DWM-222 rev A2

Rogan Dawes rogan at dawes.za.net
Wed Aug 5 10:48:46 UTC 2020


Hi Domi,

I got back to this after some time, and tried to extract the firmware to
see which modules were precompiled. However, binwalk was unable to extract
the yaffs filesystem.

I was able to get
to _DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image/,
and in there I found:

-rw-r--r--. 1 rogan rogan      360 Oct 13  2017 tz_combined_hash.mbn
-rw-r--r--. 1 rogan rogan      548 Dec  4  2014 partition.mbn
-rw-r--r--. 1 rogan rogan     7840 Apr 20  2015 sdi.mbn
-rw-r--r--. 1 rogan rogan    25088 Feb 15  2017 NV需求一览表_NEW.xls
-rw-r--r--. 1 rogan rogan    79196 Feb 15  2016 ENPRG9x25.mbn
-rw-r--r--. 1 rogan rogan    82912 Feb 15  2016 NPRG9x25.mbn
-rw-r--r--. 1 rogan rogan    92764 Nov 14  2018 appsboot.mbn
-rw-r--r--. 1 rogan rogan   146180 Oct 13  2017 rpm.mbn
-rw-r--r--. 1 rogan rogan   262144 Feb 15  2016 sbl1.mbn
-rw-r--r--. 1 rogan rogan   267168 Oct 13  2017 tzbsp_no_xpu.mbn
-rw-r--r--. 1 rogan rogan   275360 Oct 13  2017 tz.mbn
-rw-r--r--. 1 rogan rogan   299920 Jun 28  2018 mba.mbn
-rw-r--r--. 1 rogan rogan   569344 Feb 24  2017 efs.mbn
-rw-r--r--. 1 rogan rogan  3850240 Nov 14  2018
mdm-perf-image-boot-mdm9625-perf.img
-rw-r--r--. 1 rogan rogan 14012416 Nov  9  2019 cdrom.iso
-rw-r--r--. 1 rogan rogan 14454528 Nov  9  2019 cdrom.img
-rw-r--r--. 1 rogan rogan 20116800 Nov 14  2018
msm-mdm-perf-image-eglibc-ipk--mdm9625-perf.rootfs.yaffs2
-rw-r--r--. 1 rogan rogan 38922048 Nov 14  2018
mdm9625-perf-usr-image.usrfs.yaffs2
-rw-r--r--. 1 rogan rogan 41711456 Jun 28  2018 qdsp6sw.mbn

I then tried to extract the two yaffs2 files, but all that happened was I
got a new subdirectory with a .gz file, and the original .yaffs2 file again
(under a different name, but with the same sha1sum)! I DID get a long list
of files that had been detected inside the archive, at least!

rogan at nemesis:~/Downloads/DWM-222/_DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image$
binwalk -e -z mdm9625-perf-usr-image.usrfs.yaffs2

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             YAFFS filesystem, little endian
8448          0x2100          ELF, 32-bit LSB executable, ARM, version 1
(SYSV)
33875         0x8453          Copyright string: "Copyright (c)
2009-2011,2013 Qualcomm Technologies, Inc.  All Rights Reserved."
35209         0x8989          Unix path: /sys/kernel/debug"
37867         0x93EB          Unix path:
/sys/devices/system/soc/soc0/build_id ]; then
37931         0x942B          Unix path: /sys/devices/system/s
38170         0x951A          Unix path:
/sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'`
42321         0xA551          Copyright string: "Copyright (c) 2009-2011
Qualcomm Technologies, Inc."
52800         0xCE40          Executable script, shebang: "/bin/sh --"
59219         0xE753          Copyright string: "Copyright (c)
2009-2011,2013 Qualcomm Technologies, Inc.  All Rights Reserved."
60553         0xEC89          Unix path: /sys/kernel/debug"
63211         0xF6EB          Unix path:
/sys/devices/system/soc/soc0/build_id ]; then
63275         0xF72B          Unix path: /sys/devices/system/s
63514         0xF81A          Unix path:
/sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'`
69095         0x10DE7         Unix path: /sys/devices/system/cpu/cpuX/online
71808         0x11880         Executable script, shebang: "/bin/sh --"
76113         0x12951         Copyright string: "Copyright (c) 2011,2013
Qualcomm Technologies, Inc.  All Rights Reserved."
80337         0x139D1         Copyright string: "Copyright (c) 2011-2012
Qualcomm Technologies, Inc."
80579         0x13AC3         Unix path: /sys/devices/system/cpu"
80618         0x13AEA         Unix path: /sys/module/pm_8x60/"
81302         0x13D96         Unix path: /sys/devices/system/cpu/offline`
81533         0x13E7D         Unix path: /sys/devices/system/cpu/offline"
81653         0x13EF5         Unix path: /sys/devices/system/cpu/offline"
95040         0x17340         Executable script, shebang: "/bin/sh"
95081         0x17369         Unix path:
/sys/devices/system/clocksource/clocksource0/
...

Any suggestions?

Thanks!

Rogan


On Tue, 30 Oct 2018 at 14:56, Rogan Dawes <rogan at dawes.za.net> wrote:

> I just found this, which seems to be referring to some of the same
> applications related to the DWM-222.
>
> Apparently, if you run dl.exe in a folder on its own, without any
> firmware available, it should put the device into adb mode. Not sure
> of you tried that, or if this is what you were referring to with
> "DLink disabled ADB" ...
>
> Rogan
>
> On Tue, Oct 30, 2018 at 12:27 PM Rogan Dawes <rogan at dawes.za.net> wrote:
> >
> > Hi Domi,
> >
> > Actually, you are correct, my shields do look like they are "press
> > fit" onto a cage. I'm hoping that I can find a UART on the test
> > points, though, before I start pulling the shields off.
> >
> > I did some initial probing with the scope, and only found constant 1v8
> > on some, and constant ground on others. Nothing that suggested UART
> > activity, unfortunately. That said, I was not "rebooting" between each
> > point, so the device may have settled down by the time I tested the TX
> > pin!
> >
> > I'll be grabbing a foot switch, so I can reset the modem while probing
> > each point, hopefully that will give better results!
> >
> > I'm happy to try your firmware, to see if I can get ADB working. How
> > would I check if it can be accessed/enabled? As mentioned, I only get
> > the 5 ttyUSB devices (and get no response to an AT command on any of
> > them!)
> >
> > My end goal, though, is to have a completely standalone Linux
> > computer, accessible from the Internet, that can present a variety of
> > different USB gadget profiles to its host. So, while ADB would assist
> > in probing the capabilities of the built-in firmware, it would be
> > superfluous in the long run.
> >
> > Rogan
> >
> > On Tue, Oct 30, 2018 at 11:25 AM Tomcsányi Domonkos <domi at tomcsanyi.net>
> wrote:
> > >
> > > Hello Rogan,
> > >
> > > I'm the author of the Wiki page about the stick.
> > > https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick
> > > I am really glad to see some interest in the device.
> > >
> > > Do you have ADB access, or that has already been disabled?
> > > You could try to flash a new firmware on the device, using the
> provided flasher application (Windows only). Would you be open to run the
> firmware updater tool with my modified rootfs, that would enable ADB for
> the stick?
> > > I think the A1 firmware is compatible, but I cannot say for sure. All
> I know is that my stick's LED doesn't properly do status indication since I
> run the upgrade, but otherwise it functions as a modem.
> > > I'd be happy to co-operate on this project, because I think it is
> quite interesting.
> > >
> > > About the shields: as it could be seen on the pictures I just lifted
> the metal with a screewdriver to reveal the chips. The A2 has those maybe
> soldered on?
> > >
> > > Also I just noticed D-Link has released 2 new firmwares since I last
> checked. I will see if I can somehow update my dongle from the current
> semi-broken state.
> > >
> > > Cheers,
> > > Domi
> > >
> > >
> > >
> > > 2018. okt. 30. dátummal, 9:43 időpontban Rogan Dawes <
> rogan at dawes.za.net> írta:
> > >
> > > Hi folks,
> > >
> > > I have purchased a DLink DWM-222 with the intention of exploring the
> > > Linux OS running inside it, and if possible, compiling some additional
> > > USB gadgets to use with it.
> > >
> > > FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d
> > > after switching.
> > >
> > > It creates ttyUSB[0-4] when switched, and the VID:PID added to the
> > > option driver.
> > >
> > > I was wondering if there had been any further developments in the
> > > exploration of the A1 hardware or firmware, in terms of gaining a
> > > shell on the device at all without soldering?
> > >
> > > Some initial probing has shown some 1.8v signals on some of the test
> > > points, so I will check those with a scope while booting to see if I
> > > can identify some waveforms, hopefully indicating a UART. I do have a
> > > FTDI UART with a voltage reference, so I am fairly confident that I
> > > can access those signals without damaging the device once identified.
> > >
> > > Unfortunately, the updated hardware has complete shields over the
> > > interesting bits, so I cannot identify chips, etc. I have also not
> > > been able to find firmware for the A2, the only firmware I could find
> > > was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1. I'll
> > > check to see if they are compatible. And of course, will be copying
> > > the driver software from the embedded CDROM.
> > >
> > > Regards,
> > >
> > > Rogan
> > > _______________________________________________
> > > qc-linux-modems mailing list
> > > qc-linux-modems at lists.osmocom.org
> > > https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
> > >
> > >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/qc-linux-modems/attachments/20200805/00a2ae81/attachment-0001.htm>


More information about the qc-linux-modems mailing list