华三 h3c wb521x-e cpe无线客户端 拆机 刷路由，AP
本帖最后由 7486060 于 2015-4-5 15:26 编辑*****************************************************************
* *
* H3C WB521X-E BOOTROM, Version 0.1.0.8 *
* *
*****************************************************************
Copyright (c) 2013-2014 Hangzhou H3C Technologies Co., Ltd.
All rights Reserved.
Creation Date : Feb 13 2014, 10:55:52
CPU Type : MIPS
CPU Cores : 1
CPU Clock : 560MHz
DDR Size : 64 MB
DDR Clock : 400MHz
Flash Size : 16 MB
SDRAM selftest ..............................................OK!
Switch chip selftest ........................................OK!
PHY selftest ................................................OK!
The Device MAC is: 70:f9:6d:65:b8:88
Press Ctrl+B to enter Boot Menu.... 0
Password:***谁知道这个密码是多少 boot menu密码，试了好多都进不去，
Password:***
Password:
Error Password!
Use Image_1 to boot ...
Loading Image To Ram, Size=5795840 Bytes ............................................................................................
Verify Image...OK
Decompress Image...
<H3C>?
reboot Reboot device
restore Restore configuration
password Set administrator's password
ip Display the IP configuration
display Display current information
ping Ping function
admin Admin the LAN interface
<H3C>
CPU是AR9341
用TTL线连接好无法启动，然后找出原因，WB521X-E 端TX线先不能接(可能是TTL转接卡的问题，通电立马按 Ctrl+B（Press Ctrl+B to enter Boot Menu.... 0）接上RX线(TTL转接卡RX)，可进boot menu 但不知道boot menu 密码
TTL可正常使用 波特率：9600
老款华三 WB521X固件 H3C WB521XV100R004下载:http://pan.baidu.com/s/1ffJjw和wb521X-e不通用
下(图片)上设备原厂编程器固件下载：华三 h3cwb521x-e cpe无线客户端 下载地址 ：http://pan.baidu.com/s/1qW7J1rI
本设备是湖北移动的无线接入宽带的客户端设备，装在用户家楼顶上对准移动铁塔（基站）.宽带质量可比FTTH，故障低，好于ADSL，FTTB等
补充内容 (2015-4-8 20:36):
*****************************************************************
* *
* H3C WB521X-E BOOTROM, Version 0.1.0.8 *
* *
*****************************************************************
Copyright (c) 2013-2014 Hangzhou H3C Technologies Co., Ltd.
All rights Reserved.
Creation Date : Feb 13 2014, 10:55:52
CPU Type : MIPS
CPU Cores : 1
CPU Clock : 560MHz
DDR Size : 64 MB
DDR Clock : 400MHz
Flash Size : 16 MB
SDRAM selftest ..............................................OK!
Switch chip selftest ........................................OK!
PHY selftest ................................................OK!
The Device MAC is: 70:f9:6d:65:b8:88
Press Ctrl+B to enter Boot Menu.... 0
Password:
BOOT MENU
1. TFTP download application file to flash
2. Serial Port download application file to flash
3. Modify bootrom password
0. Reboot system
Enter your choice(0-3):1
Local IP Address <192.168.1.2>:
Server IP Address <192.168.1.66>:
Netmask <255.255.255.0>:
File Name:
File name null!
TFTP update fail.
BOOT MENU
1. TFTP download application file to flash
2. Serial Port download application file to flash
3. Modify bootrom password
0. Reboot system
Enter your choice(0-3):1
Local IP Address <192.168.1.2>:
Server IP Address <192.168.1.66>:
Netmask <255.255.255.0>:
File Name:all
Are you sure to download file to flash? Yes or No(y/N)y
You can cancel download with pressing Ctrl-C before erasing flash.
eth0 link down
eth1 link down
Using eth0 device
TFTP from server 192.168.1.66; our IP address is 192.168.1.2
Filename 'all'.
Load address: 0x80060000
Loading: *
Abort
TFTP update fail.
BOOT MENU
1. TFTP download application file to flash
2. Serial Port download application file to flash
3. Modify bootrom password
0. Reboot system
Enter your choice(0-3):
Are you sure to test your equipment? Yes or No(y/n)n
BOOT MENU
1. TFTP download application file to flash
2. Serial Port download application file to flash
3. Modify bootrom password
0. Reboot system
Enter your choice(0-3):
Are you sure to test your equipment? Yes or No(y/n)
BOOT MENU
1. TFTP download application file to flash
2. Serial Port download application file to flash
3. Modify bootrom password
0. Reboot system
Enter your choice(0-3):
Are you sure to test your equipment? Yes or No(y/n)y
Password:
ar7240> ?
? - Alias for 'help'
autoscr - autoscr - run script from memory
base - base - print or set address offset
bdinfo- bdinfo- print Board Info structure
boot - boot - boot default, i.e., run 'bootcmd'
bootd - bootd - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootkernel- Boot from a kernel ELF image in memory
bootm - bootm - boot application image from memory
bootvx- Boot vxWorks from an ELF image
cfg - config manufactor data in FLASH memory.
checkimg- check img, and get kernel_size .
cmp - cmp - memory compare
coninfo - coninfo - print console devices and information
cp - cp - memory copy
crc32 - crc32 - checksum calculation
debug - switch on/off debug flag.
dhcp - dhcp- invoke DHCP client to obtain IP/boot params
download- download manuinfo macaddr/manucode xxxxxxxxx
echo - echo args to console
erase - erase FLASH memory
ethreg- ethreg - S26 PHY Reg rd/wrutility
flinfo- print FLASH memory information
go - go - start application at address 'addr'
gphyreg - Read Phy register
help - print online help
iminfo- iminfo- print header information for application image
itest - itest - return true/false on integer compare
loadb - loadb - load binary file over serial line (xmodem mode)
loop - loop - infinite loop on address range
md - md - memory display
memtest - memtest ddr
mii - mii - MII utility commands
mm - mm - memory modify (auto-incrementing)
modpwd- modify super password
mtest - mtest - simple RAM test
mw - mw - memory write (fill)
nfs - nfs - boot image via network using NFS protocol
nm - nm - memory modify (constant address)
pci - pci - list and access PCI Configuration Space
ping - ping- send ICMP ECHO_REQUEST to network host
pll - pll cpu-pll dither ddr-pll dither - Set to change CPU & DDR speed
pll erase
pll get
printenv- print environment variables
protect - enable or disable FLASH write protection
reset - reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv- set environment variables
sleep - sleep - delay execution for some time
sphyreg - Write Phy register
srifpll - srifpll cpu-pll ddr-pll - To change CPU & DDR speed through srif
srifpll erase
srifpll get
test - test equipment
tftpboot- tftpboot- boot image via network using TFTP protocol
version - print monitor version
ar7240>
补充内容 (2015-4-8 20:45):
Boot Menu 密码是：WB521X-E注意大写
进入boot menu 后按 1. TFTP download application file to flash 一直回车
提示错误，后回到 boot menu菜单 按ctrl+T 选 Y 就直接进入CFE ar7240> 命令行了
补充内容 (2015-4-9 00:14):
ar7240> print
bootargs=console=ttyS0,9600;rootfstype=squashfs;init=/sbin/init;mtdparts=ath-nor0:256k(boot),64k(manu-data),64k(ART),64k(exp-save),64k(boot-ker-com),7168k(kernel-rootfs1),7168k(kernel-rootfs2),1536k(jffs2)
bootcmd=cp.b 0x9F080000 0x8006FF60 ${first_load_size};checkimg 0x8006FF60;go 80070000;bootkernel 0x82b00000 root=/dev/mtdblock6 loglevel=KERN_ERR
bootcmd2=cp.b 0x9F780000 0x8006FF60 ${first_load_size};checkimg 0x8006FF60;go 80070000;bootkernel 0x82b00000 root=/dev/mtdblock7 loglevel=KERN_ERR
bootdelay=2
baudrate=9600
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.2
serverip=192.168.1.66
netmask=255.255.255.0
ramdisk=tftp 80060000 zImage.initrd;go 80070000;bootkernel 0x82b00000 root=/dev/ram0
artdisk=tftp 80060000 art.initrd;go 80070000;bootkernel 0x82b00000 root=/dev/ram0 loglevel=KERN_ERR
artdisk1=tftp 80060000 wb521x-e_art.initrd;go 80070000;bootkernel 0x82b00000 root=/dev/ram0 loglevel=KERN_ERR
nuke_env=protect off 0x9F040000 0x9F04FFFF;erase 0x9F040000 +0x10000
autoload=n
burn_uboot=tftp 0x80060000 u-boot-wb521x-e.bin;erase 0x9F000000 +0x40000;cp.b 0x80060000 0x9F000000 0x40000
burn_img=tftp 0x80060000 WB521X-E.img;protect off 0x9F000000 0x9FFFFFFF;erase 0x9F000000 +0x1000000;cp.b 0x80060000 0x9F000000 0x1000000
burn_art=tftp 0x80060000 def-art-info;erase 0x9F050000 +0x10000;cp.b 0x80060000 0x9F050000 0x10000
HW_VER=VER.A
HW_BOT_VER=0.1.0.8
HW_SER_CONTROL=0xdeadbeef
HW_NAME=WB521X-E
HW_EXP_SAVE=0x00
TWOIMG_MODE=1
ethact=eth0
MAC_ADDR=70:F9:6D:65:B8:88
HW_SERIES_NUM=219801A0KP9146Q02413
HW_BOOT_PASSWORD=
HW_TEST_PASSWORD=
stdin=serial
stdout=serial
stderr=serial
补充内容 (2015-4-10 00:47):
补充内容 (2015-4-8 20:45):
Boot Menu 密码是：WB521X-E注意大写
进入boot menu按ctrl+t 先选n 再按ctrl+t先y输入WB521X-E可进入uboot ar7240> 命令行了 mstalent 发表于 2017-4-14 22:58
大神不敢称，可以交流交流，企鹅号⑤④⑤⑥⑦①⑤⑨①
特來感謝mstalent網友，提供的原廠固件，用編程器成功救回變磚的WB521X-E。還有一個問題就是要不要提取我之前設備固件內的ART文件整入到新的固件中，這個WB521X-E刷什麼固件可以實現發射和接受功能。 怎么拆开的。。我有个ubnt M5都不知道怎么拆 这个是CPE么? 寿司 发表于 2015-2-19 13:08
怎么拆开的。。我有个ubnt M5都不知道怎么拆
来来来我替你拆 hope.. 发表于 2015-2-19 13:24
来来来我替你拆
拆开了。进水了。。。M5不知道还能不能用 看上去不错的主板啊 寿司 发表于 2015-2-19 13:40
拆开了。进水了。。。M5不知道还能不能用
送我啊，邮费到付 hope.. 发表于 2015-2-19 20:06
送我啊，邮费到付
丢了。今天。 寿司 发表于 2015-2-20 00:41
丢了。今天。
:(:(:(:(:(:(:(:( 飘_絮 发表于 2015-2-19 13:17
这个是CPE么?
湖北移动2.4G无线接入宽带设备CPE
不错，能否用ubnt代替它接收移动宽带信号呢？ 小行星 发表于 2015-2-26 20:47
不错，能否用ubnt代替它接收移动宽带信号呢？
大功率网桥，大功率无线网卡都可以吧