Meraki Z1
-
- Junior Member
- Posts: 10
- Joined: Sun Mar 15, 2020 10:28 am
Meraki Z1
Hello... Any information on how to update the firmware for a Meraki Z1. There is a post at https://bliss.id/2017/10/i-bricked-and- ... meraki-z1/ that talks about updating a Z1.... I have tried with a U-Link, but do not get a response. Thanks!
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
I think I need to spend more time on it.
Form all the information I got this CPU core should be a MIPS one.
But the 14 pin JTAG check that was an ARM core. So there might be another JTAG port that is JTAG and so far I have not found that yet.
I will dig a little deeper to find the real JTAG port of the device.
Form all the information I got this CPU core should be a MIPS one.
But the 14 pin JTAG check that was an ARM core. So there might be another JTAG port that is JTAG and so far I have not found that yet.
I will dig a little deeper to find the real JTAG port of the device.
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
I opened the box again and only ONE JTAG port is visible. However as I said I tested the JTAG is for ARM not for MIPS.
I am considering add NAND flashing support . The trick is to program the flash on board with reasonable cost. Thinking of hacking some existing TSOP adapter.
The covid-19 virus caused all the shipping to be delayed.
I am considering add NAND flashing support . The trick is to program the flash on board with reasonable cost. Thinking of hacking some existing TSOP adapter.
The covid-19 virus caused all the shipping to be delayed.
-
- Junior Member
- Posts: 10
- Joined: Sun Mar 15, 2020 10:28 am
Re: Meraki Z1
Yes, the COVID-19 pandemic creates a lot of challenges. I did not realize that there were two processors.
-
- Junior Member
- Posts: 133
- Joined: Sat Nov 29, 2014 12:41 pm
Re: Meraki Z1
This might help
https://zeigren.com/portfolio/flashcatu ... _adapters/
https://www.youtube.com/channel/UC_bMRX ... FS9DEyx3jA
Also worth mentioning, the above method works but some nand dumps are encrypted... This is how they are able to get unencrypted dumps from cable modems using a sd card reader
https://blog.danman.eu/about-adding-a-s ... sis-modem/
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
My order of a TSOP socket has been on the road for more than one month.
I think the TSOP adapter should be the future project.
However, I have put Z1 on my desk again and investigating the issue on JTAG.
My Z1 had been updated to latest firmware and thus I cannot get access on the serial port (only printouts).
Should get better idea of if it is still possible to access it with JTAG method.
BTW. This is the last update of my order.
Mar. 14 2:11 pm
International item has left originating country and is en route to Canada
Cnszxd, China
I think the TSOP adapter should be the future project.
However, I have put Z1 on my desk again and investigating the issue on JTAG.
My Z1 had been updated to latest firmware and thus I cannot get access on the serial port (only printouts).
Should get better idea of if it is still possible to access it with JTAG method.
BTW. This is the last update of my order.
Mar. 14 2:11 pm
International item has left originating country and is en route to Canada
Cnszxd, China
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
After I hookup the JTAG again, I am 100% sure that the IR length is 4 bit instead of 5 bits (MIPS)
ID command 8 does seem to trigger a reset which looks like it is an ARM core. However using ARM target does not generate proper response like ID Code.
Initially I thought this could be multi core JTAG like EX-R I did a while ago. Turns out to be not the case. Maybe the visible 14-pin JTAG port is not the JTAG port for the main CPU. There might be another hidden JTAG for the main CPU (MIPS).
ID command 8 does seem to trigger a reset which looks like it is an ARM core. However using ARM target does not generate proper response like ID Code.
Initially I thought this could be multi core JTAG like EX-R I did a while ago. Turns out to be not the case. Maybe the visible 14-pin JTAG port is not the JTAG port for the main CPU. There might be another hidden JTAG for the main CPU (MIPS).
-
- Junior Member
- Posts: 10
- Joined: Sun Mar 15, 2020 10:28 am
Re: Meraki Z1
Appreciate the update. Thanks!
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
I am interested in program the NAND chip on board like the 360 clip. May need different tool to work on it since it needs a lot more pins than u-link NT
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
I have the prototype that can read/write NAND flash with STM32 hardware.
I just need to wait my NAND clip and see if I can access flash on board.
I just need to wait my NAND clip and see if I can access flash on board.
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
My clip has finally arrived. Will check if I can read the flash while it is on the board.
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
I tried two different router.
On Meraki Z1 I am able to detect the flash. However the R/B signal seems tide low and hard to get it working properly.
I tried EA6400 and it can get much better result. I am able to detect reliably and read data.
Due to the nature of NAND flash, sometime there is bit errors. I think it is time to implement the ECC to allow "fix" the bit read error.
Still trying to make Z1 working and the way the NAND flash is soldered on the board makes it perfect for the adapter. EA6400 needs to remove the heat sink and one little capacitor.
On Meraki Z1 I am able to detect the flash. However the R/B signal seems tide low and hard to get it working properly.
I tried EA6400 and it can get much better result. I am able to detect reliably and read data.
Due to the nature of NAND flash, sometime there is bit errors. I think it is time to implement the ECC to allow "fix" the bit read error.
Still trying to make Z1 working and the way the NAND flash is soldered on the board makes it perfect for the adapter. EA6400 needs to remove the heat sink and one little capacitor.
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
With 12V to the router and pull the ISP pin, I can properly read the back up now.
-
- Junior Member
- Posts: 8981
- Joined: Mon Jul 18, 2005 9:33 pm
Re: Meraki Z1
Here is the youtube that I use the clip to read the flash of Meraki Z1.
Who is online
Users browsing this forum: No registered users and 1 guest