer mode" (mode of stock firmware) and now LAN and WLAN are down, I cannot access the unit anymore...
I now have serial access and have flashed the unit, but there appears to be some strange flash config by default. Sectors 64, 65,
& 66. And the kernel image starts at 69. The issue is that It won't properly flash an image larger than ~4mb.
Any chance you could post the serial pinouts for this unit here? I have put the unit in "developer mode" (mode of stock firmware) and now LAN and WLAN are down, I cannot access the unit anymore...
Thanks
Rick
So... just out of curiousity, how do you enable developer mode in the firmware?
Posted: Sun Jun 16, 2013 7:42 Post subject: Build 21061 does NOT work with ECB9500
So, I tried some of the older builds and can confirm the issue that efloth faced with the 6MB image files. The new build simply reports an LZMA ERROR 1. The unit is just a paperweight now since this was advertised as working (was it even tested?) and I gave up the original firmware (which can no longer be loaded to these devices by the way) to flash it.
Posted: Sun Jun 16, 2013 9:53 Post subject: Build 21061 does NOT work with ECB9500
So deal is, the format of the firmware.bin file is incorrect... I tried extracting with the Google Firmware Tools for DD-WRT and it reports the firmware image has some faults -- even though it extracts correctly. I tried downloading the file from several different machines and Internet connections, so I doubt the issue is with a corrupt file. I also tried the ECB9750 files as well... no luck at all. Did anyone get this to work successfully for EITHER the ECB9500 or ECB9750? Thanks.
Posted: Sun Jun 16, 2013 23:16 Post subject: Re: Build 21061 does NOT work with ECB9500
zhamza wrote:
So deal is, the format of the firmware.bin file is incorrect... I tried extracting with the Google Firmware Tools for DD-WRT and it reports the firmware image has some faults -- even though it extracts correctly. I tried downloading the file from several different machines and Internet connections, so I doubt the issue is with a corrupt file. I also tried the ECB9750 files as well... no luck at all. Did anyone get this to work successfully for EITHER the ECB9500 or ECB9750? Thanks.
I would not rely much on Google Firmware Tools because they are as good as information given to developers about proprietary file formats. I had problem with another Senao router ESR1221N2 but in the process learned that recovery methods are often similar.
Is the original bootloader still present? Can you try the following?
1. press 1 like crazy during first couple seconds of router startup or press and hold WPS button when connecting the power adaptor.
2. If you are lucky router will enter into "recovery mode" It's usually indicated by slowly flashing LED.
3. Setup your PC IP address manually as
192.168.99.8
255.255.255.0
gw. 192.168.99.1
4. Open the browser and point to 192.168.9.9
5. If you see "Emergency Mode" web page. Flash the .dlf files. KNL file first
Otherwise to use tftp server, dfl files need to be cleaned up first with header.x86 and dd. _________________ Asus RT-AC66R Target:brcm47xx SubTarget:mips74k Packages:mipsel_74kc
Netgear R7000 Target:bcm53xx Packages:arm_cortex-a9
AMD Read Mode, flash reset,triger at BC000000
flash_protect ON: from 0xBC400000 to 0xBC42522F
protect on 64
protect on 65
protect on 66
monitor protection ON by default,monitor_flash_len = 152112
ENV protection ON by default !!
flash_protect ON: from 0xBC430000 to 0xBC43FFFF
protect on 67
D-CACHE set to 4 way
I-CACHE set to 4 way
##### The CPU freq = 266 MHZ ####
SDRAM bus set to 32 bit
SDRAM size =32 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
5: Load ucos code to SDRAM via TFTP. 0
3: System Boot system code via Flash.
## Booting image at bc450000 ...
Image Name: DD-WRT v24 Linux Kernel Image
Created: 2013-03-25 9:59:16 UTC
System Control Status = 0x02910084
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 917237 Bytes = 895.7 kB
Load Address: 80000000
Entry Point: 80218e90
Verifying Checksum ... OK
Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
Note that, like EnGenius firmware, the way to bypass this seemingly ~4MB limit (3866624 bytes) is to create 2 firmware images and flash the system one after the other... possibly by loading the first image into memory (KNL -- likely the linux kernel file) then the next image (APPS -- likely the filesystem). Although the current approach of reducing the size of the firmware image might work, it may simply need to be repackaged. I will try this using the firmware tools.
Posted: Mon Jun 17, 2013 2:44 Post subject: Re: hanskloss
I have had no luck with trying to repackage the firmware at all with the Google Firmware Tools... so I may think you are right... that, or the "firmware.bin" file is just poorly compiled (and since it is not quite OSS code, I can't really do it myself... or can I?).
I assume in step 4 you mean "192.168.99.9" or did you mean the IP range to be "192.168.9.0/24"?... I have tried both with no luck though.
I have tried your method. Pressing 1 like crazy lands me in the "Load system from TFTP" and will just prompt for an IP address, a server IP address and a filename. Holding the WPS button while plugging in the ECB9500 seems to do nothing at all... same result while holding the reset button.
Finally, no matter what I have tried, I cannot seem to get the emergency HTTP page (which you have indicated ALL Senao devices have?). It is correct to assume I have not replaced the U-Boot portion of the router (which holds the upper 4MB of the router memory; strange, because unless there is some heavy in there... what are all those 4MB for? Perhaps there is an HTTP server in there as you say... TFTP servers take less than a few KBs)... and I think that would be a really bad idea since replacing it with Redboot (or anything... really...) could possibly permanently brick the device with no further hope of easy recovery. Figuring out a JTAG for these Senao devices seems like that kind of stuff hell is made of... so I would like to avoid it.
I would just like someone to TAKE DOWN the "YES" for the ECB9500 (and possible ECB9750 as well) from the site in the meantime because this is NOT correct. It is STILL not supported.