Please Help have things changed???

[ger1980]

Hi in the past I have flashed 4 ambit 250 modems succesfully no problems.

Yesterday I tried to flash my ex subbed modem with the usual 250hack_dump_telnet.bin and got this far..

NTL 250 - Guide to Hacking v2

I have made changes to this tut to make it more step by step.

My first tutorial seems to have been popular. Since then lots has change (we no longer need to use a SB51xx to generate the SA3 sector, telnet access) so here's a much updated guide:

To flash the firmware onto the Ambit250 you must use a MAX232 interface.

Open your modem and inside next to you blue ethernet jack is a set of 5 pins.


Connect your max to this jack and start from the pin nearest the blue ethernet jack.
Also make sure your max lead is connected to your serial lead.
Connect up the ethernet cable to the modem and your PC LAN card.

Make a new folder on your PC.
Copy the "250hack_dump_telnet.bin" into it.
Copy the file "tftpd32.exe" (this was posted along with the ambit200-sigma hack)
In Windows networking:


Ok now click on properties and you will see this window.



Click on use the following IP address: and enter these settings.
Set your IP address to: 192.168.100.10
Set your GateWay to: 192.168.100.1
Once done click ok and then minimise network conections.



Start tftpd32.exe

Browse to the dir where you put the 250 hack dump highlight it and click ok.
Then click on show dir.


Highlight the 250hack_dump_telnet.bin file and click ok.
Once that is done minimise tftpserver.

Now start hyperterminal and make a new connection.
Use the com port that your serial is connected to on your PC using these settings:
Bits per second: 115200
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None

Power the modem up.(without the cable feed in)


Code:
Enter '1', '2', or 'p' within 2 seconds or take default...

quickly Choose option P then enter your board IP address as shown below.


Code:

Board IP Address [0.0.0.0]: 192.168.100.1 (press enter)
Board IP Mask [255.255.255.0]: (leave blank press enter)
Board IP Gateway [0.0.0.0]: (leave blank press enter)
Board MAC Address [00:10:18:ff:ff:ff]: (leave blank press enter)
Internal/External phy? (i/e)[i] (leave blank press enter)

Now you should get the main menu...


Code:
Main Menu:
==========
d) Download and save to flash
g) Download and run from RAM
c) Store icePROM bootloader to flash
b) Boot from flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
r) Read memory
w) Write memory

Choose option D and enter the text as below


Code:
Board TFTP Server IP Address [0.0.0.0]: 192.168.100.10 (press enter)
Enter TFTP filename []: 250hack_dump_telnet.bin (press enter)

You should now see the following appear:


Code:
Free store: a0500000
Starting TFTP of 250hack_dump_telnet.bin from 192.168.100.10
Getting 250hack_dump_telnet.bin using octet mode
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ...............
Tftp complete
Received 2097152 bytes
HCS failed on Image 0 Program Header

Next you should get:


Code:
Image does not have standard header. Do you wish to store it? [n] Y (press enter)
Programming 2097152 bytes
Enter sector to start store: 0 (type 0 press enter)

The modem will now write the new firmware to the flash.


Code:
Store parameters to flash ? [n] (press enter)

Now you should get the main menu again.

The modem is now flashed and you can close your copy of HyperTerminal and disconnect your MAX232 lead. (Make sure you power off the modem before you remove your max lead)

CLOSE TFTP SERVER DOWN

Set the LAN card back to dynamic IP and Gateway buy going into network connections like before and minimize.

Now reboot the modem.(still no cable feed yet) Give it a minute to power up.


Now start a new copy of HyperTerminal, this time we change the port to TCP/IP (Winsock)
In the Host address box enter 192.168.100.1
Leave the port number as 23
Once running you should get this below:-

As you can see the modem should have been flashed ok. But when I go into Hyperterminal the modem will not talk to it. I can't even open the modem webpage. I think its dead.

Anyone know why this might have happened. I am going to be flashing some 255's later. What is the best firmware to flash these with or was the firmware I was using above the correct.

Thanks in advance