Looks like there is a flash.src on the top of the bin file if you view by hex editor. Is that possible we can modify this part and enable SSH or telnet by uploading patched bin file?
����flash.scr��������’���if test "x$verbose" = "x"; then
failedmsg='[failed]'
else
failedmsg='######################################## Failed'
fi
if test -n $soc_hw_version; then
if test "$soc_hw_version" = "200d0200" || test "$soc_hw_version" = "200d0101" || test "$soc_hw_version" = "200d0102" || test "$soc_hw_version" = "200d0100" ; then
echo 'soc_hw_version : Validation success'
else
echo 'soc_hw_version : did not match, aborting upgrade'
exit 1
fi
else
echo 'soc_hw_version : unknown, skipping validation'
fi
if test "$machid" = "8010000" || test "$machid" = "8010100" || test "$machid" = "8010200" || test "$machid" = "8010300" || test "$machid" = "8010400" || test "$machid" = "8010500" || test "$machid" = "1010004" || test "$machid" = "8010001" || test "$machid" = "1010005" || test "$machid" = "8010002" || test "$machid" = "8010003" || test "$machid" = "8010006" || test "$machid" = "8010007" || test "$machid" = "8010008" || test "$machid" = "801000e" || test "$machid" = "801010e" || test "$machid" = "8010011" || test "$machid" = "8010012" || test "$machid" = "8010013" || test "$machid" = "8010009" || test "$machid" = "801000a" || test "$machid" = "801000f" || test "$machid" = "8010010" || test "$machid" = "801000c" || test "$machid" = "801000d" ; then
echo 'machid : Validation success'
else
echo 'machid : unknown, aborting upgrade'
exit 1
fi
if test "x$verbose" = "x"; then
echo \\c'Flashing hlos: '
setenv stdout nulldev
Well, the upgrade process puts out exactly nothing on UART, so those echos are going elsewhere.
One thing I've noticed is that after 'Console Disabled' there's still some activity happening on UART, it just doesn't look like UART:
I check fcc site, CR1000B is using a completely different hardware. It seems a MXL cpu, I would never buy that giving there is no way it will support openwrt.
On another note, I noticed on FCC photos of cr1000a that 6 pin connector is actually 4 pin + 2pin jumper (bottom 2), they have jumper shorted on photos. Could it be the way to enable other consoles?
Edit: I guess the remaining 4 will be in the same order as the other jtag connector?
The FCC internal photos don’t have any good shots of the black PCB. This is a dual-PCB design, likely one handles the ONT part and the other is the Arcadyan board which handles the WiFi. Betting QCA. MaxLinear is extremely unlikely to be used as a SoC here, especially if the device actually runs OpenWrt. That’d be a huge undertaking to support a whole new SoC.
Dual PCB is common in Arcadyan devices. Same design in satellite modems used by HughesNet.
