The UnBrickable

Firmwares For Conexant CX82310 Based ADSL Router

2010-12-04T17:01:00.001+08:00

After successfully unbricking the Aztech DSL305E ADSL modem, which is a Conexant CX82310 based ADSL router, I realized the firmware that I used for the job was quite old and not up to date, this triggered my obsession to search for the newest firmware for this beast, so I did a little digging around at Aztech's site and some others, the results are as follows:

Conexant Base Code & Firmware For CX82310 ADSL Router
Version 4.1.0.34		Remarks: All modules are latest version but no firewall function.
USB Flash Programmer:	Yes (Ver 4.6)
BootCode Version:	BC_CX82xxx_4.1.0.28
Conexant Firmware Version:	CX82xxx_4.1.0.34
Customer Software Version:	4.1.0.34
Showtime Firmware Version:	3.50
VxWorks Version:	5.4.2
Firewall Function:	No
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:	epicrouter
Version 4.1.0.9_S		Remarks: Only VxWorks is latest version and no firewall function.
USB Flash Programmer:	Yes (Ver 3.8)
BootCode Version:	undefined
Conexant Firmware Version:	CX82xxx_4.1.0.9_S
Customer Software Version:	4.1.0.9_S
Showtime Firmware Version:	3.30
VxWorks Version:	5.4.2
Firewall Function:	No
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:	epicrouter
Version ETHADSL_USB_032002_REL5		Remarks: All modules are old version and no firewall function.
USB Flash Programmer:	Yes (Ver 2.6)
BootCode Version:	undefined
Conexant Firmware Version:	ETHADSL_USB_032002_REL5
Customer Software Version:	ETHADSL_USB_032002_REL5
Showtime Firmware Version:	2.28b
VxWorks Version:	5.4.1
Firewall Function:	No
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:	password
Aztech Firmware For DSL305EU Generic
Version 21.2.14-001		Remarks: All modules are latest version except firewall is a bit old. Note: This version may be the initial firmware for Malaysia's DSL305EU.
USB Flash Programmer:	Yes (Ver 4.6)
BootCode Version:	BC_CX82xxx_4.1.0.28
Conexant Firmware Version:	CX82xxx_4.1.0.34
Customer Software Version:	21.2.14-001
Showtime Firmware Version:	3.50
VxWorks Version:	5.4.2
Firewall Function:	Yes (Conexant_V3.2.1)
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:
Version 21.6.9-001		Remarks: Only VxWorks is latest version and no firewall function. Note: This version may be the initial firmware for Singapore's DSL305EU.
USB Flash Programmer:	Yes (Ver 3.8)
BootCode Version:	undefined
Conexant Firmware Version:	CX82xxx_4.1.0.9_S
Customer Software Version:	21.6.9
Showtime Firmware Version:	3.30
VxWorks Version:	5.4.2
Firewall Function:	No
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:
Aztech Firmware For Singapore Models
Version 21.6.3-1 (DSL305E)		Remarks: All modules are old version with no USB flash programmer and no firewall function.
USB Flash Programmer:	No
BootCode Version:	undefined
Conexant Firmware Version:	ETHADSL_USB_032002_REL9A_9
Customer Software Version:	21.6.3
Showtime Firmware Version:	2.33a
VxWorks Version:	5.4.1
Firewall Function:	No
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:
Version 21.6.11-003 (DSL305EU)		Remarks: Only VxWorks is latest version.
USB Flash Programmer:	Yes (Ver 3.8)
BootCode Version:	undefined
Conexant Firmware Version:	CX82xxx_4.1.0.9_S
Customer Software Version:	21.6.11
Showtime Firmware Version:	3.30
VxWorks Version:	5.4.2
Firewall Function:	Yes (Conexant_V3.2.1)
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:
Aztech Firmware For Malaysia Models
Version 21.4.3 (DSL305E)		Remarks: Only VxWorks is latest version with no USB flash programmer and no firewall function.
USB Flash Programmer:	No
BootCode Version:	undefined
Conexant Firmware Version:	ETHADSL_USB_080902_REL9
Customer Software Version:	21.4.3
Showtime Firmware Version:	3.15
VxWorks Version:	5.4.2
Firewall Function:	No
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:
Version Not_Found (DSL305EU)
Newest Firmware From Origo Repair CD
Version safecom.cn 04-21-05		Remarks: Only VxWorks is latest version. CD folder: \repair54\042105
USB Flash Programmer:	Yes (Ver 4.3)
BootCode Version:	BC_CX82xxx_4.1.0.21
Conexant Firmware Version:	CX82xxx_4.1.0.21
Customer Software Version:	safecom.cn 04-21-05
Showtime Firmware Version:	3.46
VxWorks Version:	5.4.2
Firewall Function:	Yes (Conexant_V3.2.1)
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:	epicrouter
Newest Firmware For Microcom AD 2636 ADSL DeskPorte Router 100 USB
Version 4.1.0.30(B-ETSI)_FW_Fincom_04		Remarks: All modules are latest version except Conexant firmware is a bit old.
USB Flash Programmer:	Yes (Ver 4.6)
BootCode Version:	BC_CX82xxx_4.1.0.28
Conexant Firmware Version:	CX82xxx_4.1.0.30
Customer Software Version:	4.1.0.30(B-ETSI)_FW_Fincom_04
Showtime Firmware Version:	3.50
VxWorks Version:	5.4.2
Firewall Function:	Yes (Conexant_V3.2.2)
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:	epicrouter
Most Updated Conexant Base Code & Firmware For CX82310 ADSL Router
Version 4.1.0.34_FW_FC_(LHT)		Remarks: All modules are latest version with firewall function and firmware check function. Note: This version is my compilation from version 4.1.0.34 and version 4.1.0.30.
USB Flash Programmer:	Yes (Ver 4.6)
BootCode Version:	BC_CX82xxx_4.1.0.28
Conexant Firmware Version:	CX82xxx_4.1.0.34
Customer Software Version:	4.1.0.34_FW_FC_(LHT)
Showtime Firmware Version:	3.50
VxWorks Version:	5.4.2
Firewall Function:	Yes (Conexant_V3.2.2)
USB Function:	Yes
Wireless Function:	No
Web GUI URL:	http://10.0.0.2/
Web GUI Login Userid:	admin
Web GUI Login Password:	epicrouter

Aztech's
Their web support page no longer put up any links to firmware download for both DSL305E & DSL305EU, may be there were too many people having their modem bricked after uploading their firmware using modem's web manager, this is especially true for these type of modems if firmware updates through modem's web manager are not following incremental sequence from lower to higher version and jumping or skipping version in between, this will definitely results in error and a bricked modem!!
Anyway the firmwares for DSL305E/EU are still lying around inside their FTP site and it took some effort to figure out which is the most latest one.

Firmware Update Notes
a) Firmware updates via router's web manager must follow incremental sequence from lower to higher version, otherwise jumping or skipping version in between will results in error and bricked modem!!
b) Firmware updates via USB flash is the safest and foolproof method provided that the USB flash programmer is bundled with the firmware package.
c) Firmware package with bundled USB flash programmer can be use for both non USB type modem and USB type modem.
d) A special USB cable is required to flash write the firmware for non USB type modem without an external USB-B connector but with an internal USB header connector (e.g. Aztech DSL305E, refer to my previous blog post).

Repair Guide

Conexant CX82310 Based ADSL Router Repair Guide
The following symptoms will indicate a bricked router with corrupted flash memory:-
a)	After power on, only Power & LAN lights are lit.
b)	DSL light stays off & no blinking.
c)	No response to http/ftp/telnet/ping to 10.0.0.2.
d)	Reset button not working.
In this case you will have to do an USB firmware flash in order to fix it.

You will need:-
1.	A PC with an Intel or Via chipset (Intel is best) mobo with on board USB ports running a processor speed of 900Mhz or less and Win9x/WinNT/Win2K/WinXP OS.
2.	A cross/Philips head screwdriver to open the router's casing.
3.	For router without an USB-B receptacle; A special USB cable to connect the router's internal 10pins (based on Aztech DSL305E's J7) USB header to the PC's USB-A port. For router with an USB-B receptacle; A standard USB cable to connect the router's USB-B port to the PC's USB-A port.
4.	A jumper block like the ones used on the back of hard drives.
5.	A firmware package bundled with USB flash programmer.

Stage-1: Cracking open the router
1.	Unplug all cables from you router, turn it upside down and lay it on a flat surface.
2.	Unscrew any screws that you can see, if not then look for any small round rubber feet, gently pry them off with your fingernail or flat-blade-screwdriver, you will find the screws hidden under them.
3.	Turn the router back up right and carefully pull the two halves of the router casing apart, the circuit board should sit flat on the bottom casing.

Stage-2: Add jumper & connect router to PC
1.	Discharge any static electricity from your body by touching something earthed like a PC's exposed (not painted over) back panel metal casing.
2.	Locate a barcode sticker label with MAC address above or under the circuit board or under the bottom casing, note down this router's MAC address for later use.
3.	Locate the jumper pins (pair) on the circuit board, the pair should be situated near to the small shiny metal component (clock xtal), place the jumper block onto the pins, try to avoid touching any of the circuit.
4.	Disconnect all USB devices or plugs from your PC's USB ports.
5.	For router without an USB-B receptacle; Insert the special USB cable's 10pins socket to the 10pins (based on Aztech DSL305E's J7) USB header on the circuit board, make sure the pin #1 of the header is aligned with the triangular mark on the socket, plug the other end of the cable into one of your PC's USB ports. For router with an USB-B receptacle; Insert a standard USB cable's square plug into the USB socket on the router and plug the other end of the cable into one of your PC's USB ports.

Stage-3: Flash the router
1.	Make sure the router's circuit board is lying flat on the bottom casing.
2.	Connect the power cable to the router and switch it on, make sure the POWER light comes on.
3.	Boot up the PC into pure DOS mode.
4.	At DOS prompt, change directory to where the firmware files and USB flash programmer utility are located.
5.	For router without an USB-B receptacle; Type "rm.bat" & [Enter] at the DOS prompt and wait for further instruction. For router with an USB-B receptacle; Type "rm_usb.bat" & [Enter] at the DOS prompt and wait for further instruction.
6.	When prompted for "Start Ethernet Global Mac", type in the router's MAC address (the one you took from the barcode sticker label) & [Enter], e.g. 00-09-F3-00-DB-1D.
7.	When prompted for "End Ethernet Global Mac", type the same MAC address as before but change only the last byte to FF & [Enter], e.g. 00-09-F3-00-DB-FF.
8.	When flashing is over, take note on the final messages on screen, make sure there is no error messages and the DOS prompt returns.
9.	Wait about 1 minute, then power off the router and PC.

Stage-4: Reconnect the router as before
1.	Remove the power cable, USB cable and jumper block from the router.
2.	Do the reverse process of the router casing opening procedure.
3.	Connect the power cable and DSL phone line back to the router, then connect the router back to the PC via LAN/USB.
4.	Power on the router and make sure the POWER light comes on, wait about 1 minute.
5.	If the flash process is successful, the DSL light should start blinking within 1 minute from power on, it will change to solid if connection to DSLAM is established.
6.	Power up the PC and boot it into windows mode, make sure you can open the router's web configuration page.

Unbricking Aztech DSL305E ADSL Modem (Conexant CX82310 Class I Router)

2010-04-30T11:18:00.004+08:00

Intro
I'm kind of obsessed with dead stuffs, especially bricked electronic gadgets, they always seems to be silently begging me for help to revive it back to their "normal life" whenever I got chance to meet one, well here is one of them, lying on the storage shelf for years fully dead and bricked, introducing the Aztech DSL305E ADSL Modem:

History
It was bricked 2 years ago due to unknown reason, the dead symptoms was a typical case of corrupted firmware in flash memory:
a) After power on, only Power & LAN lights are lit.
b) Dead DSL light & no blinking.
c) No response to http/ftp/telnet/ping to 10.0.0.2.
d) Reset button not working.

Solutions From The Net
Immediately after that I started searching the internet hoping to find an "off the shelf" solution to unbrick this modem, although I have managed to find quite a number of resources for unbricking modems that are base on Conexant CX82310 chip with an USB socket, non so far offer any direct solution for our old friend here the Aztech DSL305E which is also base on Conexant CX82310 chip but with no USB B receptacle!!
Anyway I found this adsltech forum discussion (a dead link now!) that offer some clues on the function of J7 10 pins header inside the modem but not much.
Next I found dslreports forum discussion that offer simple solutions on unbricking DSL305EU by using the available USB B receptacle to re-flash the flash memory. As for DSL305E without the USB B receptacle, the forum members assume the J7 10 pins header inside the modem is the serial port for flash memory writing, with suggestion on using an old mobo's COM port 10 to 9 pins connector to connect J7 to PC's COM port, well nobody have any success on this and the discussion die off eventually on the DSL305E without any solution.

The Hardware
I'm a bit skeptical about the COM port thing, just to play safe before I do any experiment with the COM port method, I did a little back engineering research on the DSL305E's internal circuit board with main emphasis on the J7's circuit connection tracks, these are what I found out so far:

a) J2 is the unmounted USB B receptacle for DSL305EU.
b) J7's pin 2, 3 & 5 are linked to J2's pin of 5V, D- & D+ by a few unmounted components.
c) J7's pin 2, 3 & 5 are not physically connected to J2 on DSL305E.
d) J7's pin 3 & 5 are physically directly connected to Conexant CX82310 chip.
e) J7's pin 4 & 10 are physically directly connected to J4.

The Software
Next thing I did was to dummy run the flashing software I downloaded from dslreports forum on two old & slow PCs (a strict system requirement for the flashing software) without any connection to J7, here are the results:

Pentium 133MHz System Without On Board USB Host

Pentium 233MHz System With On Board USB Host

The Hypothesis
Base on my findings, my conclusion are:
a) J7 is not the COM port, it must be the USB port as it is linked to unmounted J2 (USB B receptacle for DSL305EU) and the flashing software requires it to connect to an USB host to functions.
b) There is no USB line biasing for J7 as all components around J2 area for USB line biasing are not mounted and J7's USB lines are directly connected to Conexant CX82310 chip only.
c) J7 should be the USB port used in manufacturing process for flash memory writing, normally factory side will have some sort of jig to connect J7 to host PC, this jig might include all the necessary components for USB line biasing if they are not mounted on board in DSL305E to save manufacturing cost.

The Experiment
At that time, with a vague knowledge on the USB specification, a busy company job on hand and no way to get any info from Aztech on the specifications for USB line biasing, I simply rush to rig a simple connection jig as follow, hoping at least to get the USB link between host PC & J7 up and running to test the flashing software, with the expectation that USB comm might fail without the line biasing circuit:

Next I followed these steps for the flashing process:
a) make sure both modem & PC are power off.
b) short J4 with a jumper block.
c) connect J7 to USB host of a Pentium 233MHz system using the jig.
d) make sure no other USB device is connected to the USB host.
e) power on the modem.
f) power on the PC & boot to DOS mode.
g) at DOS prompt, change directory to flash software folder & type rm [Enter].
The following message appeared after that:

As I expected, comm link between modem & USB host failed, the USB host can't detect any device attached to it, guess it must be that missing USB line biasing circuit or something else.
Just when things started to get more interesting, duty called for my full attention on other projects, therefore the modem was put back to storage shelf for gods know how long until I'm free to tinker with it again.

Back To The Net
Time passed by pretty fast, now after 2 years at present, I'm free again to do some tinkering works, 1st on my list is the Aztech DSL305E, once again I find myself searching the internet looking for easy solutions, thinking may be someone out there might already have one for unbricking this modem after so long.
Well this time I didn't find any direct solutions but found more clues that proves J7 is the USB port and not a COM port, these clues are mostly for other non Aztech router modems which are Class I routers that uses the same Conexant CX82310 chip.
In this RouterTech forum discussion some member managed to re-flash a bricked Class I router using direct USB host connection to an internal 5 pins USB header, this method is somewhat similar to my previous failed attempt, I think they got lucky because their router has USB line biasing components mounted on board.
Well if you are one of those lucky owners of this non Aztech Class I router modem, you will find this repair guide & repair CD extremely useful if you bricked one in future.

