Restoring old firmware on a Dlink DCM-202

If you’re like me and tried to upgrade your Dlink DCM-202 firmware only to find out that afterwards the telnet shell is no longer accessible, then this is the guide for you. I’ll describe how to recover the old version of the firmware so that you can try other firmwares as they become available.

WARNING!!: This procedure will void your warranty, and may fry your board! I take no responsibility to what you do to your board. Use this guide AT YOUR OWN RISK!!!

To do this procedure you’ll need a TTL 3.3V serial adapter to talk with the bootloader. I used a small Bluetooth to serial board with built-in level translators that I had around, but you’ll probably want to use something like the FTDI TTL serial to USB cable.

The first step to downgrading your DCM-202, to crack open the case and take the circuit board out. You should see something like this on the back:

Circuit Board

To recover the old firmware you’ll need to short the via highlighted in red, to the ground plane next to it while turning on the power to the board. This will hold one of the address lines to the flash ROM (the chip to the left of the image) low so that it’ll cause a checksum error when the bootloader tries to load the firmware, but won’t interfere with the bootloader which is also in flash. Note that, depending on your board, you may have to scrape off some of the green solder-mask to get to the metal underneath.

Here’s a listing of the serial output when booting normally:

Power-On
Uncompressing Image...
Application 1 Booting...

D-Link DCM-202 Running..

Model: DCM-202
Hardware version: 1A
Chip ID: PUMA-S
Speed: 125.00 MHz
Software version: 2.00.03D1.06
Bootloader version: 1.0.3
Build date: Jun 16 2009/10:34:45
System Object ID: ############
MAC Address: ############
Tuner Type: MicroTune MT2050

<<>>      <<>>
0x947ffdf0 (tRootTask): tnetd53xx_emac_phy_run_autoneg(0, 0x000102c7)
0x947ffdf0 (tRootTask): tnetd53xx_emac_phy_run_autoneg(0, 0x000102c7)
0x9477bea0 (tNetTask): tnetd53xx_emac_phy_run_autoneg(0, 0x000002c7)
0x9477bea0 (tNetTask): TNETD53XX_EMAC_MAC_CONTROL = 768
0x9477bea0 (tNetTask): TNETD53XX_EMAC_PHY_REG_GEN_CTL = 0x3100
0x9477bea0 (tNetTask): TNETD53XX_EMAC_PHY_REG_GEN_STS = 0x786d
Initializing Cable Modem DS/US Registers

And when resetting with that signal shorted it displays a boot menu that allows you to download a new image over the serial line using the xmodem protocol, or to select one of the two firmware images in the flash. The image named “Application 1” should be your old firmware, so all you have to do to boot it up is type in “1” and hit enter:

SW Reset SWR0
Uncompressing Image...
CRC32 error!

Uncompressing Image...
CRC32 error!

Uncompressing Image...
CRC32 error!

Unable to load Image1 or Image2

Micro Bootloader Version: 1.0.3

MENU
---------------------------
0>XMODEM receive then run
1>Application 1
2>Application 2
3>XMODEM send storage image
---------------------------
SELECT: 1

Uncompressing Image...
Application 1 Booting...

D-LINK DCM-202 Running..

Model: DCM-202
Hardware version: 1A
Chip ID: PUMA-S
Speed: 125.00 MHz
Software version: 2.00.03D1.07
Bootloader version: 1.0.3
Build date: Jul 22 2009/15:00:46
System Object ID: ###############
MAC Address: ##############
Tuner Type: MicroTune MT2050

<<>>      <<>>
0x947ffdf0 (tRootTask): tnetd53xx_emac_phy_run_autoneg(0, 0x000102c7)
Setting default sector to 1
Initializing Cable Modem DS/US Registers

0x9477bea0 (tNetTask): tnetd53xx_emac_phy_run_autoneg(0, 0x000002c7)
0x9477bea0 (tNetTask): TNETD53XX_EMAC_MAC_CONTROL = 768
0x9477bea0 (tNetTask): TNETD53XX_EMAC_PHY_REG_GEN_CTL = 0x1100
0x9477bea0 (tNetTask): TNETD53XX_EMAC_PHY_REG_GEN_STS = 0x786d
Initializing Cable Modem DS/US Registers

After that you should have your old firmware running and be able to telnet in once again. If you have any questions, just leave a comment and I’ll try to answer it.

Advertisements

~ by lwalkera on March 27, 2010.

4 Responses to “Restoring old firmware on a Dlink DCM-202”

  1. The short isn’t necessary.
    With your serial adapter attached,hit the reset button on the modem and keep hitting the esc key on the keyboard until you see the SECRET:
    prompt.Type info and hit the enter key.This will give you the MAIN> prompt which you can telnet from.Or you can get into the production menu by typing in production cbccm and then bootfrom 1 to boot the previous firmware.

  2. I would be very grateful to you for any details on how you connected the modem to the COM port of your PC. (I assume you used the Hyper Terminal utility of Windows or minicom of Linux/FreeBSD to talk to the modem.) The problem is that USB-to-RS-232 converters require a virtual port driver for the underlying OS — in this case, vxWorks. As I have no way to add that driver to the version of vxWorks pre-installed in the flash EPROM of the modem, I need to use a converter chip already supported by it. Hence my interest in the details: you obviously found a supported chip. I’d buy a converter cable based on the same chip.

  3. I am having some trouble with this. First though for Alexander who asked sometime ago the settings that worked for me are 115200 8,N,1 no flow control.

    I wasn’t able to use the ESC key method mentioned by dr. zin, but I was able to short the via mentioned in the original post. My output looks exactly the same, but I can’t seem to transmit anything.

    Any ideas?

  4. It would be helpful if someone (or author himself) can post how to connect serial port to the modem otherwise this article is as useless as a blank paper for someone who is new to this.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: