Differences

This shows you the differences between two versions of the page.

--- doc:appunti:hardware:technicolor_tg789vac_v2 [2020/03/18 15:58] – [Router Bircked] niccolo
+++ doc:appunti:hardware:technicolor_tg789vac_v2 [2020/03/18 17:36] – [Router Bircked] niccolo
@@ Line 97: / Line 97: @@
 === Forcing a bank switch ===
+Someone says that this Technicolor router has **two memory banks** to store (flash) the firmware.
+  * In normal condition, the router boot from bank_1.
+  * Flashing via **TFTP** will write to **bank_1** only. It will do so even if the active bank is currently bank_2. It will never set bank_1 as active.
+  * You can see what is the **active bank** by reading **/proc/banktable/active** or by reading **serial console** output during bootstrap.
+  * Whenever the Gateway **fails to load the firmware image three times** in a row from the active bank, the bootloader will enter Bootfail mode and will try booting from the inactive/passive bank, without setting it as active.
+  * To **force the switchover** from one bank to the other, you have to run a command like **echo bank_1 > /proc/banktable/active** as root.
+So I immagine at least two methods to force the router to boot from the other bank:
+  - Load a bad image via TFTP flashing (e.g. by disconnecting the cable during the upload, or powering the router off during the flash. I did not tried it.
+  - Force some **memory read errors** during bootstrap. This can be accomplished by connecting the **RE#** line (pin 8) of the TSOP chip to ground for some short times during bootstrap. This was **[[https://www.ilpuntotecnico.com/forum/index.php/topic,77981.msg238958.html#msg238958|reported to work by some users]]**.
+{{tg789vac_v2_tsop-pinout.jpg?200|TSOP pinout}}
 ===== Credits and Web References =====
@@ Line 103: / Line 118: @@
   * **[[https://pietrotti97.com/pagine/router/mod-fw/2018/08/05/AGTOT-FW.html|Firmware per TG789Vac-v2]]**
   * **[[https://hack-technicolor.readthedocs.io/en/stable/Repository/|Firmware Repository]]**
+  * **[[https://hack-technicolor.readthedocs.io/en/stable/Recovery/|Hacking Technicolor Gateways]]**
   * **[[https://www.crc.id.au/hacking-the-technicolor-tg799vac-and-unlocking-features/|Hacking the Technicolor TG799vac]]**
+  * **[[https://www.ilpuntotecnico.com/forum/index.php/topic,77981.msg238958.html#msg238958|TG789vac v2 iiNET/UNO Flash, Sblocco e Modding]]**