SIEMENS SE567 ROUTER

[nourequip]

Hi all,
i have a router siemens se567 which has the following chipset
tnetd7200zdw chip
K4S281632I-UC75 Samsung RAM
MX29LV320CTTC Flash
88E6060 LAN switch
which makes it very good RT subject
i will try to apply Routertec firmware on it once some things identified.
i connected to serial port and got some data my problem is i can't identify the boot loader on it so here is what i have so far.
logs through serial port:

logs.rar

(35.32 KiB) Downloaded 527 times

im only doing this so it would be some help for other ppl to do.
i have quit good electronic experience,some mikro C ,and done some mikrotik
linux novice and may be less.
this is the firmware captured after un compress the exe file in windows:


i don't have a problem making jtag.
if you can help to make this ok , if not i don't mind im only trying may be it would be help for others.
thank you
M.Ali

[thechief]

You will definitely need to change the bootloader to PSPboot in order get anything else onto the router. For this, you will need JTAG. Tread very carefully! And better backup the original bootloader (also via JTAG) before trying anything else.

The bootloader seems to be something called "BOST". See:
http://wiki.openwrt.org/doku.php?id=old ... mens:se567
http://opensimpad.org/index.php?title=B ... oldid=1745
http://opensimpad.org/index.php/Special:Unusedimages

PS: you should not post binary firmwares on the forum. It will be removed.

[nourequip]

PS: you should not post binary firmwares on the forum. It will be removed.

Sorry about that


i will read every thing and get back to you.
thank you
M.Ali

[nourequip]

hi all,
a sum of every thing i could get from the original firmware upgrade :
1- it is writing 3 files to the router
first is the image a compressed ,i think, linux operating system and the router software.
second is the bootloader
third is the configuration
2- i could re-create the image exactly identical to the image being sent using xvi hex editor and swiss file knife.
3- through serial port i was able to x-modem this to the router and load it to the flash.
my problem is the hyper terminal can only accept one file per one session of x-modem send.
what should happen is sending the three files in the sequence above in one session as if it was a one file
if i was able to do that i think i can send in the pspboot and the rt firmware some way.
----so i need some help here i need to know how to split the rt image.
----i need to know if there are dependecies of the firmware on the bootloader meaning does the firmware requst functions
from the bootloader or the bootloader just loades the firmware and set aside.
----the flash is originally a one rom block but the firmware is treating it as mtd blocks like if it was partitions(right or wrong)

the jtag ,may be, but need some software first to just do small testing not writing so i can try and find the correct pins
for jtag ,see pic, if it was ,which i think it must be, jtag.

does the 1350 share any part of the flash or no.

those are what i could find on the J7 pins.

waiting for further help.
thank you all
M.Ali

[nourequip]

I forget to give you my boot loader logs and wireshark firmware capture files
and also filemon log

M.Ali

[Edit: attachments removed by thechief]

[thechief]

1. J7 does not look like JTAG connectors to me. There would normally be many more than 6.
2. To split the firmware files, run the Firmware Tool.
3. The PSP/Adam2 bootloaders serve to load the kernel, and then drop out of the equation. Whether the kernel communicates with the bootloader thereafter is anyone's guess.
4. The firmware upgraders take a single image, and write different sections of it to different mtd partitions, as required.
5. I have removed the attachments that you posted above. They are neither necessary nor helpful in this situation.

[nourequip]

first thanks for quick reply.

will for the jtag only 4 wires are needed.
tck tdi tdo tmo

which makes the connector probable for jtag
the other pins 4 after removing vcc and ground are high impedence which makes it possible to be jtag inputs
and for the producer he has to put jtag to test the pcb and chips after assemply not for us to play around with.

what i meant about the bootloader is: if i could create and put an image with the pspboot and original firmware
would the original firmware request functions of the bootloader or no, it will crash due to bootloader change or no.
thanks

[thechief]

what i meant about the bootloader is: if i could create and put an image with the pspboot and original firmware
would the original firmware request functions of the bootloader or no, it will crash due to bootloader change or no.
thanks

I have no idea.