Meraki Z1

This forum discuss about how to JTAG different devices.
Post Reply
rjboonstra
Junior Member
Posts: 10
Joined: Sun Mar 15, 2020 10:28 am

Meraki Z1

Post by rjboonstra »

Hello... Any information on how to update the firmware for a Meraki Z1. There is a post at https://bliss.id/2017/10/i-bricked-and- ... meraki-z1/ that talks about updating a Z1.... I have tried with a U-Link, but do not get a response. Thanks!
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

I think I need to spend more time on it.
Form all the information I got this CPU core should be a MIPS one.
But the 14 pin JTAG check that was an ARM core. So there might be another JTAG port that is JTAG and so far I have not found that yet.
I will dig a little deeper to find the real JTAG port of the device.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

I opened the box again and only ONE JTAG port is visible. However as I said I tested the JTAG is for ARM not for MIPS.
I am considering add NAND flashing support . The trick is to program the flash on board with reasonable cost. Thinking of hacking some existing TSOP adapter.
The covid-19 virus caused all the shipping to be delayed.
rjboonstra
Junior Member
Posts: 10
Joined: Sun Mar 15, 2020 10:28 am

Re: Meraki Z1

Post by rjboonstra »

Yes, the COVID-19 pandemic creates a lot of challenges. I did not realize that there were two processors.
ricktendo
Junior Member
Posts: 133
Joined: Sat Nov 29, 2014 12:41 pm

Re: Meraki Z1

Post by ricktendo »

usbbdm wrote: Wed Apr 01, 2020 10:49 am I am considering add NAND flashing support . The trick is to program the flash on board with reasonable cost. Thinking of hacking some existing TSOP adapter.
The covid-19 virus caused all the shipping to be delayed.
This might help

https://zeigren.com/portfolio/flashcatu ... _adapters/

https://www.youtube.com/channel/UC_bMRX ... FS9DEyx3jA

Also worth mentioning, the above method works but some nand dumps are encrypted... This is how they are able to get unencrypted dumps from cable modems using a sd card reader

https://blog.danman.eu/about-adding-a-s ... sis-modem/
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

My order of a TSOP socket has been on the road for more than one month.
I think the TSOP adapter should be the future project.
However, I have put Z1 on my desk again and investigating the issue on JTAG.

My Z1 had been updated to latest firmware and thus I cannot get access on the serial port (only printouts).
Should get better idea of if it is still possible to access it with JTAG method.


BTW. This is the last update of my order.
Mar. 14 2:11 pm
International item has left originating country and is en route to Canada
Cnszxd, China
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

After I hookup the JTAG again, I am 100% sure that the IR length is 4 bit instead of 5 bits (MIPS)
ID command 8 does seem to trigger a reset which looks like it is an ARM core. However using ARM target does not generate proper response like ID Code.

Initially I thought this could be multi core JTAG like EX-R I did a while ago. Turns out to be not the case. Maybe the visible 14-pin JTAG port is not the JTAG port for the main CPU. There might be another hidden JTAG for the main CPU (MIPS).
rjboonstra
Junior Member
Posts: 10
Joined: Sun Mar 15, 2020 10:28 am

Re: Meraki Z1

Post by rjboonstra »

Appreciate the update. Thanks!
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

I am interested in program the NAND chip on board like the 360 clip. May need different tool to work on it since it needs a lot more pins than u-link NT
usbbdm deleted the post by usbbdm on Sun May 17, 2020 6:44 am.
Display this post.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

I have the prototype that can read/write NAND flash with STM32 hardware.
I just need to wait my NAND clip and see if I can access flash on board.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

My clip has finally arrived. Will check if I can read the flash while it is on the board.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

I tried two different router.
On Meraki Z1 I am able to detect the flash. However the R/B signal seems tide low and hard to get it working properly.
I tried EA6400 and it can get much better result. I am able to detect reliably and read data.
Due to the nature of NAND flash, sometime there is bit errors. I think it is time to implement the ECC to allow "fix" the bit read error.
Still trying to make Z1 working and the way the NAND flash is soldered on the board makes it perfect for the adapter. EA6400 needs to remove the heat sink and one little capacitor.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

With 12V to the router and pull the ISP pin, I can properly read the back up now.
Image
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Re: Meraki Z1

Post by usbbdm »

Here is the youtube that I use the clip to read the flash of Meraki Z1.
Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests