斐讯E1拆机焊接TTL救砖

从老家的柜子里翻出来一台斐讯E1，老家在用的是斐讯K2P，300M宽带，房间和大部分位置wifi5足够跑满了，一直懒得升级，也足够用了。
不过发现部分位置信号比较弱，都不到50M，考虑插上E1做个AP中继，偶尔用用，当个备胎。
结果这个E1记得之前好像刷过机，但是IP地址忘了，不知道怎么连接，各种尴尬，只好尝试恢复出厂设置，但是恢复以后也一直无法连接，reset貌似也不能恢复出厂设置，这就诡异了。
虽然这破玩意也不值啥钱，其他备用设备老家也没有了，倒是还有K2P不过不在老家了，于是尝试修一下看看吧

大概率板子上都是有ttl的，于是搜了搜拆机方法：

下载breed:
K1/K1S/K2 通用，文件名：breed-mt7620-phicomm-psg1208.bin

E1使用与k2相同的breed
https://breed.hackpascal.net/breed-mt7620-phicomm-psg1208.bin

先下载一个padavan固件临时刷机用吧：
https://opt.cn2qq.com/padavan/RT-AC54U-GPIO-1-PSG1208-64M_3.4.3.9-099.trx

搜到一个斐讯系列固件网盘下载地址,留着备用吧。
斐讯系列，MTK系列刷机，华硕老毛子padavan固件和OpwenWrt路由器固件等
http://ggdkd.ysepan.com/?xzpd=1

开启ssh或telnet刷入Breed

wget http://breed.hackpascal.net/breed-mt7620-phicomm-psg1208.bin
mtd_write write breed-mt7620-phicomm-psg1208.bin Bootloader

这个貌似用不到了，目前完全起不来，留着备用吧。

E1焊接TTL

拆机参考：https://www.right.com.cn/forum/thread-267083-1-1.html
先拆4颗螺丝，然后拿薄片四周一顿撬，趴开外壳就简单了，基本上就能看到TTL接头了。
这个E1的TTL接口有2个，任意一边都能使用，拆开外壳后，网口右下角这一块就是了。
从上往下的：RX/TX/GND/VCC
从右往左的：RX/TX/GND/VCC
ttl只需要焊接3根即可： RX/TX/GND，图上并未焊接VCC
杜邦线中间剪断，另外一头母头，直接插usb to ttl小板即可。
注意：上面标注的RX/TX是指TTL小板上的段子 如接错或者无数据，可以考虑对调TX/RX即可。

macos登录串口，windows更简单，网上一堆，不废话了。
注意，波特率为57600
刚开始我盲猜9600,115200都不行，最后搜录一下搜到k2的帖子，写的波特率为57600，然后就ok了

搜波特率的时候发现的这个k2 ttl刷机的文档，除了拆机接线不一样，后面的基本相似了：
https://blog.csdn.net/TeleostNaCl/article/details/126675764

命令行找到串口设备号：

ls /dev/tty*

登录串口
screen /dev/tty.usbserial-14140 57600
(screen 退出串口： ctrl+a, k)

ttl boot log:

U-Boot 1.1.3 ( - )

Board: Ralink APSoC DRAM:  64 MB
MT7620 gpio init : WPS / RESET pin
GPIO#1 updated GPIOMODE register: 001a311c -> 001a311d
relocate_code Pointer at: 83fa8000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29
spi device id: c8 40 17 c8 40 (4017c840)
Warning: un-recognized chip ID, please update bootloader!
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:  Time:
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes

Press press hardware button for more than 4 seconds to run web failsafe mode



Catution: hardware button wasn't pressed or not long enough!
Continuing normal boot...


Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   6: Load all then write to Flash via TFTP.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.


3: System Boot system code via Flash.
## Booting image at bc0a0000 ...
   Image Name:   OpenWrt-Linux-3.10.14
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1267333 Bytes =  1.2 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... Bad Data CRC

镜像不能启动了，Data CRC错误，不过既然uboot是好的，那就好解决了，先试试长按reset按键，直接默认uboot网页刷固件看看是否可行

U-Boot 1.1.3 ( - )

Board: Ralink APSoC DRAM:  64 MB
MT7620 gpio init : WPS / RESET pin
GPIO#1 updated GPIOMODE register: 001a311c -> 001a311d
relocate_code Pointer at: 83fa8000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29
spi device id: c8 40 17 c8 40 (4017c840)
Warning: un-recognized chip ID, please update bootloader!
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:  Time:
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes

Press press hardware button for more than 4 seconds to run web failsafe mode

reset buootn pressed!                                                                                                                                                                                                      1 second(s)reset buootn pressed!
reset buootn pressed!                                                                                                                                                                                                      2 second(s)reset buootn pressed!
reset buootn pressed!                                                                                                                                                                                                      3 second(s)reset buootn pressed!
reset buootn pressed!                                                                                                                                                                                                      4 second(s)reset buootn pressed!
reset buootn pressed!                                                                                                                                                                                                      5 second(s)reset buootn pressed!
reset buootn pressed!                                                                                                                                                                                                      6 second(s)reset buootn pressed!
reset buootn pressed!                                                                                                                                                                                                      7 second(s)reset buootn pressed!
reset buootn pressed!                                                                                                                                                                                                      8 second(s)reset buootn pressed!
reset buootn pressed!                                                                                                                                                                                                      9 second(s)reset buootn pressed!
reset buootn pressed!                                                                                                                                                                                                     10 second(s)reset buootn pressed!


hardware button was pressed for 10 seconds
HTTP server is starting for firmware update...



 NetTxPacket = 0x83FE4400

 NetRxPackets[0] = 0x83FE4A00

 NetRxPackets[1] = 0x83FE5000

 NetRxPackets[2] = 0x83FE5600

 NetRxPackets[3] = 0x83FE5C00

 NetRxPackets[4] = 0x83FE6200

 NetRxPackets[5] = 0x83FE6800

 NetRxPackets[6] = 0x83FE6E00

 NetRxPackets[7] = 0x83FE7400

 NetRxPackets[8] = 0x83FE7A00

 NetRxPackets[9] = 0x83FE8000

 NetRxPackets[10] = 0x83FE8600

 NetRxPackets[11] = 0x83FE8C00

 NetRxPackets[12] = 0x83FE9200

 NetRxPackets[13] = 0x83FE9800

 NetRxPackets[14] = 0x83FE9E00

 NetRxPackets[15] = 0x83FEA400

 NetRxPackets[16] = 0x83FEAA00

 NetRxPackets[17] = 0x83FEB000

 NetRxPackets[18] = 0x83FEB600

 NetRxPackets[19] = 0x83FEBC00

 NetRxPackets[20] = 0x83FEC200

 NetRxPackets[21] = 0x83FEC800

 NetRxPackets[22] = 0x83FECE00

 NetRxPackets[23] = 0x83FED400

 KSEG1ADDR(NetTxPacket) = 0xA3FE4400

 NetLoopHttpd,call eth_halt !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
HTTP server is starting at IP: 192.168.2.1
HTTP server is ready!

电脑手工设置网卡ip为192.168.2.10,这个是uboot默认值，后面uboot升级时就直接连接了，不需要修改默认参数了，然后浏览器访问192.168.2.1，打开e1自带的uboot更新固件的web界面，尝试传一个网上下载的原版固件：

 ETH_STATE_ACTIVE!!
HTTP server is starting at IP: 192.168.2.1
HTTP server is ready!

Request for: /
Request for: /style.css
Request for: /favicon.ico
## Error: file not found!
Request for: /
Request for: /style.css
Data will be downloaded at 0x80100000 in RAM
Upgrade type: sopimg
Upload file size: 8388608 bytes
Loading: #######################################
         #######################################

 ...
         #######################################
         ##############################

HTTP upload is done! Upgrading...


****************************
*    SOPIMG UPGRADING    *
* DO NOT POWER OFF DEVICE! *
****************************

Not found the header
## Error: HTTP ugrade failed!


 NetLoopHttpd,call eth_halt !
Trying Eth0 (10/100-M)

 ETH_STATE_ACTIVE!!
HTTP server is starting at IP: 192.168.2.1
HTTP server is ready!

报错了，提示Not found the header，不能升级，不折腾了，升级原版了还得root，然后再刷breed固件，索性直接uboot下更新breed即可

maos启用tftp server

Howto Start TFTP server on macOS
https://bacnh.com/howto-start-tftp-server-on-macos

sudo chmod -R 777 /private/tftpboot
cp ~/Downloads/phicom_e1/breed-mt7620-phicomm-psg1208.bin /private/tftpboot/breed.bin
sudo chmod -R 777 /private/tftpboot/breed.bin
sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plist


tftp -e 127.0.0.1
tftp> get breed.bin
Received 90581 bytes in 0.1 seconds
tftp> get breed1.bin
Error code 256: File not found
tftp> get breed.bin
Received 90581 bytes in 0.0 seconds
tftp> quit

然后再拨电源，再插电启动上电，因为拆机拆螺丝了，电源接头经常接触不良，导致板子不上电，于是我找了一个带开关的插排，把E1固定好，然后只需要按插排开关即可，避免来回插拨E1导致接触不良不上电。

通电以后，在ttl串口中按9，出现Y/N的提示时，先把breed放进tftp server根目录下再继续，然后通过uboot命令行刷入breed固件：

U-Boot 1.1.3 ( - )

Board: Ralink APSoC DRAM:  64 MB
MT7620 gpio init : WPS / RESET pin
GPIO#1 updated GPIOMODE register: 001a311c -> 001a311d
relocate_code Pointer at: 83fa8000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
******************************
Software System Reset Occurred
******************************
spi_wait_nsec: 29
spi device id: c8 40 17 c8 40 (4017c840)
Warning: un-recognized chip ID, please update bootloader!
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:  Time:
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes

Press press hardware button for more than 4 seconds to run web failsafe mode



Catution: hardware button wasn't pressed or not long enough!
Continuing normal boot...


Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   6: Load all then write to Flash via TFTP.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 9




9: System Load Boot Loader then write to Flash via TFTP.
 Warning!! Erase Boot Loader in Flash then burn new one. Are you sure?(Y/N)
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.2.1) ==:192.168.2.1
        Input server IP (192.168.2.10) ==:192.168.2.10
        Input Uboot filename () ==:breed.bin

 netboot_common, argc= 3

 NetTxPacket = 0x83FE4400

 KSEG1ADDR(NetTxPacket) = 0xA3FE4400

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
TFTP from server 192.168.2.10; our IP address is 192.168.2.1
Filename 'breed.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (c0:25:a5:d2:f5:62)
Got it
##################
done
Bytes transferred = 90581 (161d5 hex)
NetBootFileXferSize= 000161d5
.
blocksize write ok i=0!
.
Done!

Boot and Recovery Environment for Embedded Devices
Copyright (C) 2021 HackPascal <hackpascal@gmail.com>
Build date 2021-12-15 [git-f9b74d0]
Version 1.1 (r1337)

DRAM: 64MB
Platform: MediaTek MT7620A ver 2, eco 6
Board: Phicomm PSG1208 (K1)
Clocks: CPU: 580MHz, Bus: 193MHz
Flash: GigaDevice GD25Q64 (8MB) on rt2880-spi
rt2880-eth: Using MAC address 68:db:54:dd:28:35
eth0: MediaTek MT7620A built-in 5-port 10/100M switch

Network started on eth0, inet addr 192.168.1.1, netmask 255.255.255.0

Press any key to interrupt autoboot ... 2
Autoboot aborted due to key press.

Starting breed built-in shell

breed> help
Available commands:
about    - About this bootloader
abstatus - Interrupt status of autoboot
arp      - Display ARP table
autoboot - Detect firmware type and boot automatically
boot     - Boot firmware
btntst   - Test GPIO of buttons
dhcp     - Display DHCP leases
env      - Environment variables utility
envconf  - Configure environment variable block
exit     - Exit from telnet
flash    - Flash utility
gpio     - GPIO utilities
help     - Show available commands
mdio     - MDIO utility
mem      - Memory operation utilities
net      - Network control
netstat  - Display network state
reset    - Restart device
setbrg   - Set baudrate
spi      - SPI utility
sysinfo  - Display system information
thread   - Display all threads
wget     - Retrieval file through HTTP

breed> sysinfo
Platform: MediaTek MT7620A ver 2, eco 6
Board: Phicomm PSG1208 (K1)
Clocks: CPU: 580MHz, Bus: 193MHz
Relocate Offset: 03eba000

DRAM size: 64MB
DRAM range: 80000000 - 83ffffff

Kernel size: 274KB
Kernel range: 83fba000 - 83ffea6b

Kernel symbol table size: 1KB
Kernel symbol table range: 83fb99f0 - 83fb9ffa

Managed memory size: 2MB
Managed memory range: 83db98f0 - 83fb98ef
Managed memory used: 287.34KB (14.3%)

Boot parameter size: 256KB
Boot parameter range: 83d797f0 - 83db97ef

Unused memory size: 61MB
Unused memory range: 80000000 - 83d787ef

breed> about
Boot and Recovery Environment for Embedded Devices
Copyright (C) 2021 HackPascal <hackpascal@gmail.com>
Build date 2021-12-15 [git-f9b74d0]
Version 1.1 (r1337)

breed> netstat
Protocol    Local Address           Foreign Address         State
TCP         192.168.1.1:80          0.0.0.0:0               LISTENING
TCP         192.168.1.1:23          0.0.0.0:0               LISTENING

breed>

breed很快就刷完了，然后自动reboot，出现Press any key to interrupt autoboot … 提示时按任意键即可中止启动，进入breed提示符，然后电脑IP需要从192.168.2.10改成192.168.1.x任意地址，浏览器打开192.168.1.1，上传padavan固件， config使用公版，刷完自动重启即可。

后面基本就完事了，padavan刷完启动成功，wifi都ok了，救砖成功了。
不折腾了，拨电上螺丝，留着吃灰去了