Ok, at the end I have my sercomm working and debricked again.
Thaks to foilic for his time and patience, much appreciated.
Hurray.
Feel free to elaborate on that.
How did you do it, the Wiki might need updating ....
If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Tmomas, we are considering making a guide or how to for next who has this problem, once done it I mark solution.
1 Like
hey! how did you manage that man!? i have the same problem but now i think i made it worse hahahahaha i cant have acess to CFE anymore, u-boot acess via ttl is working!
Quantenna Mini U-Boot
Version: v37.4.0.29 Built: 9月 08 2016 at 14:17:26
br
1G-FD
Using br device
TFTP from server 1.1.1.1; our IP address is 1.1.1.2
Filename 'u-boot.bin'.
Load address: 0x88000000
Loading: *
ARP Retry count exceeded; starting again
T 1G-FD
BOOTP broadcast 1
Quantenna Mini U-Boot
Version: v37.4.0.29 Built: 9月 08 2016 at 14:17:26
br
1G-FD
Using br device
TFTP from server 1.1.1.1; our IP address is 1.1.1.2
Filename 'u-boot.bin'.
Load address: 0x88000000
Loading: T #######
####the u-boot.bin file is not correct!#######
could you help me somehow please?
i have the same problem.Can you explain how to solve it?
Hello, I have the same problem. Can you help me?
i have the same problem.Can you explain how to solve it?
I have the Lowi version and also bricked it, it seems it's impossible to revert to original FW after flashing Openwrt?
Yes, there's no way of stopping the CFE on Lowi version, but keeping the WPS pressed down before power-on still enters the Recovery mode.
I then flashed the system using sercomm-recovery as stated in the wiki.
It's actually pretty simple, but requires native linux (I wasn't able to connect inside a VM).
An old Ubuntu version works all right, like 14.04 (Only 1GB), I made a bootable USB using Rufus.
Download and extract:
Copy it all together to a second drive, my ubuntu refused to mount the usb from where it was booted from.
Start a Live system (The option "Try ubuntu without installing").
Copy the files to the Home folder, run make inside sercomm-recovery folder, it should work right away, just dropping a small printf warning.
Also put the file flash_burn.bin inside the recovery folder.
Check your ethernet name by running ifconfig, it's normally eth0.
Push WPS, turn on the router, wait about 5-10 seconds until the led starts blinking red, release the button.
Now run the tool:
sudo ./sercomm-recovery eth0 flash_burn.bin
It should find it and start the recovery procedure. After 5 minutes or so it will finish.
The firmware version from the flash burn file is VDF 3.6.0.6, not good because in this version root acccess is restricted in Telnet/SSH even with admin account.
I found I could simply downgrade it to 3.4.17 from the user interface, though it took me 2 tries, the first one it failed for some reason and refused to apply the update.
After updating and rebooting, you can now enter Telnet, port 2323, using the default admin account, giving root access.
Not happy with telnet, I added SSH:
Remount root as writable:
mount / -o remount,rw
Edit the rcS script:
vi /etc/rcS
Append this line:
/usr/sbin/sshd -p 2222
Done! Now ssh will be available at port 2222 (iptables has rules blocking the ports 22 and 23).
Still, SSH won't allow shell access, it redirects the shell to /bin/login2 (Symlinked to /bin/sc_cli).
I simply renamed it:
mv /bin/sc_cli /bin/sc_cli_
Then it works just fine:
Using username "admin".
BusyBox v1.15.3 () built-in shell (ash)
Enter 'help' for a list of built-in commands.
~ #
I've sucessfully recovered two H500s this way, one was a Lowi and the other a VDF version.
(They both run the same VDF firmware now).
2 Likes