DWM-222 rev A2

Tomcsanyi, Domonkos domi at tomcsanyi.net
Wed Aug 5 12:27:12 UTC 2020


Hi Roman,

I am pretty sure I used this project, especially unyaffs2 to extract the image. I think I have not used binwalk.

https://github.com/justsoso8/yaffs2utils


I hope this helps.

Cheers,
Domi

> 2020. aug. 5. dátummal, 12:48 időpontban Rogan Dawes <rogan at dawes.za.net> írta:
> 
> 
> Hi Domi,
> 
> I got back to this after some time, and tried to extract the firmware to see which modules were precompiled. However, binwalk was unable to extract the yaffs filesystem. 
> 
> I was able to get to _DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image/, and in there I found:
> 
> -rw-r--r--. 1 rogan rogan      360 Oct 13  2017 tz_combined_hash.mbn
> -rw-r--r--. 1 rogan rogan      548 Dec  4  2014 partition.mbn
> -rw-r--r--. 1 rogan rogan     7840 Apr 20  2015 sdi.mbn
> -rw-r--r--. 1 rogan rogan    25088 Feb 15  2017 NV需求一览表_NEW.xls
> -rw-r--r--. 1 rogan rogan    79196 Feb 15  2016 ENPRG9x25.mbn
> -rw-r--r--. 1 rogan rogan    82912 Feb 15  2016 NPRG9x25.mbn
> -rw-r--r--. 1 rogan rogan    92764 Nov 14  2018 appsboot.mbn
> -rw-r--r--. 1 rogan rogan   146180 Oct 13  2017 rpm.mbn
> -rw-r--r--. 1 rogan rogan   262144 Feb 15  2016 sbl1.mbn
> -rw-r--r--. 1 rogan rogan   267168 Oct 13  2017 tzbsp_no_xpu.mbn
> -rw-r--r--. 1 rogan rogan   275360 Oct 13  2017 tz.mbn
> -rw-r--r--. 1 rogan rogan   299920 Jun 28  2018 mba.mbn
> -rw-r--r--. 1 rogan rogan   569344 Feb 24  2017 efs.mbn
> -rw-r--r--. 1 rogan rogan  3850240 Nov 14  2018 mdm-perf-image-boot-mdm9625-perf.img
> -rw-r--r--. 1 rogan rogan 14012416 Nov  9  2019 cdrom.iso
> -rw-r--r--. 1 rogan rogan 14454528 Nov  9  2019 cdrom.img
> -rw-r--r--. 1 rogan rogan 20116800 Nov 14  2018 msm-mdm-perf-image-eglibc-ipk--mdm9625-perf.rootfs.yaffs2
> -rw-r--r--. 1 rogan rogan 38922048 Nov 14  2018 mdm9625-perf-usr-image.usrfs.yaffs2
> -rw-r--r--. 1 rogan rogan 41711456 Jun 28  2018 qdsp6sw.mbn
> 
> I then tried to extract the two yaffs2 files, but all that happened was I got a new subdirectory with a .gz file, and the original .yaffs2 file again (under a different name, but with the same sha1sum)! I DID get a long list of files that had been detected inside the archive, at least!
> 
> rogan at nemesis:~/Downloads/DWM-222/_DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image$ binwalk -e -z mdm9625-perf-usr-image.usrfs.yaffs2
> 
> DECIMAL       HEXADECIMAL     DESCRIPTION
> --------------------------------------------------------------------------------
> 0             0x0             YAFFS filesystem, little endian
> 8448          0x2100          ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
> 33875         0x8453          Copyright string: "Copyright (c) 2009-2011,2013 Qualcomm Technologies, Inc.  All Rights Reserved."
> 35209         0x8989          Unix path: /sys/kernel/debug"
> 37867         0x93EB          Unix path: /sys/devices/system/soc/soc0/build_id ]; then
> 37931         0x942B          Unix path: /sys/devices/system/s
> 38170         0x951A          Unix path: /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'`
> 42321         0xA551          Copyright string: "Copyright (c) 2009-2011 Qualcomm Technologies, Inc."
> 52800         0xCE40          Executable script, shebang: "/bin/sh --"
> 59219         0xE753          Copyright string: "Copyright (c) 2009-2011,2013 Qualcomm Technologies, Inc.  All Rights Reserved."
> 60553         0xEC89          Unix path: /sys/kernel/debug"
> 63211         0xF6EB          Unix path: /sys/devices/system/soc/soc0/build_id ]; then
> 63275         0xF72B          Unix path: /sys/devices/system/s
> 63514         0xF81A          Unix path: /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'`
> 69095         0x10DE7         Unix path: /sys/devices/system/cpu/cpuX/online
> 71808         0x11880         Executable script, shebang: "/bin/sh --"
> 76113         0x12951         Copyright string: "Copyright (c) 2011,2013 Qualcomm Technologies, Inc.  All Rights Reserved."
> 80337         0x139D1         Copyright string: "Copyright (c) 2011-2012 Qualcomm Technologies, Inc."
> 80579         0x13AC3         Unix path: /sys/devices/system/cpu"
> 80618         0x13AEA         Unix path: /sys/module/pm_8x60/"
> 81302         0x13D96         Unix path: /sys/devices/system/cpu/offline`
> 81533         0x13E7D         Unix path: /sys/devices/system/cpu/offline"
> 81653         0x13EF5         Unix path: /sys/devices/system/cpu/offline"
> 95040         0x17340         Executable script, shebang: "/bin/sh"
> 95081         0x17369         Unix path: /sys/devices/system/clocksource/clocksource0/
> ...
> 
> Any suggestions?
> 
> Thanks!
> 
> Rogan
> 
> 
>> On Tue, 30 Oct 2018 at 14:56, Rogan Dawes <rogan at dawes.za.net> wrote:
>> I just found this, which seems to be referring to some of the same
>> applications related to the DWM-222.
>> 
>> Apparently, if you run dl.exe in a folder on its own, without any
>> firmware available, it should put the device into adb mode. Not sure
>> of you tried that, or if this is what you were referring to with
>> "DLink disabled ADB" ...
>> 
>> Rogan
>> 
>> On Tue, Oct 30, 2018 at 12:27 PM Rogan Dawes <rogan at dawes.za.net> wrote:
>> >
>> > Hi Domi,
>> >
>> > Actually, you are correct, my shields do look like they are "press
>> > fit" onto a cage. I'm hoping that I can find a UART on the test
>> > points, though, before I start pulling the shields off.
>> >
>> > I did some initial probing with the scope, and only found constant 1v8
>> > on some, and constant ground on others. Nothing that suggested UART
>> > activity, unfortunately. That said, I was not "rebooting" between each
>> > point, so the device may have settled down by the time I tested the TX
>> > pin!
>> >
>> > I'll be grabbing a foot switch, so I can reset the modem while probing
>> > each point, hopefully that will give better results!
>> >
>> > I'm happy to try your firmware, to see if I can get ADB working. How
>> > would I check if it can be accessed/enabled? As mentioned, I only get
>> > the 5 ttyUSB devices (and get no response to an AT command on any of
>> > them!)
>> >
>> > My end goal, though, is to have a completely standalone Linux
>> > computer, accessible from the Internet, that can present a variety of
>> > different USB gadget profiles to its host. So, while ADB would assist
>> > in probing the capabilities of the built-in firmware, it would be
>> > superfluous in the long run.
>> >
>> > Rogan
>> >
>> > On Tue, Oct 30, 2018 at 11:25 AM Tomcsányi Domonkos <domi at tomcsanyi.net> wrote:
>> > >
>> > > Hello Rogan,
>> > >
>> > > I'm the author of the Wiki page about the stick.
>> > > https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick
>> > > I am really glad to see some interest in the device.
>> > >
>> > > Do you have ADB access, or that has already been disabled?
>> > > You could try to flash a new firmware on the device, using the provided flasher application (Windows only). Would you be open to run the firmware updater tool with my modified rootfs, that would enable ADB for the stick?
>> > > I think the A1 firmware is compatible, but I cannot say for sure. All I know is that my stick's LED doesn't properly do status indication since I run the upgrade, but otherwise it functions as a modem.
>> > > I'd be happy to co-operate on this project, because I think it is quite interesting.
>> > >
>> > > About the shields: as it could be seen on the pictures I just lifted the metal with a screewdriver to reveal the chips. The A2 has those maybe soldered on?
>> > >
>> > > Also I just noticed D-Link has released 2 new firmwares since I last checked. I will see if I can somehow update my dongle from the current semi-broken state.
>> > >
>> > > Cheers,
>> > > Domi
>> > >
>> > >
>> > >
>> > > 2018. okt. 30. dátummal, 9:43 időpontban Rogan Dawes <rogan at dawes.za.net> írta:
>> > >
>> > > Hi folks,
>> > >
>> > > I have purchased a DLink DWM-222 with the intention of exploring the
>> > > Linux OS running inside it, and if possible, compiling some additional
>> > > USB gadgets to use with it.
>> > >
>> > > FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d
>> > > after switching.
>> > >
>> > > It creates ttyUSB[0-4] when switched, and the VID:PID added to the
>> > > option driver.
>> > >
>> > > I was wondering if there had been any further developments in the
>> > > exploration of the A1 hardware or firmware, in terms of gaining a
>> > > shell on the device at all without soldering?
>> > >
>> > > Some initial probing has shown some 1.8v signals on some of the test
>> > > points, so I will check those with a scope while booting to see if I
>> > > can identify some waveforms, hopefully indicating a UART. I do have a
>> > > FTDI UART with a voltage reference, so I am fairly confident that I
>> > > can access those signals without damaging the device once identified.
>> > >
>> > > Unfortunately, the updated hardware has complete shields over the
>> > > interesting bits, so I cannot identify chips, etc. I have also not
>> > > been able to find firmware for the A2, the only firmware I could find
>> > > was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1. I'll
>> > > check to see if they are compatible. And of course, will be copying
>> > > the driver software from the embedded CDROM.
>> > >
>> > > Regards,
>> > >
>> > > Rogan
>> > > _______________________________________________
>> > > qc-linux-modems mailing list
>> > > qc-linux-modems at lists.osmocom.org
>> > > https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
>> > >
>> > >
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/qc-linux-modems/attachments/20200805/8d7cdd04/attachment.htm>


More information about the qc-linux-modems mailing list