EEVblog #978 - Keysight 1000X Hacking

[sprit]

Thanks Bud, i'll do it rn

[sprit]

Code: [Select]

p500> printenv
ramboot=dhcp 0x4000000 nk.bin;bootm 0xf8050000
baudrate=115200
serverip=192.168.1.10
gatewayip=192.168.1.10
netmask=255.255.255.0
usbtty=cdc_acm
splashdata=0xd0000000
dispParm1=0x300 0x400 0x2625A00 0x1 0x3
dispParm2=0x20 0x4c 0x1 0x2 0x3
boardversion=4
ps=0
rtc=0
erase_env=protect off 1:4;erase 1:4
store_uboot=protect off 1:1-3;erase 1:1-3;cp.b 0x800000 0xF8010000 ${filesize};protect on 1:1-3;imi 0xF8010000
get_uboot_eth=dhcp 0x800000 u-boot_image.bin;run store_uboot
get_uboot_uart=loadb 0x800000 115200;run store_uboot
ethaddr=00:03:d3:04:10:00
serialnum=serial number not programmed
ethact=unknown
ecc=4
stdin=serial
stdout=serial
stderr=serial
guid=0A1B6C88-4F07-459A-8BAD-F20000A04EC2
bootdelay=3
bootaddr=0x700
loadaddr=0x00800000
fileaddr=0x00800000
chipversion=BD
nimages=2
image1=0xd0600000
image2=0xd1e00000
fpgadata=0xd0060000
fimage=1
pbootdelay=3
numfilesystems=2
lengthfilesystem1=0x2800000
lengthfilesystem2=0x2800000
fsstart=0x02e00000
bootCeFlash=bootm 0xf8050000
bootcmd=run bootMarsupial
bootJackal=run keyrst;run bootCeFlash
bootMarsupial=run bootCeFlash
preboot=fpga; expi 62500
keyrst=mw d8100400 6 1;mw d8100008 0 1;mw d8100008 2 1
fpgasize=45480
loadComplete=2019-07-11 1344
verify=n
ipaddr=192.168.1.100
filesize=45480

Environment size: 1249/16380 bytes
p500> crc 0x60000 0x45480
CRC32 for 00060000 ... 000a547f ==> b7f7bed9
p500>After uploading the fpga file using the loady command, I calculated the image crc and the bin file I used to upload, the CRC code was not the same. Or is it because I uploaded to the wrong location or my crc command is wrong?

In uboot's help command I couldn't find any comparable command.
I will attach the code above for your reference.

[sprit]

here is image of them

[sprit]

I thought I was done. After rummaging around in the old pboot to find the compare command, I thought if I could edit the pboot, and tadaaaaaaa, after uploading the pbootddr file, I had the compare command that Bud pointed out. Now I will try to compare them

Code: [Select]

p500> loady 0x00361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/6(STX)/0(CAN) packets, 9 retries
## Total Size      = 0x0000153a = 5434 Bytes
p500> ?
?       - alias for 'help'
adc     - performs A/D conversion on channel
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cdp     - Perform CDP network configuration
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
editenv - edit environment variable
erase   - erase FLASH memory
expi    - program EXPI Clock
flinfo  - print FLASH memory information
fpga    - loadable FPGA image support
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
go      - start application at address 'addr'
help    - print command description/usage
hwreset - Perform HW RESET of the CPU
icache  - enable or disable instruction cache
iminfo  - print header information for application image
imls    - list all images found in flash
imxtract- extract a part of a multi-image
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
ls      - list files in a directory (default /)
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
rtc     - print time from RTC
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
saves   - save S-Record file over serial line
setenv  - set environment variables
sleep   - delay execution for some time
source  - run script from memory
splash  - load splash image on display
tftpboot- boot image via network using TFTP protocol
version - print monitor version
p500>

[sprit]

Code: [Select]

p500> cmp 0x800000 0x60000 0x
Total of 0 words were the same
p500>
I don't know if this is correct?

