18.png (15.32 KB, 下载次数: 8)
2016-7-14 16:55 上传
2、用PUTTY的SSH类型登陆192.168.199.1,端口号:22。login as输入root,password输入admin。
备份原厂固件,需要插入SD卡(不需要刷回原厂固件的就直接略过吧):root@Hiwifi:/#cat/proc/mtd #列出路由器分区情况mtd0:00030000 00010000 "u-boot"
mtd1:00010000 00010000 "hw_panic"
mtd2:00010000 00010000 "Factory"
mtd3:00140000 00010000 "kernel"
mtd4:00e40000 00010000 "rootfs"
mtd5:00560000 00010000 "rootfs_data"
mtd6:00010000 00010000 "hwf_config"
mtd7:00010000 00010000 "bdinfo"
mtd8:00010000 00010000 "backup"
mtd9:00f80000 00010000 "firmware"不知道哪个是KEY。我路由器里面装着SD卡。root@Hiwifi:/#cd/dev #进入/dev目录#ls #列出文件列表bus loop6 mtd3ro mtdblock1 ram0 ram8
console loop7 mtd4 mtdblock2 ram1 ram9
dm-0 mapper mtd4ro mtdblock3 ram10 random
full mem mtd5 mtdblock4 ram11 shm
fuse mmcblk0 mtd5ro mtdblock5 ram12 tty
kmsg mmcblk0p1 mtd6 mtdblock6 ram13 ttyS0
log mmcblk0p2 mtd6ro mtdblock7 ram14 ttyS1
loop-control mtd0 mtd7 mtdblock8 ram15 urandom
loop0 mtd0ro mtd7ro mtdblock9 ram2 usbdev1.1
loop1 mtd1 mtd8 null ram3 usbdev2.1
loop2 mtd1ro mtd8ro port ram4 watchdog
loop3 mtd2 mtd9 ppp ram5 zero
loop4 mtd2ro mtd9ro ptmx ram6
loop5 mtd3 mtdblock0 pts ram7
#cd/mnt #进入/mnt目录#mkdirSD #创建名为SD的文件夹#mount/dev/mmcblk0p2 /mnt/SD #挂载SD卡第二分区到/mnt/SD这个文件夹/目录Mount isdenied because the NTFS volume is already exclusively opened.
Thevolume may be already mounted, or another software may use it which
could beidentified for example by the help of the 'fuser' command.
root@Hiwifi:/mnt#cdSD #从/mnt目录进入到它的下级目录,SD这个目录root@Hiwifi:/mnt/SD#ls #列出文件列表aria2.log log traffic_his
cron lost+found traffic_total_his
hwf_download opt var
root@Hiwifi:/mnt/SD#dd if=/dev/mtd0 of=/mnt/SD/uboot.bin #备份uboot分区为uboot.bin文件到SD卡的第二分区384+0records in
384+0records out
196608bytes (192.0KB) copied, 0.044820 seconds, 4.2MB/s
root@Hiwifi:/mnt/SD#dd if=/dev/mtd1 of=/mnt/SD/hw_panic.bin #备份hw_panic分区128+0records in
128+0records out
65536bytes (64.0KB) copied, 0.014260 seconds, 4.4MB/s
root@Hiwifi:/mnt/SD#dd if=/dev/mtd2 of=/mnt/SD/Factory.bin #备份分区128+0records in
128+0records out
65536bytes (64.0KB) copied, 0.013960 seconds, 4.5MB/s
root@Hiwifi:/mnt/SD/backup#dd if=/dev/mtd6 of=/mnt/SD/hwf_config.bin #备份分区128+0records in
128+0records out
65536bytes (64.0KB) copied, 0.014140 seconds, 4.4MB/s
root@Hiwifi:/mnt/SD#dd if=/dev/mtd7 of=/mnt/SD/bdinfo.bin #备份分区128+0records in
128+0records out
65536bytes (64.0KB) copied, 0.014200 seconds, 4.4MB/s
root@Hiwifi:/mnt/SD#dd if=/dev/mtd8 of=/mnt/SD/backup.bin #备份分区128+0records in
128+0records out
65536bytes (64.0KB) copied, 0.014300 seconds, 4.4MB/s
root@Hiwifi:/mnt/SD#dd if=/dev/mtd3 of=/mnt/SD/kernel.bin #备份分区2560+0records in
2560+0records out
1310720bytes (1.3MB) copied, 0.274500 seconds, 4.6MB/s
root@Hiwifi:/mnt/SD#dd if=/dev/mtd4 of=/mnt/SD/rootfs.bin #备份分区29184+0records in
29184+0records out
14942208bytes (14.3MB) copied, 4.002140 seconds, 3.6MB/s
root@Hiwifi:/mnt/SD#dd if=/dev/mtd5 of=/mnt/SD/rootfs_data.bin #备份分区11008+0records in
11008+0records out
5636096bytes (5.4MB) copied, 1.188020 seconds, 4.5MB/s
root@Hiwifi:/mnt/SD#dd if=/dev/mtd9 of=/mnt/SD/firmware.bin #备份分区31744+0records in
31744+0records out
16252928bytes (15.5MB) copied, 3.688700 seconds, 4.2MB/s
root@Hiwifi:/mnt/SD#/sbin/hi_crypto_key device-crypt-key #提取SD卡第一加密分区的密钥,不用原厂固件的话不是很重要一串32位密码,隐私,我就不透露了。以上都是备份,其实就是为了刷回原厂做备份而已、然而很少有人会刷回原厂。。。#这是重点了,我已上传了极路由专用不死uboot(HC5661)到TMP目录下。cd/tmp #进入内存目录(在路由器里面,一般/tmp目录其实就是内存)ls #这里已经可以看到HC5661.bin文件了。
19.png (20.71 KB, 下载次数: 7)
2016-7-14 16:55 上传
/tmp #mtd write hc5661.bin u-boot #开始刷uboot,上帝保佑我的路由器不要变砖,不要停电啊。。
20.png (22.1 KB, 下载次数: 8)
2016-7-14 16:55 上传
Unlockingu-boot ...
Writingfrom hc5661.bin to u-boot ...
[ ]
21.png (20.47 KB, 下载次数: 4)
2016-7-14 16:55 上传
/tmp#reboot #嗯,刷好了,重新启动吧。