Hi folks,
I have purchased a DLink DWM-222 with the intention of exploring the Linux OS running inside it, and if possible, compiling some additional USB gadgets to use with it.
FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d after switching.
It creates ttyUSB[0-4] when switched, and the VID:PID added to the option driver.
I was wondering if there had been any further developments in the exploration of the A1 hardware or firmware, in terms of gaining a shell on the device at all without soldering?
Some initial probing has shown some 1.8v signals on some of the test points, so I will check those with a scope while booting to see if I can identify some waveforms, hopefully indicating a UART. I do have a FTDI UART with a voltage reference, so I am fairly confident that I can access those signals without damaging the device once identified.
Unfortunately, the updated hardware has complete shields over the interesting bits, so I cannot identify chips, etc. I have also not been able to find firmware for the A2, the only firmware I could find was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1. I'll check to see if they are compatible. And of course, will be copying the driver software from the embedded CDROM.
Regards,
Rogan
Hello Rogan,
I'm the author of the Wiki page about the stick. https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick I am really glad to see some interest in the device.
Do you have ADB access, or that has already been disabled? You could try to flash a new firmware on the device, using the provided flasher application (Windows only). Would you be open to run the firmware updater tool with my modified rootfs, that would enable ADB for the stick? I think the A1 firmware is compatible, but I cannot say for sure. All I know is that my stick's LED doesn't properly do status indication since I run the upgrade, but otherwise it functions as a modem. I'd be happy to co-operate on this project, because I think it is quite interesting.
About the shields: as it could be seen on the pictures I just lifted the metal with a screewdriver to reveal the chips. The A2 has those maybe soldered on?
Also I just noticed D-Link has released 2 new firmwares since I last checked. I will see if I can somehow update my dongle from the current semi-broken state.
Cheers, Domi
- okt. 30. dátummal, 9:43 időpontban Rogan Dawes rogan@dawes.za.net írta:
Hi folks,
I have purchased a DLink DWM-222 with the intention of exploring the Linux OS running inside it, and if possible, compiling some additional USB gadgets to use with it.
FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d after switching.
It creates ttyUSB[0-4] when switched, and the VID:PID added to the option driver.
I was wondering if there had been any further developments in the exploration of the A1 hardware or firmware, in terms of gaining a shell on the device at all without soldering?
Some initial probing has shown some 1.8v signals on some of the test points, so I will check those with a scope while booting to see if I can identify some waveforms, hopefully indicating a UART. I do have a FTDI UART with a voltage reference, so I am fairly confident that I can access those signals without damaging the device once identified.
Unfortunately, the updated hardware has complete shields over the interesting bits, so I cannot identify chips, etc. I have also not been able to find firmware for the A2, the only firmware I could find was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1. I'll check to see if they are compatible. And of course, will be copying the driver software from the embedded CDROM.
Regards,
Rogan _______________________________________________ qc-linux-modems mailing list qc-linux-modems@lists.osmocom.org https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
Hi Domi,
Actually, you are correct, my shields do look like they are "press fit" onto a cage. I'm hoping that I can find a UART on the test points, though, before I start pulling the shields off.
I did some initial probing with the scope, and only found constant 1v8 on some, and constant ground on others. Nothing that suggested UART activity, unfortunately. That said, I was not "rebooting" between each point, so the device may have settled down by the time I tested the TX pin!
I'll be grabbing a foot switch, so I can reset the modem while probing each point, hopefully that will give better results!
I'm happy to try your firmware, to see if I can get ADB working. How would I check if it can be accessed/enabled? As mentioned, I only get the 5 ttyUSB devices (and get no response to an AT command on any of them!)
My end goal, though, is to have a completely standalone Linux computer, accessible from the Internet, that can present a variety of different USB gadget profiles to its host. So, while ADB would assist in probing the capabilities of the built-in firmware, it would be superfluous in the long run.
Rogan
On Tue, Oct 30, 2018 at 11:25 AM Tomcsányi Domonkos domi@tomcsanyi.net wrote:
Hello Rogan,
I'm the author of the Wiki page about the stick. https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick I am really glad to see some interest in the device.
Do you have ADB access, or that has already been disabled? You could try to flash a new firmware on the device, using the provided flasher application (Windows only). Would you be open to run the firmware updater tool with my modified rootfs, that would enable ADB for the stick? I think the A1 firmware is compatible, but I cannot say for sure. All I know is that my stick's LED doesn't properly do status indication since I run the upgrade, but otherwise it functions as a modem. I'd be happy to co-operate on this project, because I think it is quite interesting.
About the shields: as it could be seen on the pictures I just lifted the metal with a screewdriver to reveal the chips. The A2 has those maybe soldered on?
Also I just noticed D-Link has released 2 new firmwares since I last checked. I will see if I can somehow update my dongle from the current semi-broken state.
Cheers, Domi
- okt. 30. dátummal, 9:43 időpontban Rogan Dawes rogan@dawes.za.net írta:
Hi folks,
I have purchased a DLink DWM-222 with the intention of exploring the Linux OS running inside it, and if possible, compiling some additional USB gadgets to use with it.
FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d after switching.
It creates ttyUSB[0-4] when switched, and the VID:PID added to the option driver.
I was wondering if there had been any further developments in the exploration of the A1 hardware or firmware, in terms of gaining a shell on the device at all without soldering?
Some initial probing has shown some 1.8v signals on some of the test points, so I will check those with a scope while booting to see if I can identify some waveforms, hopefully indicating a UART. I do have a FTDI UART with a voltage reference, so I am fairly confident that I can access those signals without damaging the device once identified.
Unfortunately, the updated hardware has complete shields over the interesting bits, so I cannot identify chips, etc. I have also not been able to find firmware for the A2, the only firmware I could find was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1. I'll check to see if they are compatible. And of course, will be copying the driver software from the embedded CDROM.
Regards,
Rogan _______________________________________________ qc-linux-modems mailing list qc-linux-modems@lists.osmocom.org https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
I just found this, which seems to be referring to some of the same applications related to the DWM-222.
Apparently, if you run dl.exe in a folder on its own, without any firmware available, it should put the device into adb mode. Not sure of you tried that, or if this is what you were referring to with "DLink disabled ADB" ...
Rogan
On Tue, Oct 30, 2018 at 12:27 PM Rogan Dawes rogan@dawes.za.net wrote:
Hi Domi,
Actually, you are correct, my shields do look like they are "press fit" onto a cage. I'm hoping that I can find a UART on the test points, though, before I start pulling the shields off.
I did some initial probing with the scope, and only found constant 1v8 on some, and constant ground on others. Nothing that suggested UART activity, unfortunately. That said, I was not "rebooting" between each point, so the device may have settled down by the time I tested the TX pin!
I'll be grabbing a foot switch, so I can reset the modem while probing each point, hopefully that will give better results!
I'm happy to try your firmware, to see if I can get ADB working. How would I check if it can be accessed/enabled? As mentioned, I only get the 5 ttyUSB devices (and get no response to an AT command on any of them!)
My end goal, though, is to have a completely standalone Linux computer, accessible from the Internet, that can present a variety of different USB gadget profiles to its host. So, while ADB would assist in probing the capabilities of the built-in firmware, it would be superfluous in the long run.
Rogan
On Tue, Oct 30, 2018 at 11:25 AM Tomcsányi Domonkos domi@tomcsanyi.net wrote:
Hello Rogan,
I'm the author of the Wiki page about the stick. https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick I am really glad to see some interest in the device.
Do you have ADB access, or that has already been disabled? You could try to flash a new firmware on the device, using the provided flasher application (Windows only). Would you be open to run the firmware updater tool with my modified rootfs, that would enable ADB for the stick? I think the A1 firmware is compatible, but I cannot say for sure. All I know is that my stick's LED doesn't properly do status indication since I run the upgrade, but otherwise it functions as a modem. I'd be happy to co-operate on this project, because I think it is quite interesting.
About the shields: as it could be seen on the pictures I just lifted the metal with a screewdriver to reveal the chips. The A2 has those maybe soldered on?
Also I just noticed D-Link has released 2 new firmwares since I last checked. I will see if I can somehow update my dongle from the current semi-broken state.
Cheers, Domi
- okt. 30. dátummal, 9:43 időpontban Rogan Dawes rogan@dawes.za.net írta:
Hi folks,
I have purchased a DLink DWM-222 with the intention of exploring the Linux OS running inside it, and if possible, compiling some additional USB gadgets to use with it.
FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d after switching.
It creates ttyUSB[0-4] when switched, and the VID:PID added to the option driver.
I was wondering if there had been any further developments in the exploration of the A1 hardware or firmware, in terms of gaining a shell on the device at all without soldering?
Some initial probing has shown some 1.8v signals on some of the test points, so I will check those with a scope while booting to see if I can identify some waveforms, hopefully indicating a UART. I do have a FTDI UART with a voltage reference, so I am fairly confident that I can access those signals without damaging the device once identified.
Unfortunately, the updated hardware has complete shields over the interesting bits, so I cannot identify chips, etc. I have also not been able to find firmware for the A2, the only firmware I could find was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1. I'll check to see if they are compatible. And of course, will be copying the driver software from the embedded CDROM.
Regards,
Rogan _______________________________________________ qc-linux-modems mailing list qc-linux-modems@lists.osmocom.org https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
Hi Domi,
I got back to this after some time, and tried to extract the firmware to see which modules were precompiled. However, binwalk was unable to extract the yaffs filesystem.
I was able to get to _DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image/, and in there I found:
-rw-r--r--. 1 rogan rogan 360 Oct 13 2017 tz_combined_hash.mbn -rw-r--r--. 1 rogan rogan 548 Dec 4 2014 partition.mbn -rw-r--r--. 1 rogan rogan 7840 Apr 20 2015 sdi.mbn -rw-r--r--. 1 rogan rogan 25088 Feb 15 2017 NV需求一览表_NEW.xls -rw-r--r--. 1 rogan rogan 79196 Feb 15 2016 ENPRG9x25.mbn -rw-r--r--. 1 rogan rogan 82912 Feb 15 2016 NPRG9x25.mbn -rw-r--r--. 1 rogan rogan 92764 Nov 14 2018 appsboot.mbn -rw-r--r--. 1 rogan rogan 146180 Oct 13 2017 rpm.mbn -rw-r--r--. 1 rogan rogan 262144 Feb 15 2016 sbl1.mbn -rw-r--r--. 1 rogan rogan 267168 Oct 13 2017 tzbsp_no_xpu.mbn -rw-r--r--. 1 rogan rogan 275360 Oct 13 2017 tz.mbn -rw-r--r--. 1 rogan rogan 299920 Jun 28 2018 mba.mbn -rw-r--r--. 1 rogan rogan 569344 Feb 24 2017 efs.mbn -rw-r--r--. 1 rogan rogan 3850240 Nov 14 2018 mdm-perf-image-boot-mdm9625-perf.img -rw-r--r--. 1 rogan rogan 14012416 Nov 9 2019 cdrom.iso -rw-r--r--. 1 rogan rogan 14454528 Nov 9 2019 cdrom.img -rw-r--r--. 1 rogan rogan 20116800 Nov 14 2018 msm-mdm-perf-image-eglibc-ipk--mdm9625-perf.rootfs.yaffs2 -rw-r--r--. 1 rogan rogan 38922048 Nov 14 2018 mdm9625-perf-usr-image.usrfs.yaffs2 -rw-r--r--. 1 rogan rogan 41711456 Jun 28 2018 qdsp6sw.mbn
I then tried to extract the two yaffs2 files, but all that happened was I got a new subdirectory with a .gz file, and the original .yaffs2 file again (under a different name, but with the same sha1sum)! I DID get a long list of files that had been detected inside the archive, at least!
rogan@nemesis:~/Downloads/DWM-222/_DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image$ binwalk -e -z mdm9625-perf-usr-image.usrfs.yaffs2
DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 YAFFS filesystem, little endian 8448 0x2100 ELF, 32-bit LSB executable, ARM, version 1 (SYSV) 33875 0x8453 Copyright string: "Copyright (c) 2009-2011,2013 Qualcomm Technologies, Inc. All Rights Reserved." 35209 0x8989 Unix path: /sys/kernel/debug" 37867 0x93EB Unix path: /sys/devices/system/soc/soc0/build_id ]; then 37931 0x942B Unix path: /sys/devices/system/s 38170 0x951A Unix path: /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'` 42321 0xA551 Copyright string: "Copyright (c) 2009-2011 Qualcomm Technologies, Inc." 52800 0xCE40 Executable script, shebang: "/bin/sh --" 59219 0xE753 Copyright string: "Copyright (c) 2009-2011,2013 Qualcomm Technologies, Inc. All Rights Reserved." 60553 0xEC89 Unix path: /sys/kernel/debug" 63211 0xF6EB Unix path: /sys/devices/system/soc/soc0/build_id ]; then 63275 0xF72B Unix path: /sys/devices/system/s 63514 0xF81A Unix path: /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'` 69095 0x10DE7 Unix path: /sys/devices/system/cpu/cpuX/online 71808 0x11880 Executable script, shebang: "/bin/sh --" 76113 0x12951 Copyright string: "Copyright (c) 2011,2013 Qualcomm Technologies, Inc. All Rights Reserved." 80337 0x139D1 Copyright string: "Copyright (c) 2011-2012 Qualcomm Technologies, Inc." 80579 0x13AC3 Unix path: /sys/devices/system/cpu" 80618 0x13AEA Unix path: /sys/module/pm_8x60/" 81302 0x13D96 Unix path: /sys/devices/system/cpu/offline` 81533 0x13E7D Unix path: /sys/devices/system/cpu/offline" 81653 0x13EF5 Unix path: /sys/devices/system/cpu/offline" 95040 0x17340 Executable script, shebang: "/bin/sh" 95081 0x17369 Unix path: /sys/devices/system/clocksource/clocksource0/ ...
Any suggestions?
Thanks!
Rogan
On Tue, 30 Oct 2018 at 14:56, Rogan Dawes rogan@dawes.za.net wrote:
I just found this, which seems to be referring to some of the same applications related to the DWM-222.
Apparently, if you run dl.exe in a folder on its own, without any firmware available, it should put the device into adb mode. Not sure of you tried that, or if this is what you were referring to with "DLink disabled ADB" ...
Rogan
On Tue, Oct 30, 2018 at 12:27 PM Rogan Dawes rogan@dawes.za.net wrote:
Hi Domi,
Actually, you are correct, my shields do look like they are "press fit" onto a cage. I'm hoping that I can find a UART on the test points, though, before I start pulling the shields off.
I did some initial probing with the scope, and only found constant 1v8 on some, and constant ground on others. Nothing that suggested UART activity, unfortunately. That said, I was not "rebooting" between each point, so the device may have settled down by the time I tested the TX pin!
I'll be grabbing a foot switch, so I can reset the modem while probing each point, hopefully that will give better results!
I'm happy to try your firmware, to see if I can get ADB working. How would I check if it can be accessed/enabled? As mentioned, I only get the 5 ttyUSB devices (and get no response to an AT command on any of them!)
My end goal, though, is to have a completely standalone Linux computer, accessible from the Internet, that can present a variety of different USB gadget profiles to its host. So, while ADB would assist in probing the capabilities of the built-in firmware, it would be superfluous in the long run.
Rogan
On Tue, Oct 30, 2018 at 11:25 AM Tomcsányi Domonkos domi@tomcsanyi.net
wrote:
Hello Rogan,
I'm the author of the Wiki page about the stick. https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick I am really glad to see some interest in the device.
Do you have ADB access, or that has already been disabled? You could try to flash a new firmware on the device, using the
provided flasher application (Windows only). Would you be open to run the firmware updater tool with my modified rootfs, that would enable ADB for the stick?
I think the A1 firmware is compatible, but I cannot say for sure. All
I know is that my stick's LED doesn't properly do status indication since I run the upgrade, but otherwise it functions as a modem.
I'd be happy to co-operate on this project, because I think it is
quite interesting.
About the shields: as it could be seen on the pictures I just lifted
the metal with a screewdriver to reveal the chips. The A2 has those maybe soldered on?
Also I just noticed D-Link has released 2 new firmwares since I last
checked. I will see if I can somehow update my dongle from the current semi-broken state.
Cheers, Domi
- okt. 30. dátummal, 9:43 időpontban Rogan Dawes <
rogan@dawes.za.net> írta:
Hi folks,
I have purchased a DLink DWM-222 with the intention of exploring the Linux OS running inside it, and if possible, compiling some additional USB gadgets to use with it.
FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d after switching.
It creates ttyUSB[0-4] when switched, and the VID:PID added to the option driver.
I was wondering if there had been any further developments in the exploration of the A1 hardware or firmware, in terms of gaining a shell on the device at all without soldering?
Some initial probing has shown some 1.8v signals on some of the test points, so I will check those with a scope while booting to see if I can identify some waveforms, hopefully indicating a UART. I do have a FTDI UART with a voltage reference, so I am fairly confident that I can access those signals without damaging the device once identified.
Unfortunately, the updated hardware has complete shields over the interesting bits, so I cannot identify chips, etc. I have also not been able to find firmware for the A2, the only firmware I could find was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1. I'll check to see if they are compatible. And of course, will be copying the driver software from the embedded CDROM.
Regards,
Rogan _______________________________________________ qc-linux-modems mailing list qc-linux-modems@lists.osmocom.org https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
Hi Roman,
I am pretty sure I used this project, especially unyaffs2 to extract the image. I think I have not used binwalk.
https://github.com/justsoso8/yaffs2utils
I hope this helps.
Cheers, Domi
- aug. 5. dátummal, 12:48 időpontban Rogan Dawes rogan@dawes.za.net írta:
Hi Domi,
I got back to this after some time, and tried to extract the firmware to see which modules were precompiled. However, binwalk was unable to extract the yaffs filesystem.
I was able to get to _DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image/, and in there I found:
-rw-r--r--. 1 rogan rogan 360 Oct 13 2017 tz_combined_hash.mbn -rw-r--r--. 1 rogan rogan 548 Dec 4 2014 partition.mbn -rw-r--r--. 1 rogan rogan 7840 Apr 20 2015 sdi.mbn -rw-r--r--. 1 rogan rogan 25088 Feb 15 2017 NV需求一览表_NEW.xls -rw-r--r--. 1 rogan rogan 79196 Feb 15 2016 ENPRG9x25.mbn -rw-r--r--. 1 rogan rogan 82912 Feb 15 2016 NPRG9x25.mbn -rw-r--r--. 1 rogan rogan 92764 Nov 14 2018 appsboot.mbn -rw-r--r--. 1 rogan rogan 146180 Oct 13 2017 rpm.mbn -rw-r--r--. 1 rogan rogan 262144 Feb 15 2016 sbl1.mbn -rw-r--r--. 1 rogan rogan 267168 Oct 13 2017 tzbsp_no_xpu.mbn -rw-r--r--. 1 rogan rogan 275360 Oct 13 2017 tz.mbn -rw-r--r--. 1 rogan rogan 299920 Jun 28 2018 mba.mbn -rw-r--r--. 1 rogan rogan 569344 Feb 24 2017 efs.mbn -rw-r--r--. 1 rogan rogan 3850240 Nov 14 2018 mdm-perf-image-boot-mdm9625-perf.img -rw-r--r--. 1 rogan rogan 14012416 Nov 9 2019 cdrom.iso -rw-r--r--. 1 rogan rogan 14454528 Nov 9 2019 cdrom.img -rw-r--r--. 1 rogan rogan 20116800 Nov 14 2018 msm-mdm-perf-image-eglibc-ipk--mdm9625-perf.rootfs.yaffs2 -rw-r--r--. 1 rogan rogan 38922048 Nov 14 2018 mdm9625-perf-usr-image.usrfs.yaffs2 -rw-r--r--. 1 rogan rogan 41711456 Jun 28 2018 qdsp6sw.mbn
I then tried to extract the two yaffs2 files, but all that happened was I got a new subdirectory with a .gz file, and the original .yaffs2 file again (under a different name, but with the same sha1sum)! I DID get a long list of files that had been detected inside the archive, at least!
rogan@nemesis:~/Downloads/DWM-222/_DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image$ binwalk -e -z mdm9625-perf-usr-image.usrfs.yaffs2
DECIMAL HEXADECIMAL DESCRIPTION
0 0x0 YAFFS filesystem, little endian 8448 0x2100 ELF, 32-bit LSB executable, ARM, version 1 (SYSV) 33875 0x8453 Copyright string: "Copyright (c) 2009-2011,2013 Qualcomm Technologies, Inc. All Rights Reserved." 35209 0x8989 Unix path: /sys/kernel/debug" 37867 0x93EB Unix path: /sys/devices/system/soc/soc0/build_id ]; then 37931 0x942B Unix path: /sys/devices/system/s 38170 0x951A Unix path: /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'` 42321 0xA551 Copyright string: "Copyright (c) 2009-2011 Qualcomm Technologies, Inc." 52800 0xCE40 Executable script, shebang: "/bin/sh --" 59219 0xE753 Copyright string: "Copyright (c) 2009-2011,2013 Qualcomm Technologies, Inc. All Rights Reserved." 60553 0xEC89 Unix path: /sys/kernel/debug" 63211 0xF6EB Unix path: /sys/devices/system/soc/soc0/build_id ]; then 63275 0xF72B Unix path: /sys/devices/system/s 63514 0xF81A Unix path: /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'` 69095 0x10DE7 Unix path: /sys/devices/system/cpu/cpuX/online 71808 0x11880 Executable script, shebang: "/bin/sh --" 76113 0x12951 Copyright string: "Copyright (c) 2011,2013 Qualcomm Technologies, Inc. All Rights Reserved." 80337 0x139D1 Copyright string: "Copyright (c) 2011-2012 Qualcomm Technologies, Inc." 80579 0x13AC3 Unix path: /sys/devices/system/cpu" 80618 0x13AEA Unix path: /sys/module/pm_8x60/" 81302 0x13D96 Unix path: /sys/devices/system/cpu/offline` 81533 0x13E7D Unix path: /sys/devices/system/cpu/offline" 81653 0x13EF5 Unix path: /sys/devices/system/cpu/offline" 95040 0x17340 Executable script, shebang: "/bin/sh" 95081 0x17369 Unix path: /sys/devices/system/clocksource/clocksource0/ ...
Any suggestions?
Thanks!
Rogan
On Tue, 30 Oct 2018 at 14:56, Rogan Dawes rogan@dawes.za.net wrote: I just found this, which seems to be referring to some of the same applications related to the DWM-222.
Apparently, if you run dl.exe in a folder on its own, without any firmware available, it should put the device into adb mode. Not sure of you tried that, or if this is what you were referring to with "DLink disabled ADB" ...
Rogan
On Tue, Oct 30, 2018 at 12:27 PM Rogan Dawes rogan@dawes.za.net wrote:
Hi Domi,
Actually, you are correct, my shields do look like they are "press fit" onto a cage. I'm hoping that I can find a UART on the test points, though, before I start pulling the shields off.
I did some initial probing with the scope, and only found constant 1v8 on some, and constant ground on others. Nothing that suggested UART activity, unfortunately. That said, I was not "rebooting" between each point, so the device may have settled down by the time I tested the TX pin!
I'll be grabbing a foot switch, so I can reset the modem while probing each point, hopefully that will give better results!
I'm happy to try your firmware, to see if I can get ADB working. How would I check if it can be accessed/enabled? As mentioned, I only get the 5 ttyUSB devices (and get no response to an AT command on any of them!)
My end goal, though, is to have a completely standalone Linux computer, accessible from the Internet, that can present a variety of different USB gadget profiles to its host. So, while ADB would assist in probing the capabilities of the built-in firmware, it would be superfluous in the long run.
Rogan
On Tue, Oct 30, 2018 at 11:25 AM Tomcsányi Domonkos domi@tomcsanyi.net wrote:
Hello Rogan,
I'm the author of the Wiki page about the stick. https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick I am really glad to see some interest in the device.
Do you have ADB access, or that has already been disabled? You could try to flash a new firmware on the device, using the provided flasher application (Windows only). Would you be open to run the firmware updater tool with my modified rootfs, that would enable ADB for the stick? I think the A1 firmware is compatible, but I cannot say for sure. All I know is that my stick's LED doesn't properly do status indication since I run the upgrade, but otherwise it functions as a modem. I'd be happy to co-operate on this project, because I think it is quite interesting.
About the shields: as it could be seen on the pictures I just lifted the metal with a screewdriver to reveal the chips. The A2 has those maybe soldered on?
Also I just noticed D-Link has released 2 new firmwares since I last checked. I will see if I can somehow update my dongle from the current semi-broken state.
Cheers, Domi
- okt. 30. dátummal, 9:43 időpontban Rogan Dawes rogan@dawes.za.net írta:
Hi folks,
I have purchased a DLink DWM-222 with the intention of exploring the Linux OS running inside it, and if possible, compiling some additional USB gadgets to use with it.
FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d after switching.
It creates ttyUSB[0-4] when switched, and the VID:PID added to the option driver.
I was wondering if there had been any further developments in the exploration of the A1 hardware or firmware, in terms of gaining a shell on the device at all without soldering?
Some initial probing has shown some 1.8v signals on some of the test points, so I will check those with a scope while booting to see if I can identify some waveforms, hopefully indicating a UART. I do have a FTDI UART with a voltage reference, so I am fairly confident that I can access those signals without damaging the device once identified.
Unfortunately, the updated hardware has complete shields over the interesting bits, so I cannot identify chips, etc. I have also not been able to find firmware for the A2, the only firmware I could find was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1. I'll check to see if they are compatible. And of course, will be copying the driver software from the embedded CDROM.
Regards,
Rogan _______________________________________________ qc-linux-modems mailing list qc-linux-modems@lists.osmocom.org https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
I had tried that, as well as the djeclipse version of unyaffs2, and neither worked. Also tried -e to switch endianess, and -p to choose different page sizes. Still nothing extracted.
I'm clearly doing something wrong!
Currently I am poking around in the sources for unyaffs2 to see if I can add any logging to figure out where the problem is.
Regards,
Rogan
On Wed, 5 Aug 2020 at 14:27, Tomcsanyi, Domonkos domi@tomcsanyi.net wrote:
Hi Roman,
I am pretty sure I used this project, especially unyaffs2 to extract the image. I think I have not used binwalk.
https://github.com/justsoso8/yaffs2utils
I hope this helps.
Cheers, Domi
- aug. 5. dátummal, 12:48 időpontban Rogan Dawes rogan@dawes.za.net
írta:
Hi Domi,
I got back to this after some time, and tried to extract the firmware to see which modules were precompiled. However, binwalk was unable to extract the yaffs filesystem.
I was able to get to _DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image/, and in there I found:
-rw-r--r--. 1 rogan rogan 360 Oct 13 2017 tz_combined_hash.mbn -rw-r--r--. 1 rogan rogan 548 Dec 4 2014 partition.mbn -rw-r--r--. 1 rogan rogan 7840 Apr 20 2015 sdi.mbn -rw-r--r--. 1 rogan rogan 25088 Feb 15 2017 NV需求一览表_NEW.xls -rw-r--r--. 1 rogan rogan 79196 Feb 15 2016 ENPRG9x25.mbn -rw-r--r--. 1 rogan rogan 82912 Feb 15 2016 NPRG9x25.mbn -rw-r--r--. 1 rogan rogan 92764 Nov 14 2018 appsboot.mbn -rw-r--r--. 1 rogan rogan 146180 Oct 13 2017 rpm.mbn -rw-r--r--. 1 rogan rogan 262144 Feb 15 2016 sbl1.mbn -rw-r--r--. 1 rogan rogan 267168 Oct 13 2017 tzbsp_no_xpu.mbn -rw-r--r--. 1 rogan rogan 275360 Oct 13 2017 tz.mbn -rw-r--r--. 1 rogan rogan 299920 Jun 28 2018 mba.mbn -rw-r--r--. 1 rogan rogan 569344 Feb 24 2017 efs.mbn -rw-r--r--. 1 rogan rogan 3850240 Nov 14 2018 mdm-perf-image-boot-mdm9625-perf.img -rw-r--r--. 1 rogan rogan 14012416 Nov 9 2019 cdrom.iso -rw-r--r--. 1 rogan rogan 14454528 Nov 9 2019 cdrom.img -rw-r--r--. 1 rogan rogan 20116800 Nov 14 2018 msm-mdm-perf-image-eglibc-ipk--mdm9625-perf.rootfs.yaffs2 -rw-r--r--. 1 rogan rogan 38922048 Nov 14 2018 mdm9625-perf-usr-image.usrfs.yaffs2 -rw-r--r--. 1 rogan rogan 41711456 Jun 28 2018 qdsp6sw.mbn
I then tried to extract the two yaffs2 files, but all that happened was I got a new subdirectory with a .gz file, and the original .yaffs2 file again (under a different name, but with the same sha1sum)! I DID get a long list of files that had been detected inside the archive, at least!
rogan@nemesis:~/Downloads/DWM-222/_DTLW1_D610A_04A0_0600_V1.0.1.1_191109_Release(2.1.2EU).exe.extracted/img/image$ binwalk -e -z mdm9625-perf-usr-image.usrfs.yaffs2
DECIMAL HEXADECIMAL DESCRIPTION
0 0x0 YAFFS filesystem, little endian 8448 0x2100 ELF, 32-bit LSB executable, ARM, version 1 (SYSV) 33875 0x8453 Copyright string: "Copyright (c) 2009-2011,2013 Qualcomm Technologies, Inc. All Rights Reserved." 35209 0x8989 Unix path: /sys/kernel/debug" 37867 0x93EB Unix path: /sys/devices/system/soc/soc0/build_id ]; then 37931 0x942B Unix path: /sys/devices/system/s 38170 0x951A Unix path: /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'` 42321 0xA551 Copyright string: "Copyright (c) 2009-2011 Qualcomm Technologies, Inc." 52800 0xCE40 Executable script, shebang: "/bin/sh --" 59219 0xE753 Copyright string: "Copyright (c) 2009-2011,2013 Qualcomm Technologies, Inc. All Rights Reserved." 60553 0xEC89 Unix path: /sys/kernel/debug" 63211 0xF6EB Unix path: /sys/devices/system/soc/soc0/build_id ]; then 63275 0xF72B Unix path: /sys/devices/system/s 63514 0xF81A Unix path: /sys/devices/system/soc/soc0/build_id | sed -e 's/^76XXT-.*//'` 69095 0x10DE7 Unix path: /sys/devices/system/cpu/cpuX/online 71808 0x11880 Executable script, shebang: "/bin/sh --" 76113 0x12951 Copyright string: "Copyright (c) 2011,2013 Qualcomm Technologies, Inc. All Rights Reserved." 80337 0x139D1 Copyright string: "Copyright (c) 2011-2012 Qualcomm Technologies, Inc." 80579 0x13AC3 Unix path: /sys/devices/system/cpu" 80618 0x13AEA Unix path: /sys/module/pm_8x60/" 81302 0x13D96 Unix path: /sys/devices/system/cpu/offline` 81533 0x13E7D Unix path: /sys/devices/system/cpu/offline" 81653 0x13EF5 Unix path: /sys/devices/system/cpu/offline" 95040 0x17340 Executable script, shebang: "/bin/sh" 95081 0x17369 Unix path: /sys/devices/system/clocksource/clocksource0/ ...
Any suggestions?
Thanks!
Rogan
On Tue, 30 Oct 2018 at 14:56, Rogan Dawes rogan@dawes.za.net wrote:
I just found this, which seems to be referring to some of the same applications related to the DWM-222.
Apparently, if you run dl.exe in a folder on its own, without any firmware available, it should put the device into adb mode. Not sure of you tried that, or if this is what you were referring to with "DLink disabled ADB" ...
Rogan
On Tue, Oct 30, 2018 at 12:27 PM Rogan Dawes rogan@dawes.za.net wrote:
Hi Domi,
Actually, you are correct, my shields do look like they are "press fit" onto a cage. I'm hoping that I can find a UART on the test points, though, before I start pulling the shields off.
I did some initial probing with the scope, and only found constant 1v8 on some, and constant ground on others. Nothing that suggested UART activity, unfortunately. That said, I was not "rebooting" between each point, so the device may have settled down by the time I tested the TX pin!
I'll be grabbing a foot switch, so I can reset the modem while probing each point, hopefully that will give better results!
I'm happy to try your firmware, to see if I can get ADB working. How would I check if it can be accessed/enabled? As mentioned, I only get the 5 ttyUSB devices (and get no response to an AT command on any of them!)
My end goal, though, is to have a completely standalone Linux computer, accessible from the Internet, that can present a variety of different USB gadget profiles to its host. So, while ADB would assist in probing the capabilities of the built-in firmware, it would be superfluous in the long run.
Rogan
On Tue, Oct 30, 2018 at 11:25 AM Tomcsányi Domonkos domi@tomcsanyi.net
wrote:
Hello Rogan,
I'm the author of the Wiki page about the stick. https://osmocom.org/projects/quectel-modems/wiki/D-Link_DWM-222_stick I am really glad to see some interest in the device.
Do you have ADB access, or that has already been disabled? You could try to flash a new firmware on the device, using the
provided flasher application (Windows only). Would you be open to run the firmware updater tool with my modified rootfs, that would enable ADB for the stick?
I think the A1 firmware is compatible, but I cannot say for sure. All
I know is that my stick's LED doesn't properly do status indication since I run the upgrade, but otherwise it functions as a modem.
I'd be happy to co-operate on this project, because I think it is
quite interesting.
About the shields: as it could be seen on the pictures I just lifted
the metal with a screewdriver to reveal the chips. The A2 has those maybe soldered on?
Also I just noticed D-Link has released 2 new firmwares since I last
checked. I will see if I can somehow update my dongle from the current semi-broken state.
Cheers, Domi
- okt. 30. dátummal, 9:43 időpontban Rogan Dawes <
rogan@dawes.za.net> írta:
Hi folks,
I have purchased a DLink DWM-222 with the intention of exploring the Linux OS running inside it, and if possible, compiling some additional USB gadgets to use with it.
FWIW, the USB ID's are 2001:ac01 before modeswitch, and 2001:7e3d after switching.
It creates ttyUSB[0-4] when switched, and the VID:PID added to the option driver.
I was wondering if there had been any further developments in the exploration of the A1 hardware or firmware, in terms of gaining a shell on the device at all without soldering?
Some initial probing has shown some 1.8v signals on some of the test points, so I will check those with a scope while booting to see if I can identify some waveforms, hopefully indicating a UART. I do have a FTDI UART with a voltage reference, so I am fairly confident that I can access those signals without damaging the device once identified.
Unfortunately, the updated hardware has complete shields over the interesting bits, so I cannot identify chips, etc. I have also not been able to find firmware for the A2, the only firmware I could find was at ftp://ftp.d-link.co.za/DWM/dwm222/Firmware/, marked as A1.
I'll
check to see if they are compatible. And of course, will be copying the driver software from the embedded CDROM.
Regards,
Rogan _______________________________________________ qc-linux-modems mailing list qc-linux-modems@lists.osmocom.org https://lists.osmocom.org/mailman/listinfo/qc-linux-modems
qc-linux-modems@lists.osmocom.org
-
Rogan Dawes -
Tomcsanyi, Domonkos -
Tomcsányi Domonkos