Driver canon pixma ip1880 window 7, Lease termination format india, Gangstar rio city of saints for windows xp, Epson stylus c41sx windows 7 driver, Ios 7 beta 6 legal ipsw iphone 5, Kalavar king telugu movie mp3 songs, Riff for ubuntu 13.04, Diablo 2 lod able items, Cults static zip, I am the bread of life

Netgear D6000 Notes

System specifications at https://wikidevi.com/wiki/Netgear_D6000

CPU / Ethernet : RT63368F
Ethernet Switch : MT7530BU

Open the top lid just by prising it apart. There are no screws, just clips around all 4 edges.
There is a serial interface header at the front center of the board, with 4 pins. Working from the front to the back, GND, TX, RX, VCC

Connect a 3v3 UART interface to the board. Just GND, TX and RX is necessary. Power up the device, and you should be presented with the console. If you let it boot, it will eventually lead you to a console login prompt, and your regular ‘admin / password’ defaults will work here.

Immediately after boot, you should be presented with a prompt ‘Press any key in 3 secs to enter boot command mode.’ If you do this, it will drop you to the bootloader.
Entering ‘ipaddr 192.168.10.1’ will set the IP address. ‘httpd’ will then start a minimal web server. If you then browse to http://192.168.10.1/ you will be presented with a firmware upload interface.

When trying to upload a non-Netgear file, it’s highly likely the following output is observed.

bldr> START TO RECEIVE the FILE
………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………………..
START TO CLOSE the FILE
Received file:
rcvdata_size = 3408046
start = 0x8002035D
Invalid filename, upload failed

Valid filename: Bootloader : tcboot.bin
Linux Kernel: tclinux.bin

Fail to upload firmware!

Is this TrendChip firmware?
https://github.com/vasvir/tcrevenge
Reverse Engineering TrendChip Firmware (ZTE-H108NS).
binwalk output…

D6000-V1.0.0.25_1.0.1.bin

DECIMAL HEXADECIMAL DESCRIPTION
——————————————————————————–
256 0x100 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4209760 bytes
1390681 0x153859 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 8094026 bytes, 1729 inodes, blocksize: 131072 bytes, created: 2014-11-07 06:46:52

D6000-V1.0.0.41_1.0.1.bin

DECIMAL HEXADECIMAL DESCRIPTION
——————————————————————————–
256 0x100 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4300896 bytes
1418962 0x15A6D2 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 8252568 bytes, 1762 inodes, blocksize: 131072 bytes, created: 2015-01-24 10:52:26

D6000-V1.0.0.47_1.0.1.bin

DECIMAL HEXADECIMAL DESCRIPTION
——————————————————————————–
256 0x100 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4300896 bytes
1419988 0x15AAD4 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 8810282 bytes, 1780 inodes, blocksize: 131072 bytes, created: 2015-03-22 08:36:00

D6000-V1.0.0.61_1.0.1.bin

DECIMAL HEXADECIMAL DESCRIPTION
——————————————————————————–
256 0x100 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 4300864 bytes
1418358 0x15A476 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 13357411 bytes, 1819 inodes, blocksize: 131072 bytes, created: 2016-08-17 07:23:16

Uploading D6000-V1.0.0.61_1.0.1.bin gives this amongst the output:

Received file:
rcvdata_size = 14775769
start = 0x8002033E
Real crc code: DDD6866
Check data success, prepare to upload

erase addr=20000 size=10000

tcrevenge -c D6000-V1.0.0.61_1.0.1.bin gives the following output:

Manual check (binwalk): header size must be 256 (0x0100)
Magic number: 0x32524448 found 0x32524448 …ok
Magic device: 0x00000100 found 0x00000100 …ok
tclinux.bin size: 14775769 found 14775769 …ok
tclinux.bin chekcsum: 0x0DDD6866 found 0x0DDD6866 …ok
Manual check Firmware version: 7.0.1.0 found VERSION:V1.0.0.61_1.0.1. If they differ use -v to adjust.
Manual check (binwalk): squashfs offset must be at 0x0015A476
Manual check (mtd partition dump): squashfs size (padded to erase_size at 4K (0x1000)) must be at 13357411 (0x00CBD163)
Manual check (all tests have been done with model 3) Model: 3 6035 122 74 found MODELNAME:D6000. If they differ use -m to adjust.

Since the checksums match, I suspect it is indeed TrendChip firmware.

Flash filesystem layout

# cat /proc/mtd
dev: size erasesize name
mtd0: 00010000 00010000 “bootloader”
mtd1: 00010000 00010000 “romfile”
mtd2: 0015a476 00010000 “kernel”
mtd3: 00cc0000 00010000 “rootfs”
mtd4: 00ea0000 00010000 “tclinux”
mtd5: 00040000 00010000 “reservearea”
mtd6: 00020000 00010000 “language_1”
mtd7: 00020000 00010000 “language_2”
mtd8: 00020000 00010000 “language_3”
mtd9: 00020000 00010000 “language_4”
mtd10: 00020000 00010000 “language_5”
mtd11: 00020000 00010000 “language_6”
mtd12: 00010000 00010000 “traffic_meter”
mtd13: 00010000 00010000 “POT”
mtd14: 00010000 00010000 “pppoe”
mtd15: 00010000 00010000 “board_data”

Leave a Reply

Your email address will not be published. Required fields are marked *