DWM-222 rev A2

Rogan Dawes rogan at dawes.za.net
Wed Aug 5 12:57:41 UTC 2020


I had tried that, as well as the djeclipse version of unyaffs2, and neither
worked. Also tried -e to switch endianess, and -p to choose different page
sizes. Still nothing extracted.

I'm clearly doing something wrong!

Currently I am poking around in the sources for unyaffs2 to see if I can
add any logging to figure out where the problem is.

Regards,

Rogan


On Wed, 5 Aug 2020 at 14:27, Tomcsanyi, Domonkos <domi at tomcsanyi.net> wrote:

> Hi Roman,
>
> I am pretty sure I used this project, especially unyaffs2 to extract the
> image. I think I have not used binwalk.
>
> https://github.com/justsoso8/yaffs2utils
>
>
> I hope this helps.
>
> Cheers,
> Domi
>
> 2020. aug. 5. dátummal, 12:48 időpontban Rogan Dawes <rogan at dawes.za.net>
> írta:
>
> 
> Hi Domi,
>
> I got back to this after some time, and tried to extract the firmware to
> see which modules were precompiled. However, binwalk was unable to extract
> the yaffs filesystem.
>
> I was able to get
> to _DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image/,
> and in there I found:
>
> -rw-r--r--. 1 rogan rogan      360 Oct 13  2017 tz_combined_hash.mbn
> -rw-r--r--. 1 rogan rogan      548 Dec  4  2014 partition.mbn
> -rw-r--r--. 1 rogan rogan     7840 Apr 20  2015 sdi.mbn
> -rw-r--r--. 1 rogan rogan    25088 Feb 15  2017 NV需求一览表_NEW.xls
> -rw-r--r--. 1 rogan rogan    79196 Feb 15  2016 ENPRG9x25.mbn
> -rw-r--r--. 1 rogan rogan    82912 Feb 15  2016 NPRG9x25.mbn
> -rw-r--r--. 1 rogan rogan    92764 Nov 14  2018 appsboot.mbn
> -rw-r--r--. 1 rogan rogan   146180 Oct 13  2017 rpm.mbn
> -rw-r--r--. 1 rogan rogan   262144 Feb 15  2016 sbl1.mbn
> -rw-r--r--. 1 rogan rogan   267168 Oct 13  2017 tzbsp_no_xpu.mbn
> -rw-r--r--. 1 rogan rogan   275360 Oct 13  2017 tz.mbn
> -rw-r--r--. 1 rogan rogan   299920 Jun 28  2018 mba.mbn
> -rw-r--r--. 1 rogan rogan   569344 Feb 24  2017 efs.mbn
> -rw-r--r--. 1 rogan rogan  3850240 Nov 14  2018
> mdm-perf-image-boot-mdm9625-perf.img
> -rw-r--r--. 1 rogan rogan 14012416 Nov  9  2019 cdrom.iso
> -rw-r--r--. 1 rogan rogan 14454528 Nov  9  2019 cdrom.img
> -rw-r--r--. 1 rogan rogan 20116800 Nov 14  2018
> msm-mdm-perf-image-eglibc-ipk--mdm9625-perf.rootfs.yaffs2
> -rw-r--r--. 1 rogan rogan 38922048 Nov 14  2018
> mdm9625-perf-usr-image.usrfs.yaffs2
> -rw-r--r--. 1 rogan rogan 41711456 Jun 28  2018 qdsp6sw.mbn
>
> I then tried to extract the two yaffs2 files, but all that happened was I
> got a new subdirectory with a .gz file, and the original .yaffs2 file again
> (under a different name, but with the same sha1sum)! I DID get a long list
> of files that had been detected inside the archive, at least!
>
> rogan at nemesis:~/Downloads/DWM-222/_DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image$
> binwalk -e -z mdm9625-perf-usr-image.usrfs.yaffs2
>
> DECIMAL       HEXADECIMAL     DESCRIPTION
>
> --------------------------------------------------------------------------------
> 0             0x0             YAFFS filesystem, little endian
> 8448          0x2100          ELF, 32-bit LSB executable, ARM, version 1
> (SYSV)
> 33875         0x8453          Copyright string: "Copyright (c)
> 2009-2011,2013 Qualcomm Technologies, Inc.  All Rights Reserved."
> 35209         0x8989          Unix path: /sys/kernel/debug"
> 37867         0x93EB          Unix path:
> /sys/devices/system/soc/soc0/build_id ]; then
> 37931         0x942B          Unix path: /sys/devices/system/s
> 38170         0x951A          Unix path:
> /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'`
> 42321         0xA551          Copyright string: "Copyright (c) 2009-2011
> Qualcomm Technologies, Inc."
> 52800         0xCE40          Executable script, shebang: "/bin/sh --"
> 59219         0xE753          Copyright string: "Copyright (c)
> 2009-2011,2013 Qualcomm Technologies, Inc.  All Rights Reserved."
> 60553         0xEC89          Unix path: /sys/kernel/debug"
> 63211         0xF6EB          Unix path:
> /sys/devices/system/soc/soc0/build_id ]; then
> 63275         0xF72B          Unix path: /sys/devices/system/s
> 63514         0xF81A          Unix path:
> /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'`
> 69095         0x10DE7         Unix path:
> /sys/devices/system/cpu/cpuX/online
> 71808         0x11880         Executable script, shebang: "/bin/sh --"
> 76113         0x12951         Copyright string: "Copyright (c) 2011,2013
> Qualcomm Technologies, Inc.  All Rights Reserved."
> 80337         0x139D1         Copyright string: "Copyright (c) 2011-2012
> Qualcomm Technologies, Inc."
> 80579         0x13AC3         Unix path: /sys/devices/system/cpu"
> 80618         0x13AEA         Unix path: /sys/module/pm_8x60/"
> 81302         0x13D96         Unix path: /sys/devices/system/cpu/offline`
> 81533         0x13E7D         Unix path: /sys/devices/system/cpu/offline"
> 81653         0x13EF5         Unix path: /sys/devices/system/cpu/offline"
> 95040         0x17340         Executable script, shebang: "/bin/sh"
> 95081         0x17369         Unix path:
> /sys/devices/system/clocksource/clocksource0/
> ...
>
> Any suggestions?
>
> Thanks!
>
> Rogan
>
>
> On Tue, 30 Oct 2018 at 14:56, Rogan Dawes <rogan at dawes.za.net> wrote:
>
>> I just found this, which seems to be referring to some of the same
>> applications related to the DWM-222.
>>
>> Apparently, if you run dl.exe in a folder on its own, without any
>> firmware available, it should put the device into adb mode. Not sure
>> of you tried that, or if this is what you were referring to with
>> "DLink disabled ADB" ...
>>
>> Rogan
>>
>> On Tue, Oct 30, 2018 at 12:27 PM Rogan Dawes <rogan at dawes.za.net> wrote:
>> >
>> > Hi Domi,
>> >
>> > Actually, you are correct, my shields do look like they are "press
>> > fit" onto a cage. I'm hoping that I can find a UART on the test
>> > points, though, before I start pulling the shields off.
>> >
>> > I did some initial probing with the scope, and only found constant 1v8
>> > on some, and constant ground on others. Nothing that suggested UART
>> > activity, unfortunately. That said, I was not "rebooting" between each
>> > point, so the device may have settled down by the time I tested the TX
>> > pin!
>> >
>> > I'll be grabbing a foot switch, so I can reset the modem while probing
>> > each point, hopefully that will give better results!
>> >
>> > I'm happy to try your firmware, to see if I can get ADB working. How
>> > would I check if it can be accessed/enabled? As mentioned, I only get
>> > the 5 ttyUSB devices (and get no response to an AT command on any of
>> > them!)
>> >
>> > My end goal, though, is to have a completely standalone Linux
>> > computer, accessible from the Internet, that can present a variety of
>> > different USB gadget profiles to its host. So, while ADB would assist
>> > in probing the capabilities of the built-in firmware, it would be
>> > superfluous in the long run.
>> >
>> > Rogan
>> >
>> > On Tue, Oct 30, 2018 at 11:25 AM Tomcsányi Domonkos <domi at tomcsanyi.net>
>> wrote:
>> > >
>> > > Hello Rogan,
>> > >
>> > > I'm the author of the Wiki page about the stick.
>> > > https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick
>> > > I am really glad to see some interest in the device.
>> > >
>> > > Do you have ADB access, or that has already been disabled?
>> > > You could try to flash a new firmware on the device, using the
>> provided flasher application (Windows only). Would you be open to run the
>> firmware updater tool with my modified rootfs, that would enable ADB for
>> the stick?
>> > > I think the A1 firmware is compatible, but I cannot say for sure. All
>> I know is that my stick's LED doesn't properly do status indication since I
>> run the upgrade, but otherwise it functions as a modem.
>> > > I'd be happy to co-operate on this project, because I think it is
>> quite interesting.
>> > >
>> > > About the shields: as it could be seen on the pictures I just lifted
>> the metal with a screewdriver to reveal the chips. The A2 has those maybe
>> soldered on?
>> > >
>> > > Also I just noticed D-Link has released 2 new firmwares since I last
>> checked. I will see if I can somehow update my dongle from the current
>> semi-broken state.
>> > >
>> > > Cheers,
>> > > Domi
>> > >
>> > >
>> > >
>> > > 2018. okt. 30. dátummal, 9:43 időpontban Rogan Dawes <
>> rogan at dawes.za.net> írta:
>> > >
>> > > Hi folks,
>> > >
>> > > I have purchased a DLink DWM-222 with the intention of exploring the
>> > > Linux OS running inside it, and if possible, compiling some additional
>> > > USB gadgets to use with it.
>> > >
>> > > FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d
>> > > after switching.
>> > >
>> > > It creates ttyUSB[0-4] when switched, and the VID:PID added to the
>> > > option driver.
>> > >
>> > > I was wondering if there had been any further developments in the
>> > > exploration of the A1 hardware or firmware, in terms of gaining a
>> > > shell on the device at all without soldering?
>> > >
>> > > Some initial probing has shown some 1.8v signals on some of the test
>> > > points, so I will check those with a scope while booting to see if I
>> > > can identify some waveforms, hopefully indicating a UART. I do have a
>> > > FTDI UART with a voltage reference, so I am fairly confident that I
>> > > can access those signals without damaging the device once identified.
>> > >
>> > > Unfortunately, the updated hardware has complete shields over the
>> > > interesting bits, so I cannot identify chips, etc. I have also not
>> > > been able to find firmware for the A2, the only firmware I could find
>> > > was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1.
>> I'll
>> > > check to see if they are compatible. And of course, will be copying
>> > > the driver software from the embedded CDROM.
>> > >
>> > > Regards,
>> > >
>> > > Rogan
>> > > _______________________________________________
>> > > qc-linux-modems mailing list
>> > > qc-linux-modems at lists.osmocom.org
>> > > https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
>> > >
>> > >
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/qc-linux-modems/attachments/20200805/fc86778b/attachment-0001.htm>


More information about the qc-linux-modems mailing list