When booting an old chaos calmer from serial, I see this.
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
However, I cannot find anything that explains what the different levels are.
Can someone shed some light on this.
best guess would be some level of verbosity with getting into it. 1 being simplest and 4 being give me everything.
https://openwrt.org/docs/techref/hardware/port.serial lists more about serial access.
https://openwrt.org/docs/guide-user/troubleshooting/failsafe_and_factory_reset should help you if you need to reset/upgrade
Hi, reading some of that info, it almost looks like mine is doing something different. I have a serial connection to the device but my only two options are to hit return early in the boot sequence which gets me to the u-boot menu or let it continue at which point it ends like the following. No console, nothing else I can type etc.
I thought maybe hitting one of those options above might get me into the console so I can fix the network settings etc.
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 8.190000] eth0: link up (1000Mbps/Full duplex)
[ 9.470000] jffs2: notice: (318) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 9.480000] mount_root: switching to jffs2 overlay
[ 9.530000] eth0: link down
[ 9.540000] procd: - early -
[ 9.540000] procd: - watchdog -
[ 10.220000] procd: - ubus -
[ 11.230000] procd: - init -
***snip***
[ 12.870000] xt_time: kernel timezone is -0000
[ 12.920000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 13.000000] PPP generic driver version 2.4.2
[ 13.000000] NET: Registered protocol family 24
[ 13.090000] ieee80211 phy0: Atheros AR9330 Rev:1 mem=0xb8100000, irq=2
This is where it ends.
help
help
?
?
It just echos back anything I type but no prompt.
I'd try all of them and log all the outputs. See what is different. Sadly i suspect like was mentioned in the other thread your mini router requires some sort of SSH key to login. However what you could do is dump the image and that way you could at least mount the image under linux and have a closer look. At the very least you would gain access to the filesystem and see what scripts are running to poll data from the solar array.
That would be perfect, that's all I'm trying to do anyhow.
I don't see any way to dump the image from that uboot menu however.
you need something like nanddump to do it.
https://openwrt.ebilan.co.uk/viewtopic.php?f=7&t=138 has a detailed guide for dumping out the bt hub5 router. Thats how i've openwrt'd mine.
As your router runs chaos calmer there must be some way to do something similar and then you can play with the resulting dump and explore the image more fully.
Do you know what the device is exactly? maybe search the table of hardware to find a similar device and check out the backup instructions for them?
(edit) just a thought. have you tried seeing if a webserver is running on it? you may be able to gain access or dump it via that route?
Is this the info? I don't see anything that says a make/model, just a generic Chinese device.
MIPS 24Kc, SoC Atheros AR9330 rev 1
AR7240/AR9330 built-in switch
From the u-boot menu, there is a web server but it's only to write a new firmware to it.
And there is a tftp client I think, to boot the device from. No options for copying the image and not finding any of that kind of information in the thread you shared but then, this might be over my head at this point.
if it is indeed a https://openwrt.org/toh/hwdata/gainstrong/gainstrong_minibox_v1.0 then you should be able to use that source to build a uboot to enable you to dump out the flash.
Gainstrong seems to have a large number of those devices, just like countless others selling the same devices under their own company names. It seems to be very generic but copying the image off of it looks like it's over my head unfortunately.
I just felt they are such jerks for leaving people hanging that I wanted to see if I could just monitor on my own.
given you can get into the bootloader. What you require is some uboot that you can tftp across and then dump the nand. I'm not an expert on that and maybe someone else here can assist.
I did find https://openwrt.org/docs/techref/bootloader/uboot this which may be part of the solution.
(edit) you may be able to boot a generic image by booting it in memory and thus dump the image out that way. I know its done for certain routers in order to flash OpenWrt in that way.
Yes, I think I understand what you are explaining.
That since I can reach the u-boot (U-Boot 1.1.4 (Jul 27 2017)), I might be able to build a new boot loader with an option that would let me copy the image to something else like a USB key or even over the network.
I'm looking at the info you've sent but it just seems to be over my head. I've been wanting to get to a point where I can make images using the source but have not been able to find the time to devote to it yet. I keep trying to however.
I'd have to figure out which code to use, then how to set it then build it then figure out how to write it to replace the current boot loader without trashing the device.
This would take me a week to figure out and I just don't have that kind of time so I think I'm soon out of luck.
the only other option i could suggest is take some pics and logs of what you have done and post a "help me dump this flash" post. As much detail as you can and hopefully someone can give a better answer. In theory its possible, its just the hows exactly.
(edit) the only other thing i could suggest is see if there is a hidden page on the webserver that will allow you to back it up. LEDE openwrt definatly had that option.
1 Like
That is code from OpenWrt failsafe mode entrance logic, where it sets a marker file about the requested system logging level.
That is maybe later read by procd, but not sure...
1 Like
You can try tftpboot from uboot to try and boot a ramdisk image and then use nanddump to get a copy of the flash
Booting a ramdisk won't overwrite the flash so you can experiment
Also
When in failsafe mode did you try if ssh works.
1 Like
When in recovery mode, nmap shows only port 80 being open.
Looking at the source of the html page that shows up, it looks like what I've seen before when only the port 80 is open.
Using nmap with http-enum, there are no other pages to be found.
I'll take a look at the other links shared, thanks.
What's a ramdisk image? Is there a default one I can download from this versions build repo?
Maybe the strange part is that I cannot run some of the u-boot commands that are shown in some of the links being shared. Is the bootloader on this very old or something other than openwrt maybe?
Restore backup from bootloader console
Press any key to stop autoboot, Autobooting in : 2[08][08]1
[08][08]0
uboot> printenv
printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),2816k(rootfs),64k(config),64k(ART)
bootcmd=bootm 0x9F020000
bootdelay=2
baudrate=115200
ipaddr=192.168.1.1
serverip=192.168.1.2
bootfile="firmware.bin"
loadaddr=0x80800000
ncport=6666
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
Environment size: 362 bytes
uboot> bdinfo
bdinfo
## Error: unknown command 'bdinfo' - try 'help'
uboot>
uboot> help
help
? - alias for 'help'
bootm - boot application image from memory
cp - memory copy
dhcpd - invoke DHCP server to obtain IP/boot params
erase - erase FLASH memory
erase_gs - erase FLASH support 4_byte mode.
help - print embedded help
httpd - start www server for firmware recovery
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv - print environment variables
printmac - print MAC address(es) stored in flash
printmodel - print router model stored in flash
reset - perform RESET of the CPU
setenv - set environment variables
setmac - save new MAC address in flash
startnc - start net console
startsc - start serial console
tftpboot - boot image via network using TFTP protocol
version - print U-Boot version
write_gs - write FLASH support 4_byte mode.
uboot>
Ramdisk is similar to a other images except it is stored in ram not flash so it is not permanent and does not make permanent changes to the device
Can you share a few steps on how to go about this so I don't mess the device up. I'm sure it could help anyone else that will come across this post, including me if I needed to do that in the future again. There are times we lose something but we don't want to overwrite what's on there because we need to know what happened, what went wrong and looking at the previous you learn more than overwriting.
Set a tftp server on your PC
Download or build the appropriate initramfs image
From boot use the tftpboot command to fetch the initramfs image and boot it.
Note, what I called ramdisk image is refered to as initramfs image in the openwrt downloads.