Sercomm h500-s bricked

Installing and Using OpenWrt
1

Hello everyone,
Im new using openwrt. My first instalation is on sercomm h500-s.
I did change firmware from Vodafone to openwrt successfully, then I did continue enabling quantenna 5g , but at some point it didn't let me activate tftp, so I gave up, and in uci console tried to send oem firmware back to router with command. It sended the knew firmware and waited 45 min. Untill I switched off router.

Now I cannot start router, it keeps looping quantenna uboot at server 1.1.1.1 having ip 1.1.1.2. I made uart cable and screened/dev/ ttyUSB0 115200 and saw a boot loop.
I don't know how to recover back, I'm sorry I'm new with this.
I cant stop the boot loop to enter any command or don't know how to sent a firmware to the router.
Please I'm asking for your help to get back to Vodafone firmware.
Thanks for your time.

2

Hopefully you don't own the lowi version

Alert :The H500-s lowi model is unrecoverable after a brick. There is no known way to stop the bootloader at the command line on the serial console.

3

Hello thanks for posting froilic. No, I own the not lowi version. The vfes version with QT3740BC serial port.

4

in that case you should try the bootloader recovery, problem is it isn't documented.

So we don't know how to use it.

First thing you have to do is to try to find out what IP it's using.
It's either by trial and error, or by attaching a serial cable, and reading the console output.

Another option might be the arp command, but then you need to know the MAC address of the device.

5

Hello froilic thanks for your time. When I plug the rj45 cable, router while looping, is not giving any ip, it keeps looking and looking for ip, connecting and disconnecting every 7 seconds.
I tried with static ip, example 192.168.0.100, but the thing is I don't know how to stop the loop and send command.
I couldn't configure tftp as command uci set dhcp.@dnsmasq[-1].enable_tftp=1, was giving me error and didn't end it up. So I guess tftp is not configured.
One question is in this situation, how do I guess the mac?

6

you can't,

hopefully you can find it on the back sticker of the device.

But if the unit is waiting for an IP, you need to start up a DHCP server for it to
get an IP assigned.

7

Ok I will send to you the sticker and the screen /dev/ttyUSB0 session.

Google Photos

Here is console screen output
Quantenna Mini U-Boot Version: v37.4.0.28 Built: Dec 18 2015 at 20:33:40 br 1G-FD Using br device TFTP from server 1.1.1.1; our IP address is 1.1.1.2 Filename 'u-boot.bin'. Load address: 0x88000000 Loading: T T T ARP Retry count exceeded; starting again T 1G-FD BOOTP broadcast 1 BOOTP broadcast 2 Retry count exceeded; starting again 1G-FD Using br device TFTP from server 1.1.1.1; our IP address is 1.1.1.2 Filename 'u-boot.bin'. Load address: 0x88000000 Loading: * ARP Retry count exceeded; starting again T 1G-FD

Check if uploaded correctly. And much appreciated for your time helping me

8

Well,

The MAC's there, but as long as your device boot looping it won't help you much.

You need to stabilize it first.

9

I agree, but question is how do I manage on stabilise it, if I could send any command to router then I could send new firmware.
But since it keeps looping, is not giving any ip, and can't stop loop to enter console...

Thanks again for your time.

10

Like I said, you need to set up a DHCP for it to get an IP

(assuming that's what it's looking for)

11

Now I'm at home so I can start working on it.
Let's explain working scenario, y have connected to router through a 3 wired dku-5 prolific 2303.
Connected gnd rx and tx.
From uart connection, is it possible to send any command to router? Or only screen /dev/ttyUSB0 115200 to see what's going on?

I connect rj45 and make static ip on PC to 192.168.0.100.
I have opened 2 console. one I have screen /dev/ttyUSB0 115200 running u-boot loop.
One opened with command nmap 192.168.0.1 searching for 20 min but nothing happens.
Then I tried ssh 192.168.0.1, nothing happens it sends the command from PC, but router is not accessible.
Then try the same to 1.1.1.1 ip but still nothing, try again to conect to 1.1.1.2 from telnet,ssh,and tftp and nothing happens.

So, from what I've tested, I need to find a door on router, and seems from LAN its not possible,
I think It could be possible from serial com port,
But don't know how.

Thanks again for your Time helping me.

P.d. One thing I just discovered, when powering on the router, it disays green led first top one, and starts uboot loop. But if I press wps button for 3 seconds, then a red led light comes on, and stays there until power off, but screen keeps on uboot looping, so I tried to put firmware to usb, connected to router and switched off and on and wps button....nothing happens...
I keep on trying...

12

You previously said it's looking for an IP / DHCP, that has to be your start, unless there's useful info provided by the serial console.

13

I agree, but as I'm testing on lan when dhcp and looking at screen /dev/ttyUSB0 115200 every 7 seconds there is a boot loop, then every 7 seconds dhcp LAN disconnect and reconnect looking for an IP resulting on a loop that never ends finding an IP on router.

14

can you C&P a dump of the console traffic ?

15

Exactly foilic what command should I use, I'm sorry I'm quite new at Linux but learning step by step.
I've been looking around for sending commands to ttyusb0 with echo in one console and cat in another console to check if it can send commands an reding outputs.

And thanks again for your time and patience.

16

I'm confused, do you have a readable console output, or not ?

17

I have one console opened with command screen /dev/ttyUSB0 115200 from where I see the boot loop.

18

post it on https://pastebin.com/, your links are protected.

1 Like
19

Here is wireshark short audition from LAN from power off to switch on. Might be useful

20

dude, you pasted the link again, not the content :slight_smile: