Changing Ambit 250/255 firmware using Linux(Ubuntu8.10)

[rhumor]

Hi there,
There doesn't seem to be a lot of info about Ambit modding using a linux box and it took me quite some time to gather all the info I needed to do this so I thought I would share my findings on here.
I use Ubuntu 8.10 (Intrepid Ibex). This may apply to 8.04 as well and maybe other linux distro's with some tweaking but can't guarantee this.
This is the first guide I have written and apologise in advance for any mistakes or inaccuracies.

1.Packages Used:

These are packages I use and work for me. Other packages may be available as alternatives and some other packages may be installed along with these for dependency.

1. xinetd (replacement for inetd and allows servers to be started when required so they are not constantly running on system)
2. tftpd-hpa (tftp daemon. This is the TFTP server I use)
3. minicom (Serial communication program, used for the same purpose as HyperTerminal in Windows.)

These can be installed using Synaptic Package Manager in Ubuntu or by using apt-get as root (e.g. sudo apt-get install xinetd)

2.Setting Up:

This is how my system is setup. I leave this permanently setup for convenience, I'm not sure if this is a security risk or not but I haven't run into any problems. Most of this information I have found from either the man files (e.g. man xinetd) or from the community at ubuntuforums.org.

The TFTP server has to be defined in xinetd before we can use it. To do this we first need to find out where our tftp server (which is called 'in.tftpd') is:

whereis in.tftpd

I get this output:

 in: /usr/sbin/in.tftpd

which tells me that the my tftp server is stored in /usr/sbin/in.tftpd (yours may be different).
Now we know where it is we'll create a tftp entry for xinetd to allow it to control this server. this file will be created in /etc/xinetd.d/ and we will need root privileges to do this. You can use gedit to create/edit this file by using the command:

gksu gedit /etc/xinetd.d/tftp

Although I prefer to use vim as it runs in the terminal

sudo vim /etc/xinted.d/tftp

The entry for this file should be as follows:

 service tftp
    {
    protocol        = udp
    port            = 69
    socket_type     = dgram
    wait            = yes
    user            = nobody
    server          = /usr/sbin/in.tftpd
    server_args     = /tftpboot
    disable         = no
    }

Note that server refers to the server that we found with the whereis command.
The server_args entry defines the folder that will be used to host our files. This may or may not exist yet. If it doesn't, create it using:

sudo mkdir /tftpboot

Now we can move our firmware files to this folder by using:

sudo cp /path/to/firmware/file /tftpboot

Be sure to use the firmware only and not a 2MB dump. As I've recently learned from Bad_Ad84, if there are any problems when flashing a 2MB dump this can lead to the modem being bricked as everything on the modem is being erased including the bootloader, and even if it does flash ok, the modems unique information will be overwritten. By flashing the firmware only the process is safer and means your modems data is retained. So to be clear Don't Use 2MB Dumps!

We will also have to change the permissions of these files as we stated in the tftp file that only the user nobody can use the tftp server:

sudo chown nobody /tftpboot/*

O.K. so we now have the tftp server ready to use and the files in the correct place with the correct permissions. We can restart xinetd to ensure these new settings are being used by entering:

sudo /etc/init.d/xinetd restart

Now it's time to setup minicom. To do this use the command:

 sudo minicom -s

Then select Serial Port Setup from the menu. I use serial port 1 on my computer which is /dev/ttyS0 in the filesystem. I think this should be the same for most setups. When changing the Bps/Par/Bits option (E), select e,l,v,w. This should change "Current:" to 115200 8N1. Heres how my settings look:

    +-----------------------------------------------------------------------+   
    | A -    Serial Device      : /dev/ttyS0                                |   
    | B - Lockfile Location     : /var/lock                                 |   
    | C -   Callin Program      :                                           |   
    | D -  Callout Program      :                                           |   
    | E -    Bps/Par/Bits       : 115200 8N1                                |   
    | F - Hardware Flow Control : No                                        |   
    | G - Software Flow Control : No                                        |   
    |                                                                       |   
    |    Change which setting?                                              |   
    +-----------------------------------------------------------------------+

If this is the only reason that you'll be using minicom then set these settings as default by selecting "Save setup as dfl" from the menu before selecting exit.

The last thing we have to do is to give the ethernet port (eth0 on my system, yours maybe different) an IP address on the same network as the modem. There are 2 ways to do this depending on wether you plan to flash one modem or lots.
To change the IP temperarily:

sudo ifconfig eth0 192.168.100.10

or to create a permanent alias (so we don't have to keep changing the IP) we can edit the /etc/network/interfaces file:

sudo vim /etc/network/interfaces

or again gedit can be used:

gksu gedit /etc/network/interfaces

and add the following stanza (Remember, if your ethernet interface isn't eth0 then amend this as necessary!)

# Modem
    auto eth0:modem
    iface eth0:modem inet static
    address 192.168.100.10
    netmask 255.255.255.0

N.B. If you use a firewall, such as firestarter then you will either have to add policies to allow connections from your modem (192.168.100.1) or stop the firewall before attempting to fetch the new firmware.

