Meraki Z1

This forum discuss about how to JTAG different devices.
rjboonstra
Posts: 6
Joined: Sun Mar 15, 2020 10:28 am

Meraki Z1

Post by rjboonstra » Tue Mar 31, 2020 7:58 pm

Hello... Any information on how to update the firmware for a Meraki Z1. There is a post at https://bliss.id/2017/10/i-bricked-and- ... meraki-z1/ that talks about updating a Z1.... I have tried with a U-Link, but do not get a response. Thanks!

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Wed Apr 01, 2020 7:55 am

I think I need to spend more time on it.
Form all the information I got this CPU core should be a MIPS one.
But the 14 pin JTAG check that was an ARM core. So there might be another JTAG port that is JTAG and so far I have not found that yet.
I will dig a little deeper to find the real JTAG port of the device.

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Wed Apr 01, 2020 10:49 am

I opened the box again and only ONE JTAG port is visible. However as I said I tested the JTAG is for ARM not for MIPS.
I am considering add NAND flashing support . The trick is to program the flash on board with reasonable cost. Thinking of hacking some existing TSOP adapter.
The covid-19 virus caused all the shipping to be delayed.

rjboonstra
Posts: 6
Joined: Sun Mar 15, 2020 10:28 am

Re: Meraki Z1

Post by rjboonstra » Wed Apr 01, 2020 11:42 am

Yes, the COVID-19 pandemic creates a lot of challenges. I did not realize that there were two processors.

ricktendo
Posts: 134
Joined: Sat Nov 29, 2014 12:41 pm

Re: Meraki Z1

Post by ricktendo » Mon Apr 27, 2020 9:56 pm

usbbdm wrote:
Wed Apr 01, 2020 10:49 am
I am considering add NAND flashing support . The trick is to program the flash on board with reasonable cost. Thinking of hacking some existing TSOP adapter.
The covid-19 virus caused all the shipping to be delayed.
This might help

https://zeigren.com/portfolio/flashcatu ... _adapters/

https://www.youtube.com/channel/UC_bMRX ... FS9DEyx3jA

Also worth mentioning, the above method works but some nand dumps are encrypted... This is how they are able to get unencrypted dumps from cable modems using a sd card reader

https://blog.danman.eu/about-adding-a-s ... sis-modem/

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Tue Apr 28, 2020 8:04 am

My order of a TSOP socket has been on the road for more than one month.
I think the TSOP adapter should be the future project.
However, I have put Z1 on my desk again and investigating the issue on JTAG.

My Z1 had been updated to latest firmware and thus I cannot get access on the serial port (only printouts).
Should get better idea of if it is still possible to access it with JTAG method.


BTW. This is the last update of my order.
Mar. 14 2:11 pm
International item has left originating country and is en route to Canada
Cnszxd, China

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Tue Apr 28, 2020 9:05 pm

After I hookup the JTAG again, I am 100% sure that the IR length is 4 bit instead of 5 bits (MIPS)
ID command 8 does seem to trigger a reset which looks like it is an ARM core. However using ARM target does not generate proper response like ID Code.

Initially I thought this could be multi core JTAG like EX-R I did a while ago. Turns out to be not the case. Maybe the visible 14-pin JTAG port is not the JTAG port for the main CPU. There might be another hidden JTAG for the main CPU (MIPS).

rjboonstra
Posts: 6
Joined: Sun Mar 15, 2020 10:28 am

Re: Meraki Z1

Post by rjboonstra » Sat May 16, 2020 10:16 pm

Appreciate the update. Thanks!

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Sun May 17, 2020 6:32 am

I am interested in program the NAND chip on board like the 360 clip. May need different tool to work on it since it needs a lot more pins than u-link NT

usbbdm deleted the post by usbbdm on Sun May 17, 2020 6:44 am.
Display this post.

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Mon May 25, 2020 10:33 am

I have the prototype that can read/write NAND flash with STM32 hardware.
I just need to wait my NAND clip and see if I can access flash on board.

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Tue Jun 09, 2020 3:32 pm

My clip has finally arrived. Will check if I can read the flash while it is on the board.

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Tue Jun 09, 2020 9:52 pm

I tried two different router.
On Meraki Z1 I am able to detect the flash. However the R/B signal seems tide low and hard to get it working properly.
I tried EA6400 and it can get much better result. I am able to detect reliably and read data.
Due to the nature of NAND flash, sometime there is bit errors. I think it is time to implement the ECC to allow "fix" the bit read error.
Still trying to make Z1 working and the way the NAND flash is soldered on the board makes it perfect for the adapter. EA6400 needs to remove the heat sink and one little capacitor.

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Wed Jun 10, 2020 7:55 pm

With 12V to the router and pull the ISP pin, I can properly read the back up now.
Image

usbbdm
Posts: 8616
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm » Thu Jun 11, 2020 9:08 pm

Here is the youtube that I use the clip to read the flash of Meraki Z1.

Post Reply