Thompson/RCA DCM425C Flashing -- Linux snmp bash script

[drewmerc]

one of these cables http://www.ebay.com/sch/i.html?_trkparms...p=15&_sc=1

[Radiotubes]

You know you can use one section of an MC1489 (quad level converter) hooked up to your SERIAL port that your computer *should* have. An MC1489 will cost you about 25 cents. Here's a SB5100 with one mounted:


.
.You only need to monitor the Tx line out of the DCM425 to accomplish the flashing.

[GBABY4201]

I used what is known as a serial cable. It has a level shifting chip on it such as a MAX232 or MAX233 that converts the voltages to ttl levels. You only have to hook this up to monitor the console (UART) output so you know when to short the flash pins and put the modem into emergency state. The actual programming is done over the ethernet cable via tftp.

radio tubes what are you grounding on for the pins??? is it a flash chip not the ram chip right??

[Radiotubes]

radio tubes what are you grounding on for the pins??? is it a flash chip not the ram chip right??

Pin 7 on the MC1489 is ground. On my example, I bent the pin over and found a convenient ground point on the board. I then soldered the pin to the ground point Here's a schematic of the circuit I drew for the SB5100 / MC1489 connections. This gives you a serial console output as drew mentioned in another thread.

[usitsupport]

This is my DCM425, where is the serial port? I have fried one USB TTL already.
   

[drewmerc]

[usitsupport]

Thank you drewmerc. I switched the Vcc with GND in my earlier attempt and fried my earlier USB TTL.

Anyway, Now I managed to get to the console, but never managed to get the "p" options to response. I do get the full menu after umpteen times (maybe 30 times) by shorting pin 1 & 2 of flash. I got to "CM/DocsisCtl>" and issued:

dload -i1 192.168.100.TFTPServerIP haxorware11rev39-DIAG.bin

The Solarwinds TFTP server keep saying:
binary, get file name: X:\haxorware11rev39-DIAG.bin, file 1181284
binary, dropped because peer didn't response.
(firewall is off)

FYI: help listing
CM/DocsisCtl> help
Instance: Console Thread (0x807db2ac)
! ? REM cd dir
find_command help history instances ls
man pwd sleep syntax system_time
usage
----
ClearCmCert binarySfid bpiShow cfg_hex_show cfg_tlv_show
clear_image comp_mac_to_phy comp_phy_to_mac copy_image dload
dload_all dsdiag dsx_show dump_flash goto_ds
goto_us igmpShow ip_initialize ip_show log_messages
map_debug modem_caps rate_shaping_enable rng_rsp
scan_stop showFlows state stop_download ucdShow
ucddiag up_dis us_phy_oh_show usdiag
----


Any suggestions? Thanks again.

[jmoney27288]

I recently flashed a DCM425C with Haxorware. It was rather easy. I'm certain most of us can find the basic steps for doing this in windows, however, I use a a real operating system called Linux .

Basically you get the modem into "emergency state" with all lights flashing. I did this with a little push button (momentary on) switch connected between pins one and two of the flash memory chip. I connected up my serial adapter to the modem header pins and monitored the console output in minicom. I pressed my little shorting button as the "dots" got to the last "s" in address.

address
..........

If you do it right and at the correct time, all the lights on the modem will be flashing.

I connected the modems ethernet to a NIC on my computer and configured the NIC to an IP of:
192.168.100.10 netmask 255.255.255.0 via ifconfig. I pinged the modem on 192.168.100.1 to be certain it answered.

Most Linux distro's have a tftp server. Read the man pages if you don't know how to use it! I put the firmware "haxorware.bin" in my tftpboot folder along with the bash script posted below. I started up the tftp server and ran the bash script. Once the script was complete, I rebooted the modem et voila! Haxorware!

Code:

# !/bin/bash

# This is the Linux bash script for putting a DCM425C modem into factory mode then configuring
# it for a firmware upload "haxorware.bin" via tftp.  It is based on a bat script written for
# winblows that can be found around the net.
# Search for "How to Flash DCM425 any version !!With one Click!!"

list=(
   "snmpset -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.1.2.1.2.1 s password"  
   "snmpget -v2c -c public 192.168.100.1 1.3.6.1.2.1.1.1.0"  
   "snmpwalk -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.2.4.2.2.2"  
   "snmpset -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.2.4.2.2.2.1.0 i 1"  
   "snmpset -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.2.4.2.2.2.2.0 a 192.168.100.10"  
   "snmpset -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.2.4.2.2.2.3.0 s haxorware.bin"  
   "snmpset -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.2.4.2.2.2.4.0 i 1"  
   "snmpset -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.2.4.2.2.2.5.0 i 1"  
   "snmpset -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.2.4.2.2.2.6.0 i 2"  
   "snmpwalk -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.2.4.2.2.2"  
   "snmpset -v2c -c public 192.168.100.1 1.3.6.1.4.1.4413.2.99.1.1.2.4.2.2.2.6.0 i 1"
   )

for i in "${list[@]}"
do
#echo "$i"
read -sp "Press ENTER to continue..."
$i
done

can u show me the pins you hook ur button 2

[drewmerc]

can u show me the pins you hook ur button 2

[jmoney27288]

thank u

---

does tftp tell u it sent firmware