[sprit]

Here is the pboot output when I bypass uboot

Code: [Select]

********* Image 1  *******************O
BL_IMAGE_TYPE_BIN

X
XXXXOOORewrite recommended, internal ECC corrected data at 0xc57
OXXOORewrite recommended, internal ECC corrected data at 0xc88
ORewrite recommended, internal ECC corrected data at 0xc94
OOORewrite recommended, internal ECC corrected data at 0xcc0
OOXOXOOORewrite recommended, internal ECC corrected data at 0xd1c
OOORewrite recommended, internal ECC corrected data at 0xd59
OOXOOOXORewrite recommended, internal ECC corrected data at 0xdb4
ORewrite recommended, internal ECC corrected data at 0xdbb
OOXXXRewrite recommended, internal ECC corrected data at 0xdea
OOOOOOOORewrite recommended, internal ECC corrected data at 0xe7a
OXORewrite recommended, internal ECC corrected data at 0xea3
OOOXOXOXRewrite recommended, internal ECC corrected data at 0xf03
OXXOXOXOXOXXXXORewrite recommended, internal ECC corrected data at 0xf67
OXXXORewrite recommended, internal ECC corrected data at 0xf8c
Rewrite recommended, internal ECC corrected data at 0xf94
ORewrite recommended, internal ECC corrected data at 0xfab
OORewrite recommended, internal ECC corrected data at 0xfc8
OOXXRewrite recommended, internal ECC corrected data at 0xff6
OXXRewrite recommended, internal ECC corrected data at 0x1003
OXXXXXXOORewrite recommended, internal ECC corrected data at 0x1032
OXXXOOXXRewrite recommended, internal ECC corrected data at 0x1071
OOXXXOXXRewrite recommended, internal ECC corrected data at 0x109f
OORewrite recommended, internal ECC corrected data at 0x10c3
OOXOOXXOOXOXRewrite recommended, internal ECC corrected data at 0x113c
ORewrite recommended, internal ECC corrected data at 0x1152
Rewrite recommended, internal ECC corrected data at 0x1156
OOOXRewrite recommended, internal ECC corrected data at 0x1193
OXOOOOOXRewrite recommended, internal ECC corrected data at 0x1211
Rewrite recommended, internal ECC corrected data at 0x1212
OOOXOOXOXXRewrite recommended, internal ECC corrected data at 0x1275
OXOXXXXXXOXXXXOOOXOOOXOXOOOOXOORewrite recommended, internal ECC corrected data at 0x137a
OOXOXOXOOOOOOX
Rewrite recommended, internal ECC corrected data at 0x1421
Rewrite recommended, internal ECC corrected data at 0x1424
OORewrite recommended, internal ECC corrected data at 0x1453
OXODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 82 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A84978  Name="" Target=RAM
******************************************************
Image at 0xd0600000 is not valid
*******************************************************

********* Image 2  *******************
BL_IMAGE_TYPE_UNKNOWN

******************************************************
Image at 0xd1e00000 is not valid
*******************************************************

P500 Boot Loader Configuration :

Mac address .......... (00:03:D3:04:10:00)
Ip address ........... (192.168.1.100)
Subnet Mask address .. (255.255.255.0)
DHCP ................. (Enabled)
Boot delay (seconds).. (3)
Load image 1 at startup

Image addresses. (0xdxxxxxxx for NAND, 0x8xxxxxxx for RAM)
        1 (0xd0600000)
        2 (0xd1e00000)

l) Load memory resident image Load image 1 now
1) Load memory resident image 1 now
2) Load memory resident image 2 now
3) Load memory resident image 3 now
d) Download from platform builder now
u) Start u-boot by resetting
v) Verify Images
>

Something is happening at 0x600000, do I have to re-upload the nk.bn0 file and compare? Damn, uart is so slow

[sprit]

Hope it can beat...

[sprit]

the moment of truth.

update: its stucked...

[Bud]

You are too fast, I do not follow what you re doing.

I checked my archive and it is required to load fpga existing image from NAND into RAM first, before you can run CRC check on it or compare it with newly transferred image. This is a breakdown of what needs to be done and the commands to do it.

'=======
Load fpga1000a.bin from computer into EDUX address 900000 using loady Y-modem command
Check that the CRC of the uploaded file matches that of on the computer
Read the existing FPGA image from NAND into RAM address 800000
Optionally run the CRC check on it to see if the CRC is matching the newly uploaded image
Compare the two images using cmp command
If the existing image is corrupt (CRC do not match), run fpga load command to load the new uploaded image from address 900000 into the fpga chip.
Proceed to booting the scope firmware.
'=========

p500> loady 900000 115200
p500> crc 900000 45480

p500> nand read 800000 60000 45480
p500> crc 800000 45480

p500> cmp 800000 900000 45480

p500> fpga 900000 45480

p500> run bootcmd

'===
If the scope  booted successfully, immediately run software update through the Utility menu. Reboot normally and do not stop Uboot.

[sprit]

Code: [Select]

U-Boot 2010.03 (May 18 2017 - 11:28:22)Agilent P500

CPU:   SPEAr600
DRAM:  128 MiB
Flash: 512 KiB
NAND:  internal ecc 128 MiB
In:    serial
Out:   serial
Err:   serial
SerNum:serial number not programmed
Chip:  BD Board Rev: 4
Net:   unknown
failed: 5 0
Could not copy from NAND offset 0x60000. Error -74 With ECC
FPGA programming FAILED!
Press space to stop autoboot: 2
p500>  loady 900000 115200
## Ready for binary (ymodem) download to 0x00900000 at 115200 bps...
CCCxyzModem - CRC mode, 1(SOH)/278(STX)/0(CAN) packets, 4 retries
## Total Size      = 0x00045480 = 283776 Bytes
p500> crc 900000 45480
CRC32 for 00900000 ... 0094547f ==> 5f15252c
p500> nand read 800000 60000 45480

NAND read: device 0 offset 0x60000, size 0x45480
 283776 bytes read: OK
p500>  crc 800000 45480
CRC32 for 00800000 ... 0084547f ==> 9cca83d7
p500> cmp 800000 900000 45480
word at 0x00801070 (0x00008000) != word at 0x00901070 (0x00000000)
Total of 1052 words were the same
p500> fpga 900000 45480
p500> run bootcmd
## Booting kernel from Legacy Image at f8050000 ...
   Image Name:   PBOOT
   Created:      2015-10-29   8:22:14 UTC
   Image Type:   ARM Linux Kernel Image (gzip compressed)
   Data Size:    37935 Bytes = 37 KiB
   Load Address: 00000000
   Entry Point:  00000000
   Uncompressing Kernel Image ... OK

Starting kernel ...


Debug serial initialized ........OK
RTC: 2024-24-12   7:88:115.48 UTC

Microsoft Windows CE Bootloader Common Library Version 1.4 Built Oct 29 2015 01:39:04
Microsoft Windows CE 6.0 Ethernet Bootloader for the Agilent P500 board
Adaptation performed by Agilent Technologies (c) 2008

PHY not found.

Press [ENTER] to launch image stored in flash or [SPACE] to cancel.
Initiating image launch in   0 seconds
System ready!
Preparing for download...
RTC: 2024-24-12   7:88:115.53 UTC
 Loading image 1 from memory at 0xD0600000
O
BL_IMAGE_TYPE_BIN

X
XXXXOOOOXXOOOOORewrite recommended, internal ECC corrected data at 0xcb1
ODeCompressFlash: CeCompressDecode() failed
 CeDecompressFlashBlock failed
****** Data record 7 corrupted, ABORT!!! ******

Completed file(s):
-------------------------------------------------------------------------------
[0]: Address=0x80361000  Length=0x1A84978  Name="" Target=RAM
 Loading image 1 failed, trying next one
 Loading image 2 from memory at 0xD1E00000

BL_IMAGE_TYPE_UNKNOWN

 Loading image 2 failed, trying next one
 All images failed

Press r to reset

here is the output, but images still load fail...

[sprit]

When comparing the output of the two files, I found that their crc32 did not match.

Code: [Select]

p500> crc 900000 45480
CRC32 for 00900000 ... 0094547f ==> 5f15252c
p500> nand read 800000 60000 45480

NAND read: device 0 offset 0x60000, size 0x45480
 283776 bytes read: OK
p500> crc 800000 45480
CRC32 for 00800000 ... 0084547f ==> 9cca83d7
p500> cmp 800000 900000 45480
word at 0x00801070 (0x00008000) != word at 0x00901070 (0x00000000)
Total of 1052 words were the sameBooting also failed. Should I try loading the nk.bn0 file first and then run the load fpga command?