3.Changing the Firmware. *** I'm using haxorware11rev30.bin ***

Now we go ahead and open up the modem and connect our serial cable to the four pins closest to the ethernet connector (as shown in countless other tutorials), and plug in the ethernet cable. We can then start minicom (I like to use some switches to allow the use of meta keys and use colour but these aren't necessary):

minicom -M -c on

when it has started and ready to go you should see a blinking cursor. Now we have to plug in the power connector and quickly hit 'p' on the keyboard when prompted.
If this has been done correctly we should see:

Board IP Address[0.0.0.0]:

enter 192.168.100.1 here. continue to press enter leaving all other prompts blank.
If all is going well then we should see the main menu:

    Main Menu:
    ==========
      d) Download and save to flash
      g) Download and run from RAM
      c) Store icePROM bootloader to flash
      b) Boot from flash
      e) Erase flash sector
      m) Set mode
      s) Store bootloader parameters to flash
      i) Re-init ethernet
      r) Read memory
      w) Write memory

From here we select option 'd) Download and save to flash'.
When prompted:

Board TFTP Server IP Address[0.0.0.0]:

enter 192.168.100.10 (the IP we defined earlier)
and at next prompt:

Enter TFTP filename[]:

enter the name of the firmware file (e.g. haxorware11rev30.bin, the one we copied into the /tftpbootfolder)
We should now see some dots (......) across the screen to show that file is being transferred. If not and you see a timeout message, check you don't have a firewall running or that the policies are set correctly.
We should then see the prompt:

Destination image                                                               
  0 = bootloader                                                                
  1/2 = CM image                                                                
  3 = specify flash sector                                                      
(0-3)[2]:

Enter 1 here

Then we see this prompt:

Are you sure you want to store an uncompressed image? [n]

Enter Y here

The new firmware will now be written to flash and when this is done we see the prompt:

Store parameters to flash ? [n]

press enter to leave this as default (no).

Providing everything has gone to plan the modem should now be flashed and we should be back at the main menu. From here we can either select option b) Boot from flash, to boot the modem or pull out the power and plug it back in again.

From this point we should be able to access the webGUI and change settings as needed. There are tutorials that cover these settings so I won't cover them here (try searching the forum, or google).

4. In Closing

None of the information I have given here is my own. It is simply my interpretation of the countless forums and tutorials that I have read through during my research. Unfortunately I am unable to recall the names of the authors that have helped me, to give proper credit where it is due. If you feel that I am plagiarizing your original work or that I'm treading on anyones toes then please let me know and I will give proper credits or retract any offensive material. I would advise anyone who has any problems using Ubuntu to visit ubuntuforums.org where I have sourced much of my knowledge from. I hope this helps anyone in the same situation I was once in and if you have any problems following this tutorial or would like to make any suggestions on editing or give some constructive criticism, then please let me know and I will update accordingly.

[Bad_Ad84]

you should edit your post to not use 2mb dumps.

using 2mb dumps is bad, other than that, good stuff.

[rhumor]

Thanks for the reply Bad_Ad84, not sure what you're referring to though. Do you mean I should add this to my post or have I got something wrong.
I wasn't aware that using a 2MB dump was bad. Why is this?

Scratch that, just saw one of your other posts that says to flash haxorware firmware straight to modem. I take it that the 2MB dump is just a 'dump' from someone else's modem that's already been flashed and the firmware may have been modified. Is this correct?

[Bad_Ad84]

it overwrites everything unique about the modem, it also erases the bootloader.

if you screw it up, you have a brick.

if you just write firmware, if it messes up you can have another attempt.

thing of it this way:

Firmware only = changing your OS, you still keep all your documents etc.
2mb dump = imaging your whole hard drive onto another pc

[rhumor]

That makes sense. Thanks for that, I'll update my post.

[Bad_Ad84]

you need to edit the sector to store part.

when you send over a firmware only, it will pick it up the header and give you a menu of locations to flash it to, rather than unknown header and sector to store.

id suggest giving it a go on a spare modem so you can copy/paste the info.

you want the first firmware bank, which is option 1

[Danielle]

Excellent post nice to see someone post some linux tuts

[Bad_Ad84]

also, ill be linking to this from my tutorial thread once i get some free time to actually post them up.

[Bad_Ad84]

i lifted this from one of my other posts.

Starting TFTP of haxorware10rc6_DOCSIS.bin from 192.168.100.10
Getting haxorware10rc6_DOCSIS.bin using octet mode
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.................................................. ..............................
.......................
Tftp complete
Received 1031763 bytes
Image 0 Program Header:
Signature: 3349
Control: 0005
Major Rev: 0001
Minor Rev: 0000
Build Time: 2008/11/22 11:05:19 Z
File Length: 1031671 bytes
Load Address: 80010000
Filename: ecram_sto.bin
HCS: 0e42
CRC: d2aa5653

CRC Verified
Destination image
0 = bootloader
1/2 = CM image
3 = specify flash sector
(0-3)[2]: 1
Stored 1031764 bytes
Verified 1031764 bytes
Store parameters to flash ? [n] y
Stored 65536 bytes
Verified 65536 bytes

its slightly different for haxorware 1.1 as it says something about uncompressed image that you need to say yes to.

[Bad_Ad84]

also edit this line

"Be sure to use the firmware only and not a 2MB dump. As I've recently learned from Bad_Ad84, if there are any problems when flashing a 2MB dump this can lead to the modem being bricked, and even if it does flash ok, the modems unique information will be overwritten and the bootloader removed"

change to

"this can lead to the modem being bricked as everything on the modem is being erased including the bootloader, and even if it does flash ok, the modems unique information will be overwritten"