• 1
    Step 1

    Using the 16 pin chip clip, connect the modem 16 pin SPI flash MX25L6406E to the SPI Hook using the pin table below.

    SPI Hook J2SPI FlashDescription
    12Vcc
    210Gnd
    37CS#
    416SCLK
    58MISO
    615MOSI
    Vcc1HOLD#
    Vcc9WP#

    The connections will look like this. My wires were the wrong gender so I had to use a breadboard in between.


    Overall setup


  • 2
    Step 2

    flashrom that comes with Ubuntu 16.04 does not include support for the FT2232H Hi-Speed Dual USB UART/FIFