Skip to content

Downgrade Firmware

Alex X edited this page Nov 6, 2020 · 31 revisions

Original authors @serrj-sv and @rezmus. Discuss here.

Gateway keeps the previous firmware before the update and you can be loaded from it.
If you update twice to a bad firmware, this method does not work.
If you have bad firmware from the factory - this method does not work.

Solder UART

  1. Open Gateway
  1. Solder USB UART adapter (GND to GND, RX to TX, TX to RX)
  1. Connect adapter to USB. UART setting: 38400 8n1, disable flow control (rts/cts)

  1. Power gateway with build-in USB power

  2. Сheck if boot is OK and there are no artifacts in console. If there are artifacts - check the wires, change the USB UART.

Go to bootloader

  1. Turn off gateway power

  2. Connect TP17 to ground (example USB case)

  1. Power gateway with build-in USB power

  2. Remove TP17/GND wire after <RealTek> shows in console.

Switch boot to old firmware

Attention: ALWAYS keep all UART logs and/or backups!

  1. Enable flash

<RealTek>snwbi

  1. Read boot_info to from nand to memory

<RealTek>snwbrecc a0000000 140 40

  1. Display boot_info in memory

<RealTek>db a0000000 40

 [Addr]   .0 .1 .2 .3 .4 .5 .6 .7 .8 .9 .A .B .C .D .E .F
A0000000: 7C 91 00 00 E4 58 01 01 01 01 00 20 EC 04 C8 CF     |....X..... ....
A0000010: 00 00 20 EC 04 CB 19 00 00 82 80 04 62 C6 00 00     .. .........b...
A0000020: 9A 40 04 72 E8 00 00 00 01 31 2E 30 2E 32 2E 30     [email protected]
A0000030: 30 35 00 00 00 00 00 FF FF FF FF FF FF FF FF FF     05..............
  1. Copy first line to this calculator:

7C 91 00 00 E4 58 01 01 01 01 00 20 EC 04 C8 CF

It should change 6 bytes:

__ __ __ __ XX XX YY YY YY YY __ __ __ __ __ __

  1. Paste response from calculator:

<RealTek>eb a000000 7C 91 00 00 E6 5A 00 00 00 00 00 20 EC 04 C8 CF

  1. Check changes. Repeat step 3. The first line should be changed

  2. ???

<RealTek>snwbeb 140

  1. Write boot_info from memory to nand

<RealTek>snwbwecc A0000000 140 40

  1. Reboot gateway (power off/on)

Gateway should starts with previous firmware.

Useful links

Clone this wiki locally