Advisory: Sophos Endpoint - "Your connection isn't private." We're aware of a certificate issue and are actively working to resolve it. Please see: KB-000045954 for the latest updates.

Trying to unbrick my APX120

I am using the instructions to unbrick my APX120 from this post, but I have run into issues below:

community.sophos.com/.../unbrick-apx120-break-bootdelay-0-recover-apx120

I can't seem to save the environment variables. When I run the "saveenv"

It says:

Saving Environment to NAND...
Erasing Nand...
Attempt to erase non page aligned data



Added TAGs
[edited by: Raphael Alganes at 2:18 PM (GMT -8) on 12 Jan 2024]
Parents
  • I came across a few APX120 that had a faulty NAND chip, so maybe your APX has faulty one.
    Power cycle your APX and post the uboot log.

    You need to short SO/SIO1 for a fraction of a second in the right moment, the nand will not be available now.
    Try to set the bootdelay to 5s, power cycle the APX and enter uBoot.

  • I tried the shorting trick to break uboot again and this time it was able to recognize the nand and save environment variables. But now I am running into a new issue, the APX120 is boot looping after tftpboot, see below. I am TFTP booting the latest APX.uimage (version: 11.0.021-1) from my firewall. When I try to enter failsafe it asks for a login and I can't seem to get root.

    U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)
    
    smem ram ptable found: ver: 1 len: 3
    DRAM:  256 MiB
    @machid : 0x8010100
    NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
    SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
    SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
    ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
    258 MiB
    MMC:
    In:    serial
    Out:   serial
    Err:   serial
    machid: 8010100
    flash_type: 0
    Hit any key to stop autoboot:  0
    Net:   MAC0 addr:94:87:c6:be:90:98
    PHY ID1: 0x4d
    PHY ID2: 0xd0b2
    ipq40xx_ess_sw_init done
    eth0
    
    (APX120) # nand erase.chip
    
    NAND erase.chip: device 1 whole chip
    Erasing at 0xffe0000 -- 100% complete.
    OK
    (APX120) # tftpboot APX.uimage
    eth0 PHY0 Down Speed :10 Half duplex
    eth0 PHY1 Down Speed :10 Half duplex
    eth0 PHY2 Down Speed :10 Half duplex
    eth0 PHY3 Down Speed :10 Half duplex
    eth0 PHY4 up Speed :1000 Full duplex
    Using eth0 device
    TFTP from server 192.168.1.8; our IP address is 192.168.1.11
    Filename 'APX.uimage'.
    Load address: 0x84000000
    Loading: #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             #################################################################
             ###
    done
    Bytes transferred = 17219613 (106c01d hex)
    (APX120) # bootm 0x84000000#config@4
    ## Booting kernel from FIT Image at 84000000 ...
       Using 'config@4' configuration
       Trying 'kernel@1' kernel subimage
         Description:  ARM OpenWrt Linux-3.14.43
         Type:         Kernel Image
         Compression:  uncompressed
         Data Start:   0x840000e4
         Data Size:    16970916 Bytes = 16.2 MiB
         Architecture: ARM
         OS:           Linux
         Load Address: 0x80208000
         Entry Point:  0x80208000
    node name: signature@1
         Sign algo:    sha256,rsa4096
         Sign value:   26de17c082ec7f77a07a4af939b59285f85153f884ef1285e066b8f6b3f8d276c69fbb606123700c1c93b3f628d561ea0d0d02e36814e280aa0db36012a40fb9210b56b9b48b7c6e396b7c54df6b46eb980cb95c7c1d9da59364c152da4f2643e954c8b44df8f50a09958b2c21612724f1d14751c6ae57d46ba913003cf0949de9a2235e80e767546f5568088ae4a65dd4e1acdb4d5f64f29c973bb971ebb2eeaeaa8c553c60dd57b15e64dcf7f0c3a5e170737a5ed074d7b9f44ff475e307634d066939f6fbd932cc72454e443ba79f9232ea37fe50ab8b1d2b152d5833056a1e5cd79aa0000edaad6345d0d9aec7fbad36f6026bfd944b0ae6ed3390dd98460e521739ff6ae0df58190c2fd73fb63a505951218b8922169ba2bd32d1af3c04fbfa8535ee098b0c4d52cf9c6c2e6b43e9796b7dcd4a64d1378126f9bd26393e846ace0aa9c630ca4df7b96807f814a08d352eb2d7d849b3a1bf0c1eb4ba42238f68728b6e9d1a81ecbdf94f90ff5d4097a44aa414e1247b1393a5d6886044d6d3b311d9cbd6f88324d820c5e4dd8fb43c5832f9d21679a5524bcae02eeec14291a6eb290dc41278754a4e3df6de45162b2bf68fe22301aff4ade69d2989855ca1e498aafcbaf1037ebc1bdd2b241f0aace9514e98a8e63d559b8931ac8ecd7b4872f589b3354bea28dcaacf1d76ab05d0ad23be3da0286e9f3ce277ca07a83e
       Verifying Hash Integrity ... sha256+ OK
    ## Flattened Device Tree from FIT Image at 84000000
       Using 'config@4' configuration
       Trying 'fdt@4' FDT blob subimage
         Description:  ARM OpenWrt Sophos-APX device tree blob
         Type:         Flat Device Tree
         Compression:  uncompressed
         Data Start:   0x85044dc8
         Data Size:    33944 Bytes = 33.1 KiB
         Architecture: ARM
    node name: signature@1
         Sign algo:    sha256,rsa4096
         Sign value:   b10820c244a7e9eee31fe5e0960b5d92734dc256f2a869cdd6834aa48842e95a803388cbab8d03a2227b50c07bd5f4bd536cb022134ab02863cec311d16ac8cd771218e23d68377d231a6642a3c4e9a5dcfa4754ada194b91e793470b8a784fe3ab8f646f419a0c4f38c3a5c4c86931108b4c926ac1a463cd4313459a7ea8f762ba8b141e1452c457520d6d4951f69a3cc6f9f8f6e60a189372393d7e41baa6788ddbd0330cf0ab962f506b34b1e4620217b05a45b2c10e81b9129b6cba3178fd4565b27be38f15f412e8f7df850e04bc434b938f116cd3d4dbaa941ca704b1896ef96a5af379f7bae826dfc166f8a3ed957a62a8dc8a815c4b09293aca868cf672a67f06ff81c8e397fd01abdb7ba48933f5ffa27563db558fb1ab7217fcac02b6a31faf1a86f9db430b23bf5261a8aaad03f9be8955e9c5a72b372dc91b558f52278698947ea04c46276a8ba13768cb2fe9386cf273e08b95abebcca4219632f730162a7ed9fe949551e1dc2546adfb64ae6d759421f5de48ad148d920b354b9b07196460aea74f8c4adece41e0e33ee0a009cbb3086c6e26131e6a07b6f21cfeaa7b34fe06a007c8972512bcc8b2f331151b160d9affae312bba7d03a800f8b93b8745121de78c326e90b869dd4415b48d84309614cd8d25727c6a852a456c57617cf764b02a4afdfab338a0d09a6d5d8114b68ea5a39b12cd04bae16074f
       Verifying Hash Integrity ... sha256+ OK
       Booting using the fdt blob at 0x85044dc8
       Loading Kernel Image ... OK
    OK
       Loading Device Tree to 86ff4000, end 86fff497 ... OK
    eth1 MAC Address from ART is not valid
    Using machid 0x8010100 from environment
    
    Starting kernel ...
    
    Press the [f] key and hit [enter] to enter failsafe mode
    Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
    Please press Enter to activate this console.
    Booting. (Version: 11.0.021-1)
    Checking The AP model
    Starting network configuration for ethernet interface over DHCP.
    Cloud certificate validation pending.
    dnsserver entries are missing
    [
    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000010
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1691 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52832 - boot_flash_init, Delta
    B -    843666 - boot_config_data_table_init, Start
    D -      3836 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850871 - clock_init, Start
    D -      7563 - clock_init, Delta
    B -    862908 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866322 - sbl1_ddr_set_params, Start
    B -    871420 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875802 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13176 - sbl1_ddr_set_params, Delta
    B -    889541 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959696 - sbl1_wait_for_ddr_training, Start
    D -        28 - sbl1_wait_for_ddr_training, Delta
    B -    975317 - Image Load, Start
    D -    152332 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1128077 - Image Load, Start
    D -      1447 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138488 - Image Load, Start
    D -    224121 - APPSBL Image Loaded, Delta - (458523 Bytes)
    B -   1363008 - QSEE Execution, Start
    D -        60 - QSEE Execution, Delta
    B -   1369207 - SBL1, End
    D -    677070 - SBL1, Delta
    S - Flash Throughput, 2008 KB/s  (758742 Bytes,  377699 us)
    S - DDR Frequency, 537 MHz
    

  • I tried firmware 2.3.2-1 and I couldn't get root:

    U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)
    
    smem ram ptable found: ver: 1 len: 3
    DRAM:  256 MiB
    @machid : 0x8010100
    NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
    SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
    SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
    ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
    258 MiB
    MMC:
    In:    serial
    Out:   serial
    Err:   serial
    machid: 8010100
    flash_type: 0
    Hit any key to stop autoboot:  0
    incorrect device type in rootfs
    Partition rootfs not found!
    Error, no UBI device/partition selected!
    ## Booting kernel from FIT Image at 84000000 ...
       Using 'config@4' configuration
       Trying 'kernel@1' kernel subimage
         Description:  ARM OpenWrt Linux-3.14.43
         Type:         Kernel Image
         Compression:  uncompressed
         Data Start:   0x840000e4
         Data Size:    16758376 Bytes = 16 MiB
         Architecture: ARM
         OS:           Linux
         Load Address: 0x80208000
         Entry Point:  0x80208000
    node name: signature@1
         Sign algo:    sha256,rsa4096
         Sign value:   8e547cdf4044e04a991f68130d577ccca52a04daf21c1b96283aef1940b71c896e19657ad7fbca311b684949c5b2c93528668093908ac50072df5dfcd93e913bb436ed04300bc3966967ac6c90a28e13a4a1acb784929df0e8964d4fe7b0b5c3152af9efd0becd009ae72f50711b032179f53babf152fae39edf723dd8f97455e0ccdc4eb4ae182237fd1204a057e9a0ee8cfef8faac46d12882e226e45e46830a51968c39252eebfebc895407fe5ebceeaf2ee476bf80b2e1689c9174fa5b81a13188519bc7cfd3fa25e80c872ddfe6e31176df17992e945a2a174750c77231718c1c6f7d5aa3cba653de90fbcf7d41870a3610ebd06b883c8af479967da56e2e5aa7642665276557e8efb6b219f094e12a8feb78bd63ce9d51c95e77176318890292e05c9a7d542e20a92af62ff8bcd15ebea62f60bfad16378c833ea477b827351d45c59734c7f4feb113c9c021275c7c822ac1794eae2f982e670b1041a4fc6d8e24d4cbe039d5f538f740f92b39389c5d12057c2e900926173f552fb96a27735276ee65f3ba46099fc13645460a0cdf1720e84a45051c27affd6a221ae629b40713fb42478afdf29c0be628d826ce232436bcc9e30cd35e333acdd886ca45631cebb6e3d80e86be9b272cb361513c061ee4b01d9b3abd5b6936a87b9a3972fdb7a341236e3dd28fd424215590503f50ef9215a7513da007cb7c4b8ec2c7
       Verifying Hash Integrity ... sha256+ OK
    ## Flattened Device Tree from FIT Image at 84000000
       Using 'config@4' configuration
       Trying 'fdt@4' FDT blob subimage
         Description:  ARM OpenWrt Sophos-APX device tree blob
         Type:         Flat Device Tree
         Compression:  uncompressed
         Data Start:   0x850112f8
         Data Size:    34822 Bytes = 34 KiB
         Architecture: ARM
    node name: signature@1
         Sign algo:    sha256,rsa4096
         Sign value:   32c96aa3ece37ac9e39bf7f1b55b31ab4df7ca0a052b8ff2b3baa1a8de2fe1922c457e66e562016d30e08584974637ce4f6784371e921e45df2b81b02f2b5c7867fef603da83b3d02b6ce35cc99c66e0af16782f3adfd5f0c8bd264c11e77c5617049c4b2ce04225342cbad675c79ebac491fb14bc3d58f791c635ebd4031ea584192b16e46864167f47d2304d13b031ca2e75ab5b208aab0b6ce4da15481780db22b9b5a61eb7bbbf291514801982ecf6ca0a1d420dcfc57afa49d8db9f6f8185acf30a100bb7e187fb8a9f39f7b244afe8c9c0da1bf039713aa6d209d130454ca0e7f1ca3007f07417243c6c40092fa79af64c8347641eba5e615ab6c1558299ec25ed36c5a301536bbbf0393baf455c6fb45cc56e855e65fc768228499975cd38a32d2dd2f05eaad1a2fca6dd0333e99265d755d29b311991e8bb26cfb0ff1368eb609c69d6c29f9d82e245fc26d68015a792d3d68451d3732830aa6782d6f376496012f63eec4795c3bfba1a955606fd1c3512cefa499d08bd8f7468946fa448f1005dd3b58eba84d5455b5e9ced317fcb7a5ca2bccbfbe43bd139dfad3f37e8fa8ffdacc49fc105790e100e57b73f3fc87744b07499bfd25d01f84f78de04c8848fc7953625b00bbf946a76f09b4452727d546020eb35fbe6f13afd698c10e479ab3627214ae0c4ba2b07a03b9feb599ada31dc8d112aaf9d125fa41109
       Verifying Hash Integrity ... sha256+ OK
       Booting using the fdt blob at 0x850112f8
       Loading Kernel Image ... OK
    OK
       Loading Device Tree to 86ff4000, end 86fff805 ... OK
    eth1 MAC Address from ART is not valid
    Using machid 0x8010100 from environment
    
    Starting kernel ...
    
    Press the [f] key and hit [enter] to enter failsafe mode
    Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
    f
    - failsafe -
    /etc/preinit: line 1: telnetd: not found
    (none) login: Please reboot system when done with failsafe network logins
    

  • I tried 11.0.021-1 and when I press enter to activate console it asks for the login and I enter root as username and fail the authentication 3 times, then I get root but the device restarts after a few seconds.

    U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)
    
    smem ram ptable found: ver: 1 len: 3
    DRAM:  256 MiB
    @machid : 0x8010100
    NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
    SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
    SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
    ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
    258 MiB
    MMC:
    In:    serial
    Out:   serial
    Err:   serial
    machid: 8010100
    flash_type: 0
    Hit any key to stop autoboot:  0
    incorrect device type in rootfs
    Partition rootfs not found!
    Error, no UBI device/partition selected!
    ## Booting kernel from FIT Image at 84000000 ...
       Using 'config@4' configuration
       Trying 'kernel@1' kernel subimage
         Description:  ARM OpenWrt Linux-3.14.43
         Type:         Kernel Image
         Compression:  uncompressed
         Data Start:   0x840000e4
         Data Size:    16970916 Bytes = 16.2 MiB
         Architecture: ARM
         OS:           Linux
         Load Address: 0x80208000
         Entry Point:  0x80208000
    node name: signature@1
         Sign algo:    sha256,rsa4096
         Sign value:   26de17c082ec7f77a07a4af939b59285f85153f884ef1285e066b8f6b3f8d276c69fbb606123700c1c93b3f628d561ea0d0d02e36814e280aa0db36012a40fb9210b56b9b48b7c6e396b7c54df6b46eb980cb95c7c1d9da59364c152da4f2643e954c8b44df8f50a09958b2c21612724f1d14751c6ae57d46ba913003cf0949de9a2235e80e767546f5568088ae4a65dd4e1acdb4d5f64f29c973bb971ebb2eeaeaa8c553c60dd57b15e64dcf7f0c3a5e170737a5ed074d7b9f44ff475e307634d066939f6fbd932cc72454e443ba79f9232ea37fe50ab8b1d2b152d5833056a1e5cd79aa0000edaad6345d0d9aec7fbad36f6026bfd944b0ae6ed3390dd98460e521739ff6ae0df58190c2fd73fb63a505951218b8922169ba2bd32d1af3c04fbfa8535ee098b0c4d52cf9c6c2e6b43e9796b7dcd4a64d1378126f9bd26393e846ace0aa9c630ca4df7b96807f814a08d352eb2d7d849b3a1bf0c1eb4ba42238f68728b6e9d1a81ecbdf94f90ff5d4097a44aa414e1247b1393a5d6886044d6d3b311d9cbd6f88324d820c5e4dd8fb43c5832f9d21679a5524bcae02eeec14291a6eb290dc41278754a4e3df6de45162b2bf68fe22301aff4ade69d2989855ca1e498aafcbaf1037ebc1bdd2b241f0aace9514e98a8e63d559b8931ac8ecd7b4872f589b3354bea28dcaacf1d76ab05d0ad23be3da0286e9f3ce277ca07a83e
       Verifying Hash Integrity ... sha256+ OK
    ## Flattened Device Tree from FIT Image at 84000000
       Using 'config@4' configuration
       Trying 'fdt@4' FDT blob subimage
         Description:  ARM OpenWrt Sophos-APX device tree blob
         Type:         Flat Device Tree
         Compression:  uncompressed
         Data Start:   0x85044dc8
         Data Size:    33944 Bytes = 33.1 KiB
         Architecture: ARM
    node name: signature@1
         Sign algo:    sha256,rsa4096
         Sign value:   b10820c244a7e9eee31fe5e0960b5d92734dc256f2a869cdd6834aa48842e95a803388cbab8d03a2227b50c07bd5f4bd536cb022134ab02863cec311d16ac8cd771218e23d68377d231a6642a3c4e9a5dcfa4754ada194b91e793470b8a784fe3ab8f646f419a0c4f38c3a5c4c86931108b4c926ac1a463cd4313459a7ea8f762ba8b141e1452c457520d6d4951f69a3cc6f9f8f6e60a189372393d7e41baa6788ddbd0330cf0ab962f506b34b1e4620217b05a45b2c10e81b9129b6cba3178fd4565b27be38f15f412e8f7df850e04bc434b938f116cd3d4dbaa941ca704b1896ef96a5af379f7bae826dfc166f8a3ed957a62a8dc8a815c4b09293aca868cf672a67f06ff81c8e397fd01abdb7ba48933f5ffa27563db558fb1ab7217fcac02b6a31faf1a86f9db430b23bf5261a8aaad03f9be8955e9c5a72b372dc91b558f52278698947ea04c46276a8ba13768cb2fe9386cf273e08b95abebcca4219632f730162a7ed9fe949551e1dc2546adfb64ae6d759421f5de48ad148d920b354b9b07196460aea74f8c4adece41e0e33ee0a009cbb3086c6e26131e6a07b6f21cfeaa7b34fe06a007c8972512bcc8b2f331151b160d9affae312bba7d03a800f8b93b8745121de78c326e90b869dd4415b48d84309614cd8d25727c6a852a456c57617cf764b02a4afdfab338a0d09a6d5d8114b68ea5a39b12cd04bae16074f
       Verifying Hash Integrity ... sha256+ OK
       Booting using the fdt blob at 0x85044dc8
       Loading Kernel Image ... OK
    OK
       Loading Device Tree to 86ff4000, end 86fff497 ... OK
    eth1 MAC Address from ART is not valid
    Using machid 0x8010100 from environment
    
    Starting kernel ...
    
    Press the [f] key and hit [enter] to enter failsafe mode
    Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
    Please press Enter to activate this console.
    
    Warning: Bad CRC, using default environment
    (none) login: root
    Password:
    Login incorrect
    (none) login: root
    Password:
    Login incorrect
    (none) login: root
    Password:
    Booting. (Version: 11.0.021-1)
    Checking The AP model
    Login incorrect
    Mar 30 10:46:57 login[128]: invalid password for 'root' on 'consPlease press Enter to activate this console.
    
    
    
    BusyBox v1.23.2 (2023-03-30 10:36:59 UTC) built-in shell (ash)
    
    FIRMWARE_VERSION: 11.0.021-1
    root@(none):/#
    root@(none):/# ls
    bin       download  lib       proc      sbin      usr
    config    etc       mnt       rom       sys       var
    dev       init      overlay   root      tmp       www
    root@(none):/# cd bin
    root@OpenWrt:/bin# ls
    add_mesh_iface.sh         false                     ps
    add_radio_mapping.sh      fgrep                     pwd
    add_ssh_pubkey.sh         fsync                     remove_dcs_schedule.sh
    add_time_base_scan.sh     grep                      remove_wifi_ifaces.sh
    add_wifi_iface.sh         gunzip                    rm
    ap_caps.sh                gzip                      rmdir
    apx_packet_capture.sh     ipcalc.sh                 scan_mesh.sh
    ash                       iptables.sh               sed
    base64                    kill                      sh
    board_detect              ln                        sleep
    busybox                   lock                      sophos_login
    cat                       login                     start_dropbear.sh
    chgrp                     login.sh                  stat
    chmod                     ls                        sync
    chown                     mkdir                     tar
    config_generate           mknod                     touch
    cp                        mktemp                    true
    create_vxlan_tunnel.sh    mod_wifi_iface.sh         ubus
    date                      mount                     umount
    dcs_schedule.sh           mv                        uname
    dd                        netmsg                    update_config.sh
    df                        netstat                   update_image.sh
    dmesg                     nice                      vi
    echo                      pidof                     zcat
    egrep                     ping
    enable_remote_logging.sh  ping6
    root@OpenWrt:/bin# [
    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000010
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1691 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52832 - boot_flash_init, Delta
    B -    843666 - boot_config_data_table_init, Start
    D -      3836 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850871 - clock_init, Start
    D -      7566 - clock_init, Delta
    B -    862910 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866324 - sbl1_ddr_set_params, Start
    B -    871421 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875804 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13176 - sbl1_ddr_set_params, Delta
    B -    889543 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959626 - sbl1_wait_for_ddr_training, Start
    D -        27 - sbl1_wait_for_ddr_training, Delta
    B -    975245 - Image Load, Start
    D -    152334 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1128005 - Image Load, Start
    D -      1446 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138416 - Image Load, Start
    D -    224120 - APPSBL Image Loaded, Delta - (458523 Bytes)
    B -   1362935 - QSEE Execution, Start
    D -        60 - QSEE Execution, Delta
    B -   1369157 - SBL1, End
    D -    677020 - SBL1, Delta
    S - Flash Throughput, 2008 KB/s  (758742 Bytes,  377700 us)
    S - DDR Frequency, 537 MHz
    

Reply
  • I tried 11.0.021-1 and when I press enter to activate console it asks for the login and I enter root as username and fail the authentication 3 times, then I get root but the device restarts after a few seconds.

    U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)
    
    smem ram ptable found: ver: 1 len: 3
    DRAM:  256 MiB
    @machid : 0x8010100
    NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
    SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
    SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
    ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
    258 MiB
    MMC:
    In:    serial
    Out:   serial
    Err:   serial
    machid: 8010100
    flash_type: 0
    Hit any key to stop autoboot:  0
    incorrect device type in rootfs
    Partition rootfs not found!
    Error, no UBI device/partition selected!
    ## Booting kernel from FIT Image at 84000000 ...
       Using 'config@4' configuration
       Trying 'kernel@1' kernel subimage
         Description:  ARM OpenWrt Linux-3.14.43
         Type:         Kernel Image
         Compression:  uncompressed
         Data Start:   0x840000e4
         Data Size:    16970916 Bytes = 16.2 MiB
         Architecture: ARM
         OS:           Linux
         Load Address: 0x80208000
         Entry Point:  0x80208000
    node name: signature@1
         Sign algo:    sha256,rsa4096
         Sign value:   26de17c082ec7f77a07a4af939b59285f85153f884ef1285e066b8f6b3f8d276c69fbb606123700c1c93b3f628d561ea0d0d02e36814e280aa0db36012a40fb9210b56b9b48b7c6e396b7c54df6b46eb980cb95c7c1d9da59364c152da4f2643e954c8b44df8f50a09958b2c21612724f1d14751c6ae57d46ba913003cf0949de9a2235e80e767546f5568088ae4a65dd4e1acdb4d5f64f29c973bb971ebb2eeaeaa8c553c60dd57b15e64dcf7f0c3a5e170737a5ed074d7b9f44ff475e307634d066939f6fbd932cc72454e443ba79f9232ea37fe50ab8b1d2b152d5833056a1e5cd79aa0000edaad6345d0d9aec7fbad36f6026bfd944b0ae6ed3390dd98460e521739ff6ae0df58190c2fd73fb63a505951218b8922169ba2bd32d1af3c04fbfa8535ee098b0c4d52cf9c6c2e6b43e9796b7dcd4a64d1378126f9bd26393e846ace0aa9c630ca4df7b96807f814a08d352eb2d7d849b3a1bf0c1eb4ba42238f68728b6e9d1a81ecbdf94f90ff5d4097a44aa414e1247b1393a5d6886044d6d3b311d9cbd6f88324d820c5e4dd8fb43c5832f9d21679a5524bcae02eeec14291a6eb290dc41278754a4e3df6de45162b2bf68fe22301aff4ade69d2989855ca1e498aafcbaf1037ebc1bdd2b241f0aace9514e98a8e63d559b8931ac8ecd7b4872f589b3354bea28dcaacf1d76ab05d0ad23be3da0286e9f3ce277ca07a83e
       Verifying Hash Integrity ... sha256+ OK
    ## Flattened Device Tree from FIT Image at 84000000
       Using 'config@4' configuration
       Trying 'fdt@4' FDT blob subimage
         Description:  ARM OpenWrt Sophos-APX device tree blob
         Type:         Flat Device Tree
         Compression:  uncompressed
         Data Start:   0x85044dc8
         Data Size:    33944 Bytes = 33.1 KiB
         Architecture: ARM
    node name: signature@1
         Sign algo:    sha256,rsa4096
         Sign value:   b10820c244a7e9eee31fe5e0960b5d92734dc256f2a869cdd6834aa48842e95a803388cbab8d03a2227b50c07bd5f4bd536cb022134ab02863cec311d16ac8cd771218e23d68377d231a6642a3c4e9a5dcfa4754ada194b91e793470b8a784fe3ab8f646f419a0c4f38c3a5c4c86931108b4c926ac1a463cd4313459a7ea8f762ba8b141e1452c457520d6d4951f69a3cc6f9f8f6e60a189372393d7e41baa6788ddbd0330cf0ab962f506b34b1e4620217b05a45b2c10e81b9129b6cba3178fd4565b27be38f15f412e8f7df850e04bc434b938f116cd3d4dbaa941ca704b1896ef96a5af379f7bae826dfc166f8a3ed957a62a8dc8a815c4b09293aca868cf672a67f06ff81c8e397fd01abdb7ba48933f5ffa27563db558fb1ab7217fcac02b6a31faf1a86f9db430b23bf5261a8aaad03f9be8955e9c5a72b372dc91b558f52278698947ea04c46276a8ba13768cb2fe9386cf273e08b95abebcca4219632f730162a7ed9fe949551e1dc2546adfb64ae6d759421f5de48ad148d920b354b9b07196460aea74f8c4adece41e0e33ee0a009cbb3086c6e26131e6a07b6f21cfeaa7b34fe06a007c8972512bcc8b2f331151b160d9affae312bba7d03a800f8b93b8745121de78c326e90b869dd4415b48d84309614cd8d25727c6a852a456c57617cf764b02a4afdfab338a0d09a6d5d8114b68ea5a39b12cd04bae16074f
       Verifying Hash Integrity ... sha256+ OK
       Booting using the fdt blob at 0x85044dc8
       Loading Kernel Image ... OK
    OK
       Loading Device Tree to 86ff4000, end 86fff497 ... OK
    eth1 MAC Address from ART is not valid
    Using machid 0x8010100 from environment
    
    Starting kernel ...
    
    Press the [f] key and hit [enter] to enter failsafe mode
    Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
    Please press Enter to activate this console.
    
    Warning: Bad CRC, using default environment
    (none) login: root
    Password:
    Login incorrect
    (none) login: root
    Password:
    Login incorrect
    (none) login: root
    Password:
    Booting. (Version: 11.0.021-1)
    Checking The AP model
    Login incorrect
    Mar 30 10:46:57 login[128]: invalid password for 'root' on 'consPlease press Enter to activate this console.
    
    
    
    BusyBox v1.23.2 (2023-03-30 10:36:59 UTC) built-in shell (ash)
    
    FIRMWARE_VERSION: 11.0.021-1
    root@(none):/#
    root@(none):/# ls
    bin       download  lib       proc      sbin      usr
    config    etc       mnt       rom       sys       var
    dev       init      overlay   root      tmp       www
    root@(none):/# cd bin
    root@OpenWrt:/bin# ls
    add_mesh_iface.sh         false                     ps
    add_radio_mapping.sh      fgrep                     pwd
    add_ssh_pubkey.sh         fsync                     remove_dcs_schedule.sh
    add_time_base_scan.sh     grep                      remove_wifi_ifaces.sh
    add_wifi_iface.sh         gunzip                    rm
    ap_caps.sh                gzip                      rmdir
    apx_packet_capture.sh     ipcalc.sh                 scan_mesh.sh
    ash                       iptables.sh               sed
    base64                    kill                      sh
    board_detect              ln                        sleep
    busybox                   lock                      sophos_login
    cat                       login                     start_dropbear.sh
    chgrp                     login.sh                  stat
    chmod                     ls                        sync
    chown                     mkdir                     tar
    config_generate           mknod                     touch
    cp                        mktemp                    true
    create_vxlan_tunnel.sh    mod_wifi_iface.sh         ubus
    date                      mount                     umount
    dcs_schedule.sh           mv                        uname
    dd                        netmsg                    update_config.sh
    df                        netstat                   update_image.sh
    dmesg                     nice                      vi
    echo                      pidof                     zcat
    egrep                     ping
    enable_remote_logging.sh  ping6
    root@OpenWrt:/bin# [
    Format: Log Type - Time(microsec) - Message - Optional Info
    Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
    S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
    S - IMAGE_VARIANT_STRING=DAABANAZA
    S - OEM_IMAGE_VERSION_STRING=CRM
    S - Boot Config, 0x00000021
    S - Reset status Config, 0x00000010
    S - Core 0 Frequency, 0 MHz
    B -       261 - PBL, Start
    B -      1338 - bootable_media_detect_entry, Start
    B -      1678 - bootable_media_detect_success, Start
    B -      1691 - elf_loader_entry, Start
    B -      5068 - auth_hash_seg_entry, Start
    B -      7209 - auth_hash_seg_exit, Start
    B -    577087 - elf_segs_hash_verify_entry, Start
    B -    694221 - PBL, End
    B -    694245 - SBL1, Start
    B -    785250 - pm_device_init, Start
    D -         7 - pm_device_init, Delta
    B -    786695 - boot_flash_init, Start
    D -     52832 - boot_flash_init, Delta
    B -    843666 - boot_config_data_table_init, Start
    D -      3836 - boot_config_data_table_init, Delta - (419 Bytes)
    B -    850871 - clock_init, Start
    D -      7566 - clock_init, Delta
    B -    862910 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
    B -    866324 - sbl1_ddr_set_params, Start
    B -    871421 - cpr_init, Start
    D -         2 - cpr_init, Delta
    B -    875804 - Pre_DDR_clock_init, Start
    D -         4 - Pre_DDR_clock_init, Delta
    D -     13176 - sbl1_ddr_set_params, Delta
    B -    889543 - pm_driver_init, Start
    D -         2 - pm_driver_init, Delta
    B -    959626 - sbl1_wait_for_ddr_training, Start
    D -        27 - sbl1_wait_for_ddr_training, Delta
    B -    975245 - Image Load, Start
    D -    152334 - QSEE Image Loaded, Delta - (297752 Bytes)
    B -   1128005 - Image Load, Start
    D -      1446 - SEC Image Loaded, Delta - (2048 Bytes)
    B -   1138416 - Image Load, Start
    D -    224120 - APPSBL Image Loaded, Delta - (458523 Bytes)
    B -   1362935 - QSEE Execution, Start
    D -        60 - QSEE Execution, Delta
    B -   1369157 - SBL1, End
    D -    677020 - SBL1, Delta
    S - Flash Throughput, 2008 KB/s  (758742 Bytes,  377700 us)
    S - DDR Frequency, 537 MHz
    

Children
No Data