GM MDI serial number..

HI to ALL

anyone, can you help me for image for this SD card, my SD card has no information...
thanks...

Hi all,

just a hint:
The clones that don't allow an easy serial change use a different NOR chip  - it is a version that has Bottom Boot (P/N of chip has a B almost at the end), not Top Boot (P/N of chip has a T instead) and this is why it's not aligned.

   

An easy and permanent fix would be to rearrange MTDs for this BB NOR in order have them aligned with the sectors, but without touching MTD0 and MTD1.
The other method was described here earlier - create an extra MTD that contains the entire address space of original MTDs for serial and MAC (that are on the same bigger sector).

I'm struggling for 5 days with a Ford VCM II clone which uses almost the same main chips as this GM MDI and comparing it with another clone and a genuine one I found this difference.

I'm running into an issue with not being able to "open mtd device" when running the flash unlock command. Any insight?

hello,please any person can change my serial. please <pm

Hi,
I wiped the flash memory of my Mdi, I wanted to ask you if you have a full backup of the MTD files? 
Thank's

The serial number is in the 16mb on board flash memory - the intel chip on the computer sub-board.

You can get u-boot access by making up a serial cable. Signals are available on the 8 pin mini din on the outside of the MDI case. pin 1 goes to PC TX (MDI RX), pin 2 goes to PC RX (MDI TX). Pin 3 goes to ground. Then when you boot:

U-Boot 1.1.4 (Dec 21 2007 - 12:11:55) ETAS VCI (r13006)

U-Boot code: A3F00000 -> A3F218F0  BSS: -> A3F27524
RAM Configuration: TRITON 270 II
Bank #0: a0000000 64 MB
Bank #1: a4000000 64 MB
HW Configuration: (0x207) MDI VCI with SMSC9116
Found P30 Flash, unlocking all blocks: 130
Flash: 16 MB
In:    serial
Out:  serial
Err:  serial
Hit any key to stop autoboot:  0
$ help
?      - alias for 'help'
askenv  - get environment variables from stdin
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd  - boot default, i.e., run 'bootcmd'
bootm  - boot application image from memory
bootp  - boot image via network using BootP/TFTP protocol
cmp    - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32  - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
erase  - erase FLASH memory
exit    - exit script
flinfo  - print FLASH memory information
flock  - physical lock of Strataflash
funlock  - physical unlock of Strataflash
go      - start application at address 'addr'
help    - print online help
iminfo  - print header information for application image
imls    - list all images found in flash
increnv  - increment environment variables
itest  - return true/false on integer compare
loadb  - load binary file over serial line (kermit mode)
loads  - load S-Record file over serial line
loop    - infinite loop on address range
macaddr  - display or store MAC address in Strataflash
mapadd - add a memory map item
mapdel - delete a memory map item
mapinfo - display the memory map information
md      - memory display
mm      - memory modify (auto-incrementing)
mmcinfo - get info on mmc(sd) card
mtest  - simple RAM test
mw      - memory write (fill)
nfs    - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
pinit  - PCMCIA sub-system
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset  - Perform RESET of the CPU
run    - run commands in an environment variable
saveenv - save environment variables to persistent storage
serialnum  - display or store serial number in Strataflash
setenv  - set environment variables
sleep  - delay execution for some time
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
version - print monitor version

The problem is the serial number and MAC flash partitions are misaligned from the flash erase block boundaries, which forces them to mount read only. Because of this the update commands dont work

Code:

$ serialnum
Serial number: 1220-22129579
$ serialnum 1220-12345678
Error: start address not on sector boundary
Failed to read same serial number back from Strataflash

I think that if we mapped a memory partition at 0x00FE0000 with size 0x00020000 then we would be able to erase that partition and load a new one via ethernet / tftp. This 128k block would cover both the serial and mac paritions. Both these partitions have checksums which would need to be figured out and calculated.

What you have been editing is the equivalent of the MDI registry. Once the serial and mac are changed in flash then a re-flash of the device should put the new numbers in the registry and they should persist over device firmware updates. I expect duplicate mac addresses are as relevant as the serial number duplicates on your lan.

$ mapinfo
Name            Location  Size      Type      Source    Guard
----            --------  ----      ----      ------    -----
boot            0x00000000 0x00040000 Flash    bootargs  Off
bootvars        0x00040000 0x00020000 Flash    bootargs  Off
linux1          0x00060000 0x00180000 Flash    bootargs  Off
initrd1          0x001e0000 0x00600000 Flash    bootargs  Off
linux2          0x007e0000 0x00180000 Flash    bootargs  Off
initrd2          0x00960000 0x00600000 Flash    bootargs  Off
linuxvars1      0x00f60000 0x00020000 Flash    bootargs  Off
linuxvars2      0x00f80000 0x00020000 Flash    bootargs  Off
serialnum        0x00ff0000 0x00008000 Flash    bootargs  Off
macaddress      0x00ff8000 0x00008000 Flash    bootargs  Off
zImage          0xa0008000 0x00200000 DRAM      Initial  Off
scratch          0xa2000000 0x00a00000 DRAM      Initial  Off
script          0xa2a00000 0x00100000 DRAM      Initial  Off
Stack            0xa3e9ff80 0x00020000 DRAM      System    On
GD              0xa3ebff80 0x00000080 DRAM      System    On
Heap            0xa3ec0000 0x00040000 DRAM      System    On
Text            0xa3f00000 0x000218f0 DRAM      System    On
BSS              0xa3f218f0 0x00005c34 DRAM      System    On

The sdcard is just the /usr/local/ portion of the firmware. The rest is in the 16mb flash.

Be careful, its super easy to brick your MDI with these tools.

Hopefully your still around and possibly can help me figure this out as i have no idea how to use linux. uboot, is that already installed on the mdi device, and your reading it directly from terminal in your linux pc? i need to change my serial number in hopes to prevent further account lockout due to clone device. i have the mdi pins 1-3 wired to a standard usb cable, is that correct or should i be using a serial port? how do you get uboot to show any information inside of terminal? sorry for the noob questions, but once i get uboot to load i should be fine from there i just dont understand completely how to run the program.

Your jumping ahead and incorrectly.. I sure hope you didn't power anything up with the wiring connected as you mentioned.
You do indeed need serial communications, 38400 baud to connect to the mdi but that is only part of it. Do you have an MDI 1 clone or one of those mongrel mdi2's??? I have not done this with an mdi2, no idea if it'll work the same.
this is not in order but you'll need all 3..
1)You need to be able to insert the SD card from the MDI into a card reader and be able to read AND write files.. The card is written in EXT2(I think) format and that is readable by something running linux. There are some windows programs that can give you the ability to read and write to this card, you'll have to investigate and find something that works for you. EXT2FSD is a free program but it's been known to brick and corrupt the windows OS. Might be better off downloading a linux OS and booting off a thumbdrive onto a spare laptop or something. Paragon software makes a good program called Linux File Systems for Windows but it's paid software. I think there's a 10 day trial but that would be a gamble unless you have everything else ready to go and have the spare time.
2)You need a serial cable done up and ready and communicating with the MDI. SERIAL PORT, NOT USB. 38400 baud. pinout has been mentioned. pic below is from pcmhacking.net . You can use something like termite or some other serial communication program. there are lots.
3) patience.. If you try to jump steps, or just rush it you'll likely fail.. These can be bricked doing this.

I've revised the steps slightly, there is no need for using ftp to push the file, that's extra steps for me that I don't need to take. I just push the extra partition to the SD card. Modify the file, save it back to the SD card and then write it back to the flash.

See if these instructions make it any clearer. I know there is an easier way, I just don't quite remember how I did it, lol.. I used setbootargs primary and moved serialnum partition to be writeable and then used the init_script_testmode utility to change the serial which even worked after a total recovery. Just some SD card modding, some serial work and let the utility do it for me.. I might figure it out but I have no need to spend the time figuring it out again.

1) This is modifying the SD card files a little. Need the card from the MDI installed in something that can read and write linux.
a)Take SD card from MDI and install into reader.
b)find bin/telnetd.sh-disable and rename to "telnetd.sh"
c)Add << export PS1='[\u@mdi \W]\$ ' >> to the top of init_script.sh **everything between the << and >> including the '


2) Booting up MDI with serial cable connected and serial terminal running. This is so we can modify the boot and add a partition.
a)Now you need the serial cable connected to the MDI.
b)Reinstall the modified SD card with the modified files into the MDI and power it up.
c)With a serial program connected at 38,400 press any key during boot at the prompt.
d) type in "askenv setbootargsprimary"
e) type in "run normalargs addinit addconsole addeth addprimary;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress),128k@16256k(id);"
f) now type "boot" and the mdi should restart and boot.

3) Now we have the MDI booted up with the changed files and telnet should be running.
a)open up a telnet program. I used the windows 10 built in program by typing in telnet into the search prompt on taskbar.
b)type in o 192.168.171.2 to open a telnet session.
c) type in "dd bs=512 if=/dev/mtd10 of=/usr/local/include/mtd10" and this copies mtd partition as a file to sd card.

4)Now shut down MDI, install SD card into the computer and locate the mtd file in the include folder.

5)modify the file time!! Load up mtd10 on your pc in HxD or Hexworkshop.
The serial is at 0x10000 with a crc32 checksum of 0x10000->0x17FFB written at 17FFC-17FFFF (LSB).
The MAC is at 18000 with a crc32 checksum 0x18000->0x1FFFB at 1FFFC. << this is not needed to change serial.

Update both (just change the last couple of numbers), and use the calculate checksum feature of the hexeditor to calculate crc32 the sums of of the ranges and save the new sums in the bin (remember to enter them in LSB format).
Check that you understand how the crc is written before changing anything. Setup the checksum, get the crc and see how it's entered LSB format.
Again. CRC32 is written back to front here!!! If in doubt send me or someone else the file who knows how to do this. or post it up here.
Don't forget to SAVE THE FILE!!! You can rename it but you'll need to modify the instructions below accordingly if you do..

6)now that the mtd10 file is changed with the new serial number put it back in the mdi and serial cable connected.
a) Boot up the mdi but stop boot using serial terminal again.
b) Type in "askenv setbootargsprimary"
c) Type in "run normalargs addinit addconsole addeth addprimary;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress),128k@16256k(id);"
d) Now type "boot" and the mdi should restart and boot again with the added partition again.

7) Time to telnet in and finish up.. almost done!!
a)open up the telnet program again.
b)type in "o 192.168.171.2" to open a telnet session again.
c)now type cd /usr/local/mtd/" and the next prompts should change to "[root@mdi mtd]#"
d)Type in "./flash_unlock" /dev/mtd10 to unlock the flash partition. do NOT stop now!!!
e)Type in "./flash_erase" /dev/mtd10 to erase the flash partition do NOT stop now!!!
f)type in "dd bs=512 if=/usr/local/include/mtd10 of=/dev/mtd10" and this copies mtd file back into flash partition.

Congrats!!! You should have seen
256+0 records in
256+0 records out

As long as you saw it write the modified file back go ahead and shut down the MDI, power it back up holding down the power button to put it in recovery mode and recover the MDI.. all done!!

---

Trying to upload a pic of the serial connection I grabbed from another site. Credit is given in the image, hope the author doesn't mind.

serial connector external .zip

25

245.59 KB

Download

> uboot, is that already installed on the mdi device, and your reading it directly from terminal in your linux pc?

Yes. Tek1229's instructions look good a glance. We are talking old school serial here, higher voltage than most modern interface. Make sure you get a USB to RS232 interface and use that, if you use TTL serial or anything that isnt RS232 you'll likely blow something up.