USB Rules
My next step now is to target on figuring out the proper USB line biasing by dwelling deeply into the nuts and bolts of the USB comm.
First I found this info on page 36 of Conexant CX82310 DataSheet:

It is a requirement to connect CX82310's USB port data lines each through a 24 ohm resistor to USB host.
Next I found out the possible key reason why USB host can't detect any connected USB device at this Website:

So there you have it, the USB host can't detect anything if there is no 3.3V pull up on either D+ or D- line on the device side, I just need confirm this possibility by doing some electrical measurements on J7's pins especially CX_D+ & CX_D-:

With both pin 3 & 5 measured around 0.3V for voltage to GND and more than 9 mega ohm for resistance to +3.3V, it is obvious that there is no 3.3V pull up on either D+ or D- line, with this strong lead immediately I rig out another version of my connection jig as follow:

There are just three components added, two 24 ohm series resistors for data lines & one 1.5K ohm resistor for 3.3V pull up to D+ line, this time I'm confidence this added basic USB line biasing circuit should do the trick.

The Resurrection
Now the final moment has come for my 2nd experiment with the new connection jig using the same flashing software and flashing methods as before:
a) make sure both modem & PC are power off.
b) short J4 with a jumper block.
c) connect J7 to USB host of a Pentium 233MHz system using the jig.
d) make sure no other USB device is connected to the USB host.
e) power on the modem.
f) power on the PC & boot to DOS mode.
g) at DOS prompt, change directory to flash software folder & type rm [Enter].
h) at "Start Ethernet Global Mac" prompt, type the same MAC address as printed on a sticker at the bottom side of modem's circuit board [Enter].
i) at "End Ethernet Global Mac" prompt, type the same MAC address as h) but change the last byte to FF [Enter].
Here is the long & mesmerizing screen dump during flash memory writing:

Yes, the USB host and modem are "talking" to each other now, what a great sight!!
One small thing to take note is the message at the end of screen dump about "Please see status of Ready LED to determine success", this is actually the USB status LED which is not mounted on board in DSL305E, without it one can still judge the success of flash memory writing by:
a) seeing the final screen dump message with DOS prompt.
b) wait about 1 minute.
c) power off modem & PC.
d) remove jumper block from J4 & USB connector from J7.
e) reconnect LAN & TEL lines.
f) power on modem & check power LED is on.
g) wait about 1 minute.
h) see that DSL LED starts blinking, will change to solid if connected to active DSL line.
i) power on PC, wait until finish booting & check LAN LED is on.
j) use I.E. to connect http://10.0.0.2 and get the following Web Manager's Login page:

k) type admin & password [Enter] and the following home page appeared:

When seeing the above web page appeared for the 1st time, I'm fully convinced now that the Aztech DSL305E has finally come alive and kicking again.

The Firmware
The flashing software that I used above will upload Conexant base firmware to the modem, upon completion of the flash writing process, an updated firmware has to be uploaded using the modem's Web Manager:

Here is the updated firmware's home page:

This Conexant firmware work faster & has more features than the updated Aztech firmware.
Anyway I tried to upload the Aztech firmware using the Conexant Web Manager and the result as follow:

Well, I guess Conexant Web Manager won't accept Aztech firmware image file, as a result I bricked the modem and have to redo the USB flashing all over again. I will stick to Conexant firmware as it work faster and has many features that are not available in Aztech firmware.

The Others
The above methods used for unbricking Aztech DSL305E ADSL router modem are applicable for all other Class I router modems which are using Conexant CX82310 with conditions:
a) no USB B receptacle on circuit board (a non USB model).
b) internal USB header connector is provided without USB biasing circuit.

Notes
Uploading Aztech firmware image file using Conexant Web Manager will cause error and brick the DSL305E again, the only sure way to upload Aztech firmware is to direct flash write it through USB, but Aztech never provide any USB flashing utilities & firmware source files, another possibility is to disassemble the Aztech firmware image file and use Conexant's USB flashing utility to flash write it, I will KIV this problem for my next project.

...stay tuned. :)