Flash firmware to bricked IP telephone?

[ZippyDan]

Can anyone take a look at this picture of a circuit board and tell me if there are any programmable chips on it?

http://imgur.com/a/i55O8

The backstory is this: this is an IP telephone with updateable firmware. I'm fairly certain I have maybe a half-dozen of these phones which experienced a bad or interrupted flash during a firmware update (user pulled the plug in the middle of flashing) and now they won't boot at all. I'm wondering if there is anyway I can buy a device that will allow me to copy the firmware off of a working device and manually flash it to one of the bricked devices. I'm not sure if that is completely far fetched (like fixing a bricked cell phone) or more realistic like a EEPROM device for reading/flashing an old-school CMOS chip.

 

[postmortemIA]

you have JTAG ready connectors in bottom left, so if anything is possible, it would go through it.

 

[ZippyDan]

you have JTAG ready connectors in bottom left, so if anything is possible, it would go through it.

Ah yes, I see them. Reminds me of old times modding original xBox systems. Assuming this would be possible, what hardware would I need to read from a working board and write to a bricked board from a PC I guess? I'm good with computers, but not really so knowledgeable about low-level circuitry.

 

[videogames101]

looks like some good info

http://www.usbjtag.com/vbforum/forumdisplay.php?f=20

on using this product:

http://www.usbjtag.com/

but thats about all i could find, maybe there's enough there to help you figure out a diy solution

 

[imagoon]

FYI that Intel Flash has block protection, both software and hardware locking, bit keys to block device substitution etc. None of that may be in use however but just an FYI that it does have security protections inside it and it can make "amusing" to flash or 'impossible' if the phone actually checks the device signature.

What is odd in my mind is that the phones normally lock the sections of the boot firmware effectively making them impossible to delete so it can boot enough to flash.

 

[ZippyDan]

FYI that Intel Flash has block protection, both software and hardware locking, bit keys to block device substitution etc. None of that may be in use however but just an FYI that it does have security protections inside it and it can make "amusing" to flash or 'impossible' if the phone actually checks the device signature.

What is odd in my mind is that the phones normally lock the sections of the boot firmware effectively making them impossible to delete so it can boot enough to flash.

I'm not sure if I understand your last sentence, but there was a specific onscreen warning not to power off the phone during flashing or you would brick your device. Perhaps there wasn't enough room on the phone's flash to maintain both the old and new firmwares? Firmware was flashed on this phone via network connection, so it would require network settings as well to connect to the server hosting the new firmware.

 

[imagoon]

I'm not sure if I understand your last sentence, but there was a specific onscreen warning not to power off the phone during flashing or you would brick your device. Perhaps there wasn't enough room on the phone's flash to maintain both the old and new firmwares? Firmware was flashed on this phone via network connection, so it would require network settings as well to connect to the server hosting the new firmware.

I am still surprised. I can rip the cord out of the phones here while flashing and they still have a enough brains to connect to the network and download their flash image. Cisco, Mitel, Nortel etc recover.

On the phone I have used at least... the firmware flash procedure is not stored in the image, it was a protected block "boot loader" that uses something similar to these chips and block protection so they can't be wiped. Chips like the intel one in your picture won't erase protected blocks.

Your phones may be different but my point was to not expect them to work if you replace the flash chip nor may the flash be straight forward since the devices has block protection and signature registers. It is never impossible, you would need knowledge of what goes where and what the signatures and block configuration is.

 

[postmortemIA]

I would ask manufactur if they have some support for bricked devices. At least they could share what JTAG device is compatible with the phone.
The ones that I've used cost surely more than dozen of your phones, and are for specific purpose...

 

[gsaldivar]

I would start by contacting the manufacturer. A quick search of their website indicates that Allworx has a program in place for becoming an authorized partner. You might want to ask if they have paperwork that you can complete just for access to the repair hardware & software. http://www.allworx.com/telephony-partnership

 

[inachu]

Hey I took apart a Nortel phone and it looked just like your picture!

Those phones for companies are a dime a dozen. sadly I think that phone is a goner.

I mean is is possible to unbrick it? Yes. But do you really want to invest that much time into it? If you truly are a hardware hacker and really gung ho then sure go for it.

Otherwise trash it. You could always ask some nortel forum if any IP phone techie could guide you.

Try this webforum on that flash chip:
http://www.usbjtag.com/vbforum/archive/index.php?t-1879.html

 

[SunnyD]

Are you SURE it's bricked?

More often than not when devices like this end up with borked firmware they fall back into a secure preboot TFTP mode or can be forced into a TFTP mode where you can load a new firmware via TFTP directly.

 

[KWiklund]

It's common practice in many devices with updatable firmware to have a block of protected data that stores the original (and functional) firmware. This allows for recovery in the event of a bad update. The manufacturer should be able to tell you more about whether this is a possibility, and how it might be done.

 

[ZippyDan]

Based on the pictures, can anyone tell me which chip is likely to be the CPU?

I looked up all the chips that seemed important and came up with this list:

Marvell 88E6021-RCJ Ethernet Controller
Texas Instruments TMS 320VC547 Digital Signal Processor
Pulse H2009 Power Over Ethernet
Intel TE28F160 C3BD70 Flash Memory
Micron 48LC2M32B2 64MB SDRAM
Cooper Industries CTX01-16679 Power Inductor
Texas Instruments TLV320AIC22C Audio VOIP Coder/Decoder

Am I wrong to think of this phone as having some basic OS / architecture? What is the main CPU of this phone? None of those chips seem like the big boss, but I think one of them has to be. One of the TI chips?

 

[Lorthreth]

It's the TMS320VC5471.

It has an ARM7TDMI microcontroller alongside the DSP.

 

[ZippyDan]

It's the TMS320VC5471.

It has an ARM7TDMI microcontroller alongside the DSP.

Much thanks!