HUAWEI CPE BM635

All about firmwares for routers. Support for RouterTech firmwares is here too.
Bahram
Novice
Novice
Posts: 17
Joined: Mon Nov 24, 2008 7:29 pm

HUAWEI CPE BM635

Post by Bahram » Mon Jan 02, 2012 6:48 pm

Hi

First of all, im really glad to back again to this forum. it resolves my problem some years ago with my ASUS ADSL modem.

And now, i have a problem with my WIMAX modem.

Model: Huawei EchoLife BM635

The problem is: i change the MAC address of this modem via telnet with no problems so many times but one day, after change the MAC address and reset the modem, the WAN mac address didn't change and it became to blank!!!

When i was login to control panel of modem (192.168.1.1), the WAN MAC address was blank but the another mac address such LAN or WLAN has mac address.

I try to hard reset but still blank MAC address!

I try to flash the firmware but the problem is its very hard to find the firmware. The only firmware that i find is provided by my ISP but it didn't worked. Its began to flash but in 47% its stop and failed!

Here is the link of firmware:

http://wimax.irancell.ir/Webfiles/Files ... nstall.exe

Is there any solution to resolve this problem?

tnx
Bahram
Novice
Novice
Posts: 17
Joined: Mon Nov 24, 2008 7:29 pm

Re: HUAWEI CPE BM635

Post by Bahram » Wed Jan 04, 2012 10:53 am

ok i think nobody know the solution

I change my question:

Is there any way to extract the firmware from another router and flash it to my router?
User avatar
thechief
RouterTech Team
RouterTech Team
Posts: 12067
Joined: Wed Feb 01, 2006 10:22 pm
Location: England, the Centre of Africa
Contact:

Re: HUAWEI CPE BM635

Post by thechief » Thu Jan 05, 2012 12:43 am

We are not familiar with this router. However, it seems to me that your problem is how to get any firmware successfully on the router, rather than how to find a good firmware (one would assume that your ISP's firmware is good). My advice is to search for repair tools for the router's chipset. A quick search on Google revealed nothing useful, so I suspect that you will have your work cut out to restore this router.
The Chief: :afro: Be sure to read the Firmware FAQ and do a Forum Search before posting!
No support via PM. Ask all questions on the open forum.
Bahram
Novice
Novice
Posts: 17
Joined: Mon Nov 24, 2008 7:29 pm

Re: HUAWEI CPE BM635

Post by Bahram » Thu Jan 05, 2012 1:22 am

Well sounds bad but i want to take my last chance

Can you tell me how is the routin process to extract the firmware from any router? Is it possible or not?

With my search i found, it could be get files from /var/mtdblock(s) via tftp. is it true?

Unfortunately, my ISP doesnt support this router any more and that firmware from my ISP didn't work correctly.
User avatar
thechief
RouterTech Team
RouterTech Team
Posts: 12067
Joined: Wed Feb 01, 2006 10:22 pm
Location: England, the Centre of Africa
Contact:

Re: HUAWEI CPE BM635

Post by thechief » Thu Jan 05, 2012 11:44 am

Bahram wrote:Well sounds bad but i want to take my last chance

Can you tell me how is the routin process to extract the firmware from any router? Is it possible or not
It depends on whether (and how) you can access your router, and how its flash memory is configured. If you can access the router via telnet and the flash memory is configured similarly to the AR7 routers, then the instructions here: viewtopic.php?f=16&t=4512&start=2 will do the job. From what you describe, I doubt that the router is accessible at all - but only you can tell that.
Bahram wrote:Unfortunately, my ISP doesnt support this router any more and that firmware from my ISP didn't work correctly.
What you describe as it not working correctly is simply a description of a failed upgrade. The firmware might be perfectly fine, but it is not possible to upgrade because the required facilities (e.g., full bootloader access or filesystem access) are not there. I suspect that this is what the problem is. If you get low level tools that can access the bootloader directly (or you can use JTAG), you should be able to flash a firmware successfully.
The Chief: :afro: Be sure to read the Firmware FAQ and do a Forum Search before posting!
No support via PM. Ask all questions on the open forum.
Bahram
Novice
Novice
Posts: 17
Joined: Mon Nov 24, 2008 7:29 pm

Re: HUAWEI CPE BM635

Post by Bahram » Thu Jan 05, 2012 4:55 pm

Yes i could access all features of my router and also i can used it like a access point! just the wimax didn't work...

but i think, i just brick it now!

I got mtdblocks from another router that extacly the same model as mine but after uploaded to my router and reset, the router seems had a serious problem. One of the singal bar began to flash and i cant access it anymore via telnet or anything else.

Well i think the problem is about the method of puting the mtdblocks, i used tftp!!! All mtdblocks uploaded successfully except mtdblock3 that i think its a main file!!!

I searched a lot this forum but i didn't find the topic you said. I feel more bad luck now...

but i dont give up... I will try again and test another solutions.

if you have any suggestions to me i will be appreciate

tnx
User avatar
thechief
RouterTech Team
RouterTech Team
Posts: 12067
Joined: Wed Feb 01, 2006 10:22 pm
Location: England, the Centre of Africa
Contact:

Re: HUAWEI CPE BM635

Post by thechief » Thu Jan 05, 2012 6:53 pm

Sorry to hear that - but without any knowledge of the specific router or its bootloader or system layout, I can't be more helpful, except to suggest that you might want to investigate whether it has any serial or JTAG interface. A serial console will let you see what exactly is going on, and JTAG would let you upgrade the firmware (via a very lengthy process, since JTAG transfers are typically tediously slow).
The Chief: :afro: Be sure to read the Firmware FAQ and do a Forum Search before posting!
No support via PM. Ask all questions on the open forum.
Bahram
Novice
Novice
Posts: 17
Joined: Mon Nov 24, 2008 7:29 pm

Re: HUAWEI CPE BM635

Post by Bahram » Fri Jan 06, 2012 12:53 pm

tnx thechief

can you show me the topics about JTAG and the Serial port? (if exists)

I have found the serial pin on the router board but dont know anything about JTAG and using serial port
User avatar
thechief
RouterTech Team
RouterTech Team
Posts: 12067
Joined: Wed Feb 01, 2006 10:22 pm
Location: England, the Centre of Africa
Contact:

Re: HUAWEI CPE BM635

Post by thechief » Fri Jan 06, 2012 1:26 pm

Run a forum search for "JTAG" and "serial console".

You need to note that these things can differ, depending on the device. The only ones you will find here are for AR7 routers - and even then, the pins (serial) are different for different manufacturers.
The Chief: :afro: Be sure to read the Firmware FAQ and do a Forum Search before posting!
No support via PM. Ask all questions on the open forum.
Bahram
Novice
Novice
Posts: 17
Joined: Mon Nov 24, 2008 7:29 pm

Re: HUAWEI CPE BM635

Post by Bahram » Fri Jan 06, 2012 4:39 pm

how can I know my router is AR7 or not?
User avatar
thechief
RouterTech Team
RouterTech Team
Posts: 12067
Joined: Wed Feb 01, 2006 10:22 pm
Location: England, the Centre of Africa
Contact:

Re: HUAWEI CPE BM635

Post by thechief » Fri Jan 06, 2012 10:24 pm

I can almost guarantee that it isn't.
The Chief: :afro: Be sure to read the Firmware FAQ and do a Forum Search before posting!
No support via PM. Ask all questions on the open forum.
Bahram
Novice
Novice
Posts: 17
Joined: Mon Nov 24, 2008 7:29 pm

Re: HUAWEI CPE BM635

Post by Bahram » Tue Jan 10, 2012 1:56 pm

Hi again

I made the TTL to RS232 converter to connect my router to the pc and here is the log:

Code: Select all


ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X

ROM VER: 1.0.3
CFG 01
Read EEPROMX
 X
enter bootstrap_board_init_f
jump to bootstrap_relocate_code
addr_sp = 0x81fabf98
 id = 0x81fcbfb0
 addr = 0x81ffc000
 bootstrap_board_init_r
start lzma_inflate
jump to start.s to run uboot  addr = 0xa0400000
board_init_f
DRAM:  32 MB

 relocate code finish.
Now running in RAM - U-Boot at: 81fd8000

 type is 00000001
 type is 0000227e
 info->flash_id 00000000  0000227e
 info->flash_id 000000b4Flash:  8 MB
In:    serial
Out:   serial
Err:   serial
Net:  address:64:16:F0:6E:E5:43danube Switch

befor main_loop!

Type "run flash_nfs" to mount root filesystem over NFS

Hit any key to stop autoboot:  0
## Booting image at b0020000 ...
addr is =: 0xb0020000
   Image Name:   MIPS Linux-2.6.20
   Created:      2009-12-26   8:32:48 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    858694 Bytes = 838.6 kB
   Load Address: 80002000
   Entry Point:  80283000
   Verifying Checksum ... OK
   Verifying rootfs Checksum ...
the mid is :49
the mid is :24
the mid is :11
the mid is :5
the mid is :2
the mid is :0
is old rootfs

enter multi
enter multi_main_start

   kernel is good ,you not need repair the kernel!

   rootfs_file is bad ,you need repair the rootfs!

   NOTICE: have entery the repair waite state ,you can do 1 or 2 !!!

   1:press <<Ctrl  +C>>  exit the  repair waite state!!!

   2:sent to the repair package and repair the kernel and rootfs!

Abort

repaire complete
DANUBE # 
these are the availabe commands:

Code: Select all

askenv  - get environment variables from stdin
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mulupgrade     - mulupgrade commands in an environment variable
mw      - memory write (fill)
nm      - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
tftpboot- boot image via network using TFTP protocol
upgrade - forward/backward copy memory to pre-defined flash location
version - print monitor version


and this is the info that printenv command give to me:

Code: Select all

bootcmd=run flash_flash
bootdelay=1
baudrate=115200
preboot=echo;echo Type "run flash_nfs" to mount root filesystem over NFS;echo
mem=30M
ethaddr=00:E0:92:00:01:40
netdev=eth0
baudrate=115200
loadaddr=0x80800000
rootpath=/tftpboot/nfsrootfs
nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):on
addmisc=setenv bootargs $(bootargs) console=ttyS1,$(baudrate) ethaddr=$(ethaddr) mem=$(mem)
flash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)
ramdisk_addr=B0100000
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
bootfile=uImage
net_nfs=tftp $(loadaddr) $(bootfile);run nfsargs addip addmisc;bootm
net_flash=tftp $(loadaddr) $(bootfile); run flashargs addip addmisc; bootm
u-boot=u-boot.ifx
flash-image=image
jffs2fs=jffs2.img
rootfs=rootfs.img
art_data=art.data
flashimage=HGW.BIN
flash_rootfs_addr=0xB0000000
firmware=firmware.img
load=tftp $(loadaddr) $(u-boot)
update=protect off 1:0-2;era 1:0-2;cp.b $(loadaddr) B0000000 $(filesize)
flashargs=setenv bootargs root=/dev/mtdblock2 ro rootfstype=squashfs
mtdargs=setenv bootargs root=/dev/mtdblock2 rw rootfstype=jffs2
flash_flash=run flashargs addip addmisc; bootm $(f_kernel_addr)
net_mtd=tftp $(loadaddr) $(bootfile); run mtdargs addip addmisc; bootm
flash_mtd=run mtdargs addip addmisc; bootm $(f_kernel_addr)
update_image=tftpboot $(loadaddr) $(flash-image);upgrade image $(loadaddr) $(filesize) 0
update_uboot=tftpboot $(loadaddr) $(u-boot);upgrade uboot $(loadaddr) $(filesize) 0
update_kernel=tftpboot $(loadaddr) $(bootfile);upgrade kernel $(loadaddr) $(filesize) 0
update_rootfs=tftpboot $(loadaddr) $(rootfs); erase 0xB0120000 0xB075FFFF 1;cp.b $(loadaddr) $(f_rootfs_addr) $(filesize)
update_flash=tftpboot $(loadaddr) $(flashimage); erase 0xB0000000 0xB07FFFFF 1;cp.b $(loadaddr) $(flash_rootfs_addr) $(filesize)
update_art=tftpboot $(loadaddr) $(art_data); erase 0xB07E0000 0xB07EFFFF 1;cp.b $(loadaddr) 0xB07E1000 $(filesize)
update_rootfs_1=tftpboot $(loadaddr) $(rootfs); erase 1:47-132; cp.b $(loadaddr) $(f_rootfs_addr) $(filesize)
update_jffs2=tftpboot $(loadaddr) $(rootfs); upgrade rootfs $(loadaddr) $(filesize) 0
update_jffs2_1=tftpboot $(loadaddr) $(jffs2fs); erase 1:47-132; cp.b $(loadaddr) $(f_rootfs_addr) $(filesize)
update_firmware=tftpboot $(loadaddr) $(firmware);upgrade firmware $(loadaddr) $(filesize) 0
reset_uboot_config=erase 0xB07F0000 0xB07FFFFF
part0_begin=0xB0000000
part1_begin=0xB0020000
part2_begin=0xB0120000
part3_begin=0xB0760000
part4_begin=0xB07E0000
part5_begin=0xB07F0000
total_part=6
flash_end=0xB07FFFFF
data_block0=uboot
data_block1=kernel
data_block2=rootfs
data_block3=protect
data_block4=calibration
data_block5=ubootconfig
total_db=6
f_uboot_addr=0xB0000000
f_uboot_size=0x20000
f_ubootconfig_addr=0xB07F0000
f_ubootconfig_size=0x10000
f_ubootconfig_end=0xB07FFFFF
f_kernel_addr=0xB0020000
f_kernel_size=0x100000
f_kernel_end=0xB011FFFF
f_rootfs_addr=0xB0120000
f_rootfs_size=0x640000
f_rootfs_end=0xB075FFFF
f_protect_addr=0xB0760000
f_protect_size=0x80000
f_protect_end=0xB07DFFFF
f_calibration_addr=0xB07E0000
f_calibration_size=0x10000
ethact=danube Switch
filesize=640000
fileaddr=B0120000
ipaddr=192.168.1.1
serverip=192.168.1.10
stdin=serial
stdout=serial
stderr=serial
bootargs=root=/dev/mtdblock2 ro rootfstype=squashfs ip=192.168.1.1:192.168.1.10::::eth0:on console=ttyS1,115200 ethaddr=00:E0:92:00:01:40 mem=30M

Environment size: 3529/65532 bytes

I'de try to write mtdblocks via tftp and it seems worked but after reset nothing changed!

can you tell me if any chance to unbrick my router with this information?

tnx
User avatar
thechief
RouterTech Team
RouterTech Team
Posts: 12067
Joined: Wed Feb 01, 2006 10:22 pm
Location: England, the Centre of Africa
Contact:

Re: HUAWEI CPE BM635

Post by thechief » Tue Jan 10, 2012 3:22 pm

Bahram wrote:can you tell me if any chance to unbrick my router with this information?
tnx
It seems that it should be possible to upload a good filesystem image to fix the corrupted filesystem. However, there is no indication as to how you would do that. You might be able to do it via ftp/tftp if you have the correct image, and you know where to put the image. There are lots of file offsets given, and many commands in the environment. However, it is not clear what you need to do with that information.

Bottom line: as long as you do not overwrite the booloader in the process, there is no harm in trying various things. Without more detailed documentation, you can only do trial and error.
The Chief: :afro: Be sure to read the Firmware FAQ and do a Forum Search before posting!
No support via PM. Ask all questions on the open forum.
kalaghack
Newbie
Newbie
Posts: 1
Joined: Sat Mar 31, 2012 5:44 pm

Re: HUAWEI CPE BM635

Post by kalaghack » Sun Apr 01, 2012 7:41 am

Hi Bahram
I have the same issue with my modem.
Ive changed the mac address many times and now i cant
change it anymore and the BLANK WAN MAC just happened and
my WiMax signal is gone.

Did u find any way to fix this problem ????
mark007
Regular
Regular
Posts: 41
Joined: Wed Nov 21, 2007 11:20 pm

Re: HUAWEI CPE BM635

Post by mark007 » Sun Apr 01, 2012 5:04 pm

Post Reply