how do Vermin update the bootloaders of the modems

[/24]

Basically what I want to know is how do vermin manage to update the bootloader to remove the p option and disable console access? Is it not possible to use this method to fool the modem into taking a fake update with the old bootloader on it and the console enabled or am I just clutching at straws? the reason I am asking is I dont seem to be able to use any of the other methods to flash my modem and was wandering if it was somehow possible to setup a fake update server and make the modem take an update with the old bootloader to get the p option back that way? if anyone with more knowledge than me has any idea if this is possible? or if there is any way other than console unlocker to activate the console as although this works for me using hyperterminal whenever I try and use any other app to connect to the modem it just wont connect I do remember reading something fitzs posted a while ago about using snmp to do it but dont really know much else.

The best I have managed when attempting to use amchobit to access the console is a code dump shown in the attachment. anyone know what causes this?

[SunRise]

Originally Posted by /24

Basically what I want to know is how do vermin manage to update the bootloader to remove the p option and disable console access? Is it not possible to use this method to fool the modem into taking a fake update with the old bootloader on it and the console enabled or am I just clutching at straws? the reason I am asking is I dont seem to be able to use any of the other methods to flash my modem and was wandering if it was somehow possible to setup a fake update server and make the modem take an update with the old bootloader to get the p option back that way? if anyone with more knowledge than me has any idea if this is possible? or if there is any way other than console unlocker to activate the console as although this works for me using hyperterminal whenever I try and use any other app to connect to the modem it just wont connect I do remember reading something fitzs posted a while ago about using snmp to do it but dont really know much else.

The best I have managed when attempting to use amchobit to access the console is a code dump shown in the attachment. anyone know what causes this?

They update the application (image1 or 2).

Each time this boots it's checks the version of the booter loader and if not the correct version, copies the correct one from a copy in the image over the top of the existing one.

[/24]

So i guess that it isnt possible to feed it a faked update with the noisy bootloader in it? how is the console disabled then can this be reactivated without console unlocker as I think it is that which is giving me issues connecting to it using soft jtag

[cockneysean]

The cable company update the modem from the HFC side, as in VM config mode you are obviously unable to update the modems firmware through the console.

If you wanted to use their method you would need your own CMTS!!

If indeed you had your own CMTS you could update any cable modem through the cable coax. When they do an update, it's just a script that they run on the CMTS that auto updates all of the modems on the network.

What is done here is we update it through the MAX232 Port and use console unlocker to unlock.

[/24]

Thanks for that I have given up now anything I try will not work I have left it with my m8 to see what he can do as after using console unlocker the only thing that I can connect to it with is hyper terminal and putty anything else fails so my m8 was going to try and write a script or something to feed the write memory commands to it to change rewrite the bootloader although I expect that I am going to end up with a brick as issuing the read memory command at the console causes the device to reboot! Im going to send my other bricked one off to have the TSOP lifted instead