Toshiba pcx2500

[drewmerc]

me i use a self built ft2232 usb jtag (based on the open source happyjtag 2) if i was recommending a jtag cable i'd say buy a bus blaster v2 http://www.seeedstudio.com/depot/bus-bla...?cPath=174 (toms jtag compatable & open ocd)
but people who do not understand jtag or just doing modems should stick with a usbjtagnt just for the support and ease of use

[Radiotubes]

I spent quite a bit of time on the Toshiba PCX2500. I was able to read and write to it through a simple buffered jtag adapter. Once I accidentally erased the firmware and disabled it for a time. I was able to recover from my error by reloading the old firmware from a backup I made. In order to read and write to it, I used HairyDairyMaid utility for routers. Specifically I used

HairyDairyMaid_WRT54G_Debrick_Utility_v48~cshore2.zip

. I had to edit some things in the source to get the 2500 detected. There was also some fiddling involved in the way the bytes were ordered to be able to write back to the modem. I would have to revisit all my efforts to figure out how I did this. You can monitor what is going on while the modem boots via a serial console. The connections available on the circuit board. I got as far as being able to decompress (not accurately) the firmware image to it's fill size. The compression routine is credited in F/W to Mark Adler who created zlib library and gzip. I fooled around with several de-compress routines, but never got consistent results. There's another modem out there that uses the Toshiba TNETC4401 chip and I think it's a D-Link DCM-202. There is a bit of information on this modem, but not much on ppl tinkering with it.

I would certainly enjoy getting into detail about the 2500, but my abilities to manipulate f/w is limited. I'm thinking it maybe as simple as changing a few bytes to get the modem to respond from a console. Then perhaps use the modem with a different MAC address?

[Radiotubes]

okay, I dug through my files and found the output of a console connection:

Code:

Cable Modem Image starter
Texas Instruments (C) 2002
Version 01.05d
Running image #2.
Trying to run default image
        Prefix address - B0100000       Found image CRC OK; Decompressing
...................................
Well, looks OK; Let's go
Target Name: vxTarget

Attached TCP/IP interface to emac unit 0
NFS client support not included.
CPU is PUMA
Board is Tansui
HW Revision is 9.2.3.1
SW Version is 2.0.12 (Build 07_11_02:1) - Creation Date/Time:  Nov  7 2002 / 11:
08:47

TNETC406: MIPS Core speed is 100.00 MHz (100 Ticks per second)
0x947ffdf0 (tRootTask): Loading RNDIS End Driver...
0x947ffdf0 (tRootTask): Memory setup complete
0x947ffdf0 (tRootTask): Configuring rndis2...
0x947ffdf0 (tRootTask): Done loading RNDIS END.
Installed MIPS exception handler

Initialized BBIF

                   ***********************************
                   **      Toshiba Corporation     ***
                   **   DOCSIS based Cable Modem   ***
                   ***********************************

USB_Init
0x947ffdf0 (tRootTask): After USB_Init

InitCB
init RNDIS CB
Attaching network interface lo0... done.
Power Table Initialization Complete
TxWDT: Installing Anti-Bubble protection...


>>>
-> -> ->
-> 0000001008:Trying to synchronize ...
0000001014:Scanning frequency 693000000Hz
0000001248:Downstream Locked - Collecting Upstream Information
0000001479:Starting Ranging On Channel 5
0000001553:SYNCHRONIZED - 693000000 Hz , ucd 5
0000001553:Trying to register through CMTS...
0000001965:DHCP - parameters acquired
0000002565:ToD request sent - No Response received
0000002712:Registration file - downloaded

Tlb Load Exception
Exception Program Counter: 0x941b96dc
Status Register: 0x00008c01
Cause Register: 0x10000008
Access Address : 0x3e00e617
Task: 0x946a80a0 "CMRT"
CM_Exp_handler - Exception
Task Trace:

Sorry, traces of my own stack begin at tt ().

Tasks states:
Show routine of this object not configured into system.

.
.
This was an old 2500 I bought at a thrift store...

[drewmerc]

this should be of use to you http://bitsum.com/firmware_mod_kit.htm you may have to play with the source a bit
but it should help you play with the firmware

[Radiotubes]

How nice It's developed for Linux! Just was I was hoping for.