ambit 255 headache :(

[ARGYLL]

Ok ive started wth using putty as another method of trying to configure both my ambit 255s, using some basic step by step tuts I feel I have followed the correct steps in the procedure I will start with the first ambit 255 this modem has never been altered it only been out of service 7 mths
, I have connected the max 232 onto the ambit circuit board & serial cable via comport , ive got a red light on the max 232 I know the connection is all in order

I have now set my ip to 192.168.100., 255.255.255. 192.168.100.1 , all is in order

Now I have decided to use putty after having not much joy using HyperTerminal although is very much the same principle of procedure in the attempt of configuration setting up putty serial line I have com 1 , speed 115200 connection type serial, in my sessions I ave entered
I have now set up my tftp server and selected the file haxorware 11rev32.bin , also I have tried haxorware 1.0rc.4_ambit ready.bin> haxorware10rc3_ambit 250 full flash original , 2.1.6d boot loader
now I have changed from tftp now having a play with pumpkin tftp system, not a bad system for it gives you the option of being prompted when there is a live connection .
but still no joy of overwriting both 255s
What a complete downer L


BCM3349A0
100000010346890
MemSize: ......................... 8M
Flash detected @0xbe000000

Signature: 3349



Build Date: Dec 7 2004
Build Time: 09:10:44

Image 1 Program Header:
Signature: 3349
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2005/2/23 05:03:29 Z
File Length: 868364 bytes
Load Address: 80010000
Filename: ecram_sto.bin
HCS: 9ee2
CRC: 7499e8bb


HCS failed on Image 2 Program Header


Enter '1', '2', or 'p' within 2 seconds or take default...

When I press P
THIS IS FAR AS I GET , IVE ALSO EXPERIANCED DIFERANT TEXT WHEN I TYPE ANYTHING IN TO TRY AND ALTER THE BOARD IP
IN HOPE OF DIFFERENT COMAND
EXAMPLE IF I PUT OOO MY RETURN KEY REMOVES THIS ..
STRANGE !!
.


Board IP Address [192.168.100.1]:




I CANT SEEM TO GET AS FAR AS THIS STAGE , WHERE AM I GOING WRONG ??

quickly Choose option P then enter your board IP address as shown below.


Code:

Board IP Address [0.0.0.0]: 192.168.100.1 (press enter)
Board IP Mask [255.255.255.0]: (leave blank press enter)
Board IP Gateway [0.0.0.0]: (leave blank press enter)
Board MAC Address [00:10:18:ff:ff:ff]: (leave blank press enter)
Internal/External phy? (i/e)[i] (leave blank press enter)

I Made a new connection with the following settings:Connect using: (TCP/IP Winsock)
Host Address: 192.168.100.1
Port Number: 23

Only to get as far as here
trying various passwords
Admin infinite
root root
admin SetValue
Broadcom Corporation Embedded Telnet Server (c) 2000-2003

WARNING: Access allowed by authorized users only.

login: admin
password:

Invalid login...

login: admin
password:

Invalid login...

login: root

Bye bye...

Broadcom Corporation Embedded Telnet Server (c) 2000-2003

WARNING: Access allowed by authorized users only.

login: root
password:
LAST TRY
login: INFINITE
password:

Login attempts exceeded!



Bye bye...

Telnet connection from 192.168.100.10:1946 refused.

Knock it off; I'm not lettin' you in...


Bye bye...

Telnet connection from 192.168.100.10:1947 refused.

You again? Don't make me call the cops...
L

Bye bye...



WHATS THE THE CRACK HERE
IS THE MODEM BRICKED ??
IS THERE AN OVERRIDE LOGIN + PASWORD OTHER THAN ADMIN+ INFINITE ?
…………………………………………………………………………………………………………………………………… …………………………………………………………………………………………………………………………………… …………………………………………………………………………………………………………………………………… …………

2 nd 255 ambit modem unflashed

when I connect the power I only get as far as here pressing P does not work !