[sprit]

edit: when I use the command "fpga 900000 45480" I can hear the relay clicking, is that good news?
The crc32 of the file I uploaded to RAM matches the crc32 on the computer but does not match what is on the NAND.

[Bud]

That means your fpga image in NAND is corrupt. Yes clicking is ok. If you do not get any error messages when doing fpga load command, the fpga loaded properly.

And your main firmware is also corrupt. So i recommend load fpga from serial first (you can skip loading the existing image from NAND as it is now clear it is corrupt), then load the nk bin from serial and do   go 0x00362000 command.

[sprit]

Thank you Bud
So now I will load the FPGA image to address 800000 with the command loady 800000 11520 or loady 900000?

[Bud]

Does not matter, just use the same address after that when loading the fpga.

[sprit]

so the progress will be:
l

Code: [Select]

oady 900000 115200
fpga 900000 45480
loady 0x00361000 115200
go 0x00362000?
I'm wondering if this is the first one with both NAND and FPGA failures lol

[Bud]

It is the same NAND chip.

[sprit]

God bless me... I hope it can pass...

[sprit]

Im done, its still cant boot

Code: [Select]

p500> loady 900000 115200
## Ready for binary (ymodem) download to 0x00900000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/278(STX)/0(CAN) packets, 3 retries
## Total Size      = 0x00045480 = 283776 Bytes
p500> loady 0x00361000 115200
## Ready for binary (ymodem) download to 0x00361000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/27158(STX)/0(CAN) packets, 3 retries
## Total Size      = 0x01a857c0 = 27809728 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...
Windows CE Kernel for ARM (Thumb Enabled) Built on Mar  8 2013 at 17:05:33
Setting up for a Cold Reboot
Done Setting up for a Cold Reboot
Windows CE Firmware Init
BSP 1.0.0 for the SPEARHEAD600AB board (built Jun 10 2019)
Adaptation performed by ADENEO (c) 2005
+OALIntrInit
-OALIntrInit(rc = 1)
Initialize driver globals Zeros area...
pDrvGlobalArea 0xa0060000  size 0x800 (0xa0060800 -0xa0060000)
Initialize driver globals Zeros area...done
 OALKitlStart
Firmware Init Done.
OALIoctlHalEnterI2cCriticalSection init i2c cs
++SER_Init: context Drivers\Active\14
SER_Init, dwIndex:2
SER2 got sysintr:0x00000017
SER2 Serial Port, new baud rate:0x1c200  (UARTCLK:48000000 IBRD:0x1a FBRD:0x2)
Incorrect Data, interal ECC failed at 0xc0
Incorrect Data, interal ECC failed at 0xc1
Incorrect Data, interal ECC failed at 0xc2
Incorrect Data, interal ECC failed at 0xc3
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xc4
Rewriting Block at Sector Address 0xc4. 1656
Incorrect Data, interal ECC failed at 0xc0
Incorrect Data, interal ECC failed at 0xc1
Incorrect Data, interal ECC failed at 0xc2
Incorrect Data, interal ECC failed at 0xc3
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xc4
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xc5
Incorrect Data, interal ECC failed at 0xc6
Incorrect Data, interal ECC failed at 0xc7
Incorrect Data, interal ECC failed at 0xc8
Incorrect Data, interal ECC failed at 0xc9
Incorrect Data, interal ECC failed at 0xca
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xcb
Incorrect Data, interal ECC failed at 0xcc
Incorrect Data, interal ECC failed at 0xcd
Incorrect Data, interal ECC failed at 0xce
Incorrect Data, interal ECC failed at 0xcf
Incorrect Data, interal ECC failed at 0xd0
Incorrect Data, interal ECC failed at 0xd1
Incorrect Data, interal ECC failed at 0xd2
Incorrect Data, interal ECC failed at 0xd3
Incorrect Data, interal ECC failed at 0xd4
Incorrect Data, interal ECC failed at 0xd5
Incorrect Data, interal ECC failed at 0xd6
Incorrect Data, interal ECC failed at 0xd7
Incorrect Data, interal ECC failed at 0xd8
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xd9
Incorrect Data, interal ECC failed at 0xda
Incorrect Data, interal ECC failed at 0xdb
Incorrect Data, interal ECC failed at 0xdc
Incorrect Data, interal ECC failed at 0xdd
Incorrect Data, interal ECC failed at 0xde
Incorrect Data, interal ECC failed at 0xdf
Incorrect Data, interal ECC failed at 0xe0
Incorrect Data, interal ECC failed at 0xe1
Incorrect Data, interal ECC failed at 0xe2
Incorrect Data, interal ECC failed at 0xe3
Incorrect Data, interal ECC failed at 0xe4
Incorrect Data, interal ECC failed at 0xe5
Incorrect Data, interal ECC failed at 0xe6
Incorrect Data, interal ECC failed at 0xe7
Incorrect Data, interal ECC failed at 0xe8
Incorrect Data, interal ECC failed at 0xe9
Incorrect Data, interal ECC failed at 0xea
Incorrect Data, interal ECC failed at 0xeb
Incorrect Data, interal ECC failed at 0xec
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0xed
Incorrect Data, interal ECC failed at 0xee
Incorrect Data, interal ECC failed at 0xef
Incorrect Data, interal ECC failed at 0xf0
Incorrect Data, interal ECC failed at 0xf1
Incorrect Data, interal ECC failed at 0xf2
Incorrect Data, interal ECC failed at 0xf3
Incorrect Data, interal ECC failed at 0xf4
Incorrect Data, interal ECC failed at 0xf5
Incorrect Data, interal ECC failed at 0xf6
Incorrect Data, interal ECC failed at 0xf7
Incorrect Data, interal ECC failed at 0xf8
Incorrect Data, interal ECC failed at 0xf9
Incorrect Data, interal ECC failed at 0xfa
Incorrect Data, interal ECC failed at 0xfb
Incorrect Data, interal ECC failed at 0xfc
Incorrect Data, interal ECC failed at 0xfd
Incorrect Data, interal ECC failed at 0xfe
Incorrect Data, interal ECC failed at 0xff
Read Block FAILED 1954
Erased Block SUCCEEDED 1956
Completed rewriting Block SUCCEEDED 2004
Incorrect Data, interal ECC failed at 0xc6
Incorrect Data, interal ECC failed at 0xca
Incorrect Data, interal ECC failed at 0xd0
Incorrect Data, interal ECC failed at 0xd2
Incorrect Data, interal ECC failed at 0xd3
Incorrect Data, interal ECC failed at 0xd5
Incorrect Data, interal ECC failed at 0xd6
Incorrect Data, interal ECC failed at 0xd7
Incorrect Data, interal ECC failed at 0xd8
Incorrect Data, interal ECC failed at 0xda
Incorrect Data, interal ECC failed at 0xdd
Incorrect Data, interal ECC failed at 0xde
Incorrect Data, interal ECC failed at 0xdf
Incorrect Data, interal ECC failed at 0xe0
Incorrect Data, interal ECC failed at 0xe1
Incorrect Data, interal ECC failed at 0xe2
Incorrect Data, interal ECC failed at 0xe6
Incorrect Data, interal ECC failed at 0xe7
Incorrect Data, interal ECC failed at 0xe8
Incorrect Data, interal ECC failed at 0xec
Incorrect Data, interal ECC failed at 0xee
Incorrect Data, interal ECC failed at 0xf1
Incorrect Data, interal ECC failed at 0xf3
Incorrect Data, interal ECC failed at 0xf5
Incorrect Data, interal ECC failed at 0xf6
Incorrect Data, interal ECC failed at 0xf9
Incorrect Data, interal ECC failed at 0xfc
Incorrect Data, interal ECC failed at 0xff
Incorrect Data, interal ECC failed at 0x100
Incorrect Data, interal ECC failed at 0x101
Incorrect Data, interal ECC failed at 0x102
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0x103
Rewriting Block at Sector Address 0x103. 2139
Incorrect Data, interal ECC failed at 0x100
Incorrect Data, interal ECC failed at 0x101
Incorrect Data, interal ECC failed at 0x102
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0x103
Incorrect Data, interal ECC failed at 0x104
Incorrect Data, interal ECC failed at 0x105
Incorrect Data, interal ECC failed at 0x106
Incorrect Data, interal ECC failed at 0x107
Incorrect Data, interal ECC failed at 0x108
Incorrect Data, interal ECC failed at 0x109
Incorrect Data, interal ECC failed at 0x10a
Incorrect Data, interal ECC failed at 0x10b
Incorrect Data, interal ECC failed at 0x10c
Incorrect Data, interal ECC failed at 0x10d
Incorrect Data, interal ECC failed at 0x10e
Incorrect Data, interal ECC failed at 0x10f
Incorrect Data, interal ECC failed at 0x110
Incorrect Data, interal ECC failed at 0x111
Incorrect Data, interal ECC failed at 0x112
Incorrect Data, interal ECC failed at 0x113
Incorrect Data, interal ECC failed at 0x114
Incorrect Data, interal ECC failed at 0x115
Incorrect Data, interal ECC failed at 0x116
Incorrect Data, interal ECC failed at 0x117
