unable to configure Ambit 250, blank hyperterminal

[vurt]

unable to configure Ambit 250, blank hyperterminal.

Thought I'd give as much info as possible to help with diagnosis, any help greatly

appreciated.


When powered up the modem lights all lights
then only POWER and ENET are on with a rapidly flashing SEND light
Then a constant POWER + ENET with flashing SYNC

I am trying to connect to the modem with a max 232 board bought from ebay

I have connected the max232 cable to the pin header on the ambit 250 circuit board (four

pins closest to the blue ethernet port) and directly into the com port on my pc.

The max232 has a green led which lights when connected to the modem so I assume the

connection is right (I have also tried reversing the cable, no led)

When I try to connect with hyperterminal using :
Bits per second: 115200
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None

I get a blank hyperterminal display, no text at all, completley blank. I try powering up the

modem several times and pressing p even though the hyperterminal display shows nothing. I

get no response in Hyperterminal.


I've attempted to re-flash the ambit 250 using the E08C007 Console Unlocker Exploit (PM me

your email address and I'll send it to you if you want)
but I get "Error dropping the exploit. Please reset the device and re-run this application"
I notice the exploit says "compatible with software version 2.94.1094 only" from below I

notice my modem is Software Version : 2.94.1014 so this exploit may not work for me.

I can communicate with the modem by browsing to 192 . 168 . 100 . 1 / CmNavigation . asp
Cat 5 ethernet lead attached using NIC settings of :
IP:192.168.100.10
Subn t:255.255.255.0
Gat way:192.168.100.1

from there I got the follwoing info :

Cable Modem Information
Cable Modem : DOCSIS 1.0/1.1/2.0 Compliant
MAC Address : 00:0e:9b:**:**:** (hid part of mac address)
Serial Number : 000E9B****** (hid part of mac address)
Boot Code Version : 3.1.6d
Software Version : 2.94.1014
Hardware Version : 1.19


Cable Modem Status
Item Status Comments
Acquire a Downstream Channel 194000000 Hz In Progress
Connectivity State In Progress Not Synchronized
Boot State In Progress Unknown

Cable Modem Downstream
Downstream Lock : Not Locked
Downstream Channel Id : 0
Downstream Frequency : 290750000 Hz
Downstream Modulation : unknown
Downstream Symbol Rate : Unknown
Downstream Interleave Depth : taps32Increment4
Downstream Receive Power Level : -22.9 dBmV
Downstream SNR : 48.5 dB


Cable Modem Upstream
Upstream Lock : Not Locked
Upstream Channel ID : 0
Upstream Frequency : 0 Hz
Upstream Modulation : QPSK
Upstream Symbol Rate : 0 Ksym/sec
Upstream transmit Power Level : 8.3 dBmV
Upstream Mini-Slot Size : 0


Cable Modem Upstream Burst


Modulation Type
Differential Encoding
Preamble Length
Preamble Value Offset
FEC Error Correction (T)
FEC Codeword Information Bytes (k)
Scrambler Seed
Maximum Burst Size
Guard Time Size
Last Codeword Length
Scrambler on/off


Cable Modem Operation Configuration
Network Access : Denied
Maximum Downstream Data Rate : 0
Maximum Upstream Data Rate : 0
Maximum Upstream Channel Burst : 0
Maximum Number of CPEs : -1
Modem Capability : Concatenation Enabled, Fragametation Enabled, PHS Enabled

[G77]

try swapping the pin header around the other way

[DjAaron]

Hello r u sure u have it in the rite com port or is the max 232 in the rite way

[shaka]

I have exact same problem to the description provided by vurt. does anybody have any ideas? i think either max232 faulty circuit or windows is a cracked version and doesnt accept the two windows programs with ocd files.

Any help appreciated, been tryin several days. driving me crazy. hehe

[vurt]

Hi all,

I Must not have my notifications set, I thought nobody answered my question.

I sent the max232 back to be tested and it worked ok so max is good.

I found out the pinouts of the five pins on an ambit 250 starting from the blue ethernet port are :
GND
TXD
3.3V
RXD
GND

My max232 cable is
GND
RXD
3.3V
TXD

So when I connected to the 4 pins closest the blue ethernet port my RXD and TXD were crossed over, blank hyperterminal.

If I connected the max232 to the 4 pins closest to the broadcom chip, my RXD and TXD are in the right order and lo and behold I got bootup in hyperterminal.


Now I can see the modem boot via com1 but my 250 is Boot Code Version : 3.1.6d so no option P.
To get by this you either remove and reflash the tsop or use the console unlocker recently released by water.

Using the Console Unlocker v1.1b.exe exploit I was able to trick the modem into accepting a connection to re-write the bootloader to 2.16d

the readme for Console Unlocker v1.1b.exe says :
3. Power on the modem and wait for it to startup (10 secs)
4. Open the exploit application and hit “Execute Exploit”
5. If it says its successful, then the console is now ready to accept connections!
If it fails, power cycle the modem and try the application again.

At this point, if you want to restore your bootloader to the original 2.1.6d that has the re-flashing menu etc, you need a copy of SoftJTAG and the 2.1.6d bootloader.

** BE CAREFUL WHEN USING SOFTJTAG - As you can brick your modem if your not careful **

1. Open SoftJTAG, and connect via your serial port.
2. On the right hand side, click on “Write Bootloader” and select the 2.1.6d bootloader file
3. Wait till its done (this takes 10 – 15 minutes). Once it’s done, close SoftJTAG
4. Start HyperTerminal/TeraTerm and connect to your serial port
5. Reset the modem

When I got as far as click on "write Bootloader" it prompts for a memory address, just ok this. when I choose the 2.16d bootloader file SoftJTAG would erase the bootloader area on the modem OK then crap out with the error
"System.IO.IOException: The I/O operation has been aborted because of either a thread exit or an application request."

This left me with a modem with no bootloader section which I dare not turn off or it won't boot again.

After trying several attempts at running SoftJTAG (I was able to connect to modem each time) to re-write the bootloader and always failing with the same error I left the modem switched ON with max232 and ethernet still attached and re-booted my PC, after re-booting SoftJTAG worked and I was able to re-write the bootloader (it counts up in bytes to show its loading) then I was able to load and configure infinite. Modem now works fine on the net.

To avoid the SoftJTAG crashing problem I'd advise Re-booting the PC after running the unlocker (bootloader will still be intact) and before you run SoftJTAG. SoftJTAG should then work fine.



If anybody finds this useful drop me a thanks as I'd like to beef up my profile a bit. I've been mostly reading other peoples posts so far.

Cheers
Vurt

[G77]

sounds a good trick.