Revision: 3.9.32 RELEASE

Features: AckCel(tm) DOCSIS 1.0/1.1/2.0 Propane(tm) CM SNMP w/Factory MIB | Features: Support CM Vendor Extension

|Broadcom Data-Only CM Vendor Extension
|
Copyright (c) 1999 - 2004 Broadcom Corporation

Revision: 3.6.2 RELEASE

Features: DHCP Server HTTP Server OSS2-N-03025 Visualization LED
Build Date: Mar 6 2009
Built By: betty
Firmware version : 2.94.1015
Hidden version : 2.94.1015


Disable console output


Im now starting to realize that both these ambit 255s are bullet proof
And now im wondering can I go any further?
Am I just wasting my time and effort , if anyone can offer me a very simple solution or a tut I would be very very much greatfull J)
ARGYLL

[ant16151189]

i use putty, and solar winds for the tftp server,

so the console unlocker when you clicked exploit was the message ok

then when you used the soft jtag program was everything ok did it let you write the boot loader.

then after that i use putty, do the serial connection like you said and i then pull power from back of modem then quickly plug back in, then within 2 seconds press p on keyboard.

you should get into menu and from there didnt have a problem had solar winds opened selected the haxorwarerev32, then modem downloaded it and i clicked yes and followed instructions.

then after it installed haxorware successfully,.


i done this on laptop using usb to serial

i would try using solar winds for the tftp server.

[ARGYLL]

well to be honest ive tried diferent methods now but im still not getting past pressing the letter P on the boot up i reckon im gonna have to find someone who can flash both the 255 for me
my hed is in bits thinking now haha

[ARGYLL]

Previously flashed modem that im trying to overwrite with no joy
I really appreciate your help and patience with me on this subject but im so determined to get it right but its no fun being a noob ha-ha J
I guess this is all sounding hard work and long hours for me but I guess this is how you stick around and learn what I want to know and hopefully it gets better he he .J)
Q i use putty, and solar winds for the tftp server,
(Answer)
Yes im using putty & also using solar winds haxororware 11 rev32 bin
Serial line comport 1.> speed 115200 > connection type. Serial > load save or delete stored session I have saved > default sessions > modem> modem_ telnet ok?
Im not sure what other settings are relevant in the use of putty , im also wondering if I can sort my txt input problem through putty ? ie when I get to
The stage of pressing P Board IP Address [192.168.100.1]: this is all I get!
I’m unable to change this my text input goes a bit haywire

I COULD ACTULY DO WITH A WHOLE CCONFIGURATION MANUAL OF PUTTY FOR THIS SUBJECT, J)

Q so the console unlocker when you clicked exploit was the message ok

Q then when you used the soft jtag program was everything ok did it let you write the boot .. Loader.
(Answer)
NO not realy the soft jtag program I think is where im lost … I have got the link for the file that has all 3 versions , soft jtag exe installer tried them all !
windows tells me that it has encountered a problem and needs to close down so im kind of wondering what to do next ?
windows don’t seem to like softjtg unlocker for some reason I have played about with its properties to see if I could change things , but it’s a certain no go for me
my next tool is e08c007 shell unocker v1.1b console
error dropping the exploit please reset the device & rerun the application im having no joy with this method grr

Q then after that i use putty, do the serial connection like you said and i then pull power from back of modem then quickly plug back in, then within 2 seconds press p on keyboard.
(Answer)
putty im just figuring out
I got the modem too boot up but when pressing P
Enter '1', '2', or 'p' within 2 seconds or take default...
.


Board IP Address [192.168.100.1]:

(IM UNABLE TO CHANGE 'Board IP Address .>> [0.0.0.0]: I AM STUCK WITH 192.168.100.1


HCS failed on Image 2 Program Header


Enter '1', '2', or 'p' within 2 seconds or take default...
.


Board IP Address [192.168.100.1]: this is all I get !
WHEN I SHOULD BE GETTING [0.0.0.0]: I SHOULD BE ABLE TO ALTER THIS


IT JUST SEEMS TO GIVE ME DIFFERENT TEXT INPUT I CANT GO NO FURTHER ?)
Still no joy!
But im so determent to learn what’s going down here

ARGYLL

[ant16151189]

firstly the error message for console unlocker where it goes error dropping exploit is where cable is not right way round.


im gonna show you picture of the way it should be,

because theres 2 ways you can do it and the red light comes on the max 232.

but only 1 way it gives a successful message.

and the other program jtag is where you dont have a program installed that makes the jtag program work.

for example net framework 3.5 sp1

[ant16151189]

zoom in on picture you need to use them 4 pins, and try cable both way rounds on those exact 4 pins. you should get a red light on max 232 to say its connected.


then you need ethernet connected and power to modem and let it boot itself up wait like 15 seconds.

then go to console unlocker select the right com port that you are using e.g. com 1

then click exploit.

if you get error message close program and remove power lead from modem then plug back in wait 15 seconds then open program try again.

you should get a successful message.

[ant16151189]

also get net framework 3.5 sp1,


Download .NET Framework Version 3.5 SP1 - FileHippo.com


and get this microsoft visual j


Download details: Microsoft Visual J#® 2.0 Redistributable Package – Second Edition (x86)

then the programs should run.

[lee-ds]

Originally Posted by ARGYLL

Previously flashed modem that im trying to overwrite with no joy
I really appreciate your help and patience with me on this subject but im so determined to get it right but its no fun being a noob ha-ha J
I guess this is all sounding hard work and long hours for me but I guess this is how you stick around and learn what I want to know and hopefully it gets better he he .J)
Q i use putty, and solar winds for the tftp server,
(Answer)
Yes im using putty & also using solar winds haxororware 11 rev32 bin
Serial line comport 1.> speed 115200 > connection type. Serial > load save or delete stored session I have saved > default sessions > modem> modem_ telnet ok?
Im not sure what other settings are relevant in the use of putty , im also wondering if I can sort my txt input problem through putty ? ie when I get to
The stage of pressing P Board IP Address [192.168.100.1]: this is all I get!

Just press <enter>, as it already has the IP addy.


Q then when you used the soft jtag program was everything ok did it let you write the boot .. Loader.
(Answer)
NO not realy the soft jtag program I think is where im lost … I have got the link for the file that has all 3 versions , soft jtag exe installer tried them all !
windows tells me that it has encountered a problem and needs to close down so im kind of wondering what to do next ?
windows don’t seem to like softjtg unlocker for some reason I have played about with its properties to see if I could change things , but it’s a certain no go for me
my next tool is e08c007 shell unocker v1.1b console
error dropping the exploit please reset the device & rerun the application im having no joy with this method grr

Leave this one for now, and concentrate on the 1 that gives you access.

Q then after that i use putty, do the serial connection like you said and i then pull power from back of modem then quickly plug back in, then within 2 seconds press p on keyboard.
(Answer)
putty im just figuring out
I got the modem too boot up but when pressing P
Enter '1', '2', or 'p' within 2 seconds or take default...
.




Board IP Address [192.168.100.1]: this is all I get !
WHEN I SHOULD BE GETTING [0.0.0.0]: I SHOULD BE ABLE TO ALTER THIS

just press enter (as above)

IT JUST SEEMS TO GIVE ME DIFFERENT TEXT INPUT I CANT GO NO FURTHER ?)
Still no joy!
But im so determent to learn what’s going down here

ARGYLL

I've replied above in blue.

If it's no help, come back.

BTW, have you tried Tftpd32 as your server, I find it quite good?

[ant16151189]

if you still dont manage to flash modem i could do it for you, i have done like 10 ambit 255 and one ambit 250 and havent had a problem. thanks

[metoyou]

Sounds like a bootloader problem have you tried reflashing the bootloader.