Incorrect Data, interal ECC failed at 0x118
Incorrect Data, interal ECC failed at 0x119
Incorrect Data, interal ECC failed at 0x11a
Incorrect Data, interal ECC failed at 0x11b
Incorrect Data, interal ECC failed at 0x11c
Incorrect Data, interal ECC failed at 0x11d
Incorrect Data, interal ECC failed at 0x11e
Incorrect Data, interal ECC failed at 0x11f
Incorrect Data, interal ECC failed at 0x120
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0x121
Incorrect Data, interal ECC failed at 0x122
Incorrect Data, interal ECC failed at 0x123
Incorrect Data, interal ECC failed at 0x124
Incorrect Data, interal ECC failed at 0x125
Incorrect Data, interal ECC failed at 0x126
Incorrect Data, interal ECC failed at 0x127
Incorrect Data, interal ECC failed at 0x128
Incorrect Data, interal ECC failed at 0x129
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0x12a
Incorrect Data, interal ECC failed at 0x12b
Incorrect Data, interal ECC failed at 0x12c
Incorrect Data, interal ECC failed at 0x12d
Incorrect Data, interal ECC failed at 0x12e
Incorrect Data, interal ECC failed at 0x12f
Incorrect Data, interal ECC failed at 0x130
Incorrect Data, interal ECC failed at 0x134
Incorrect Data, interal ECC failed at 0x135
Incorrect Data, interal ECC failed at 0x136
Incorrect Data, interal ECC failed at 0x137
Incorrect Data, interal ECC failed at 0x138
Incorrect Data, interal ECC failed at 0x139
Incorrect Data, interal ECC failed at 0x13a
Incorrect Data, interal ECC failed at 0x13b
Incorrect Data, interal ECC failed at 0x13c
Incorrect Data, interal ECC failed at 0x13d
Incorrect Data, interal ECC failed at 0x13e
Incorrect Data, interal ECC failed at 0x13f
Read Block FAILED 2412
Erased Block SUCCEEDED 2414
Completed rewriting Block SUCCEEDED 2462
Incorrect Data, interal ECC failed at 0x104
Incorrect Data, interal ECC failed at 0x108
Incorrect Data, interal ECC failed at 0x10b
Incorrect Data, interal ECC failed at 0x10d
Incorrect Data, interal ECC failed at 0x10e
Incorrect Data, interal ECC failed at 0x10f
Incorrect Data, interal ECC failed at 0x112
Incorrect Data, interal ECC failed at 0x113
Incorrect Data, interal ECC failed at 0x117
Incorrect Data, interal ECC failed at 0x118
Incorrect Data, interal ECC failed at 0x11a
Incorrect Data, interal ECC failed at 0x11b
Incorrect Data, interal ECC failed at 0x11c
Incorrect Data, interal ECC failed at 0x11d
Incorrect Data, interal ECC failed at 0x122
Incorrect Data, interal ECC failed at 0x123
Incorrect Data, interal ECC failed at 0x125
Incorrect Data, interal ECC failed at 0x127
Incorrect Data, interal ECC failed at 0x12c
Incorrect Data, interal ECC failed at 0x12d
Incorrect Data, interal ECC failed at 0x130
Incorrect Data, interal ECC failed at 0x134
Incorrect Data, interal ECC failed at 0x135
Incorrect Data, interal ECC failed at 0x137
Incorrect Data, interal ECC failed at 0x138
Incorrect Data, interal ECC failed at 0x139
Incorrect Data, interal ECC failed at 0x13b
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0x142
Rewriting Block at Sector Address 0x142. 2586
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0x142
Incorrect Data, interal ECC failed at 0x143
Incorrect Data, interal ECC failed at 0x144
Incorrect Data, interal ECC failed at 0x145
Incorrect Data, interal ECC failed at 0x146
Incorrect Data, interal ECC failed at 0x147
Incorrect Data, interal ECC failed at 0x148
Incorrect Data, interal ECC failed at 0x149
Incorrect Data, interal ECC failed at 0x14a
Incorrect Data, interal ECC failed at 0x14b
Incorrect Data, interal ECC failed at 0x14c
Incorrect Data, interal ECC failed at 0x14d
Incorrect Data, interal ECC failed at 0x14e
Incorrect Data, interal ECC failed at 0x14f
Incorrect Data, interal ECC failed at 0x150
Incorrect Data, interal ECC failed at 0x151
Incorrect Data, interal ECC failed at 0x152
Incorrect Data, interal ECC failed at 0x153
Incorrect Data, interal ECC failed at 0x154
Incorrect Data, interal ECC failed at 0x155
ERROR: c:\WINCE600\PLATFORM\COMMON\SRC\SOC\STM\COMMON\DRIVERS\NandFlash\.\stm_NandFlash.c line 656: Rewrite recommended, internal ECC corrected data at 0x156
Incorrect Data, interal ECC failed at 0x157
Incorrect Data, interal ECC failed at 0x158
Incorrect Data, interal ECC failed at 0x159
Incorrect Data, interal ECC failed at 0x15a
Incorrect Data, interal ECC failed at 0x15b
Incorrect Data, interal ECC failed at 0x15c
Incorrect Data, interal ECC failed at 0x15d
Incorrect Data, interal ECC failed at 0x15e
Incorrect Data, interal ECC failed at 0x15f
Incorrect Data, interal ECC failed at 0x160
Incorrect Data, interal ECC failed at 0x161
Incorrect Data, interal ECC failed at 0x162
Incorrect Data, interal ECC failed at 0x163
Incorrect Data, interal ECC failed at 0x164
Incorrect Data, interal ECC failed at 0x165
Incorrect Data, interal ECC failed at 0x166
Incorrect Data, interal ECC failed at 0x167
Incorrect Data, interal ECC failed at 0x168
Incorrect Data, interal ECC failed at 0x169
Incorrect Data, interal ECC failed at 0x16a
Incorrect Data, interal ECC failed at 0x16b
Incorrect Data, interal ECC failed at 0x16c
Incorrect Data, interal ECC failed at 0x16d
Incorrect Data, interal ECC failed at 0x16e
Incorrect Data, interal ECC failed at 0x16f
Incorrect Data, interal ECC failed at 0x170
Incorrect Data, interal ECC failed at 0x171
Incorrect Data, interal ECC failed at 0x172
Incorrect Data, interal ECC failed at 0x173
Incorrect Data, interal ECC failed at 0x174
Incorrect Data, interal ECC failed at 0x175
Incorrect Data, interal ECC failed at 0x176
Incorrect Data, interal ECC failed at 0x177
Incorrect Data, interal ECC failed at 0x178
Incorrect Data, interal ECC failed at 0x179
Incorrect Data, interal ECC failed at 0x17a
Incorrect Data, interal ECC failed at 0x17b
Incorrect Data, interal ECC failed at 0x17c
Incorrect Data, interal ECC failed at 0x17d
Incorrect Data, interal ECC failed at 0x17e
Incorrect Data, interal ECC failed at 0x17f
Read Block FAILED 2852
Erased Block SUCCEEDED 2855
Completed rewriting Block SUCCEEDED 2902
Incorrect Data, interal ECC failed at 0x143
Incorrect Data, interal ECC failed at 0x144
Incorrect Data, interal ECC failed at 0x146
Incorrect Data, interal ECC failed at 0x147
Incorrect Data, interal ECC failed at 0x149
Incorrect Data, interal ECC failed at 0x14c
Incorrect Data, interal ECC failed at 0x14d
Incorrect Data, interal ECC failed at 0x150
Incorrect Data, interal ECC failed at 0x151
Incorrect Data, interal ECC failed at 0x153
Incorrect Data, interal ECC failed at 0x154
Incorrect Data, interal ECC failed at 0x155
Incorrect Data, interal ECC failed at 0x157
Incorrect Data, interal ECC failed at 0x158
Incorrect Data, interal ECC failed at 0x159
Incorrect Data, interal ECC failed at 0x15b
Incorrect Data, interal ECC failed at 0x15e
Incorrect Data, interal ECC failed at 0x15f
Incorrect Data, interal ECC failed at 0x160
Incorrect Data, interal ECC failed at 0x161
Incorrect Data, interal ECC failed at 0x163
Incorrect Data, interal ECC failed at 0x165
Incorrect Data, interal ECC failed at 0x169
Incorrect Data, interal ECC failed at 0x16a
Incorrect Data, interal ECC failed at 0x16b
Incorrect Data, interal ECC failed at 0x16c
Incorrect Data, interal ECC failed at 0x16d
Incorrect Data, interal ECC failed at 0x16e
Incorrect Data, interal ECC failed at 0x16f
Incorrect Data, interal ECC failed at 0x170
Incorrect Data, interal ECC failed at 0x172
Incorrect Data, interal ECC failed at 0x173
Incorrect Data, interal ECC failed at 0x175
Incorrect Data, interal ECC failed at 0x177
Incorrect Data, interal ECC failed at 0x17a
Incorrect Data, interal ECC failed at 0x17b
Incorrect Data, interal ECC failed at 0x17d
Incorrect Data, interal ECC failed at 0x17e
OHCI\system.c, GCFG_USBH1_SW_RST
OHCI\system.c, GCFG_USBH2_SW_RST
LAN PHY NOT detected.
DeleteP500EnetRegistry:
   \Comm\GMAC 0x0
   \Comm\GMAC1 0x0
   \Comm\Tcpip\Linkage 0x0
   \Drivers\Virtual 0x0
   \Drivers\BuiltIn\LIN 0x5
LIN: Data Valid
BALDWIN_DDI: cBaldwinHwIf::Init: Initializing...
BALDWIN_DDI: cBaldwinHwIf::Init: Scope successfully identified.


or maybe i need the load fpga after upoad nk.bin file? 

[sprit]

or maybe i need to load the nk.bn0 file and fpga bin file to the same address...?

[Bud]

You transferred fpga bin file but did not load it into fpga. Use fpga command before uploading the main firmware bin.

[sprit]

its still stuck...

Code: [Select]

p500> loady 900000 115200
## Ready for binary (ymodem) download to 0x00900000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/278(STX)/0(CAN) packets, 11 retries
## Total Size      = 0x00045480 = 283776 Bytes
p500> fpga 900000 45480
p500> loady 900000 115200
## Ready for binary (ymodem) download to 0x00900000 at 115200 bps...
CCxyzModem - CRC mode, 1(SOH)/27158(STX)/0(CAN) packets, 4 retries
## Total Size      = 0x01a857c0 = 27809728 Bytes
p500> go 0x00362000
## Starting application at 0x00362000 ...

[Bud]

Mate, take a break, you are too tired. Really, stop and have rest, you are making silly mistakes.

[sprit]

I tried to sleep for a bit but when I closed my eyes, the image of the console appeared again. I will try one last time... by the way, mod the LAN circuit for this EDUX.


loady 900000 11520
upload fpga file
load 900000 45480
loady 0x00361000 115200
upload nb.bn0
go 0x00362000

[sprit]

Yeahhhhhh. I madee ittttt