search

jclehner / bcm2-utils

Utilities for Broadcom-based cable modems
GNU General Public License v3.0
147 stars 25 forks source link

How to write dynamic/permanent flash? #72

Open Anonymous941 opened 1 week ago

Anonymous941 commented 1 week ago

@jclehner When trying to factory reset my DDW36C, I accidentally wiped out all dynamic and permanent settings. Now its default SSID is WIFIDEAD01 and won't authenticate with my ISP

I have a backup of all the partitions, but am unable to send anything; tftp_read and tftp_write fail without even trying to connect to my LAN IP. I tried patching bcm2dump to enable writing, but despite claiming it wrote the settings successfully, after rebooting nothing changes. It seems it's flushing the settings to NVRAM for some reason and I don't know how to stop it

I have a CM console, but am unable to access the bootloader because there is no prompt; the first thing printed after reset is eCos - hal_diag_init, which is sent from image2 (I checked in Ghidra)

Anonymous941 commented 1 week ago

It turns out that bcm2dump write ... flash ... doesn't use the command /flash/erase -r unless it can directly call it with /call. Manually running this command and then running bcm2dump fixed it

jclehner commented 6 days ago

I'll have to dig out my modems and check, but as far as I remember they didn't have a /flash/erase command. Thanks for the info though, I'll have to incorporate that into bcm2dump.

Anonymous941 commented 6 days ago

I'll have to dig out my modems and check, but as far as I remember they didn't have a /flash/erase command. Thanks for the info though, I'll have to incorporate that into bcm2dump.

Interesting, maybe it's not there if the flash doesn't require erasing. The help text for the /flash/write command says The value will only be stored if the block was previously erased, or a bit is being changed from 1 to 0., and here is the help text for /flash/erase (in case none of your routers have it):

Erases the flash block specified by the block number (-b), address offset (-a) or erases all blocks in the region (-r).

Not sure if it matters whether you erase one block at a time or the whole region, for me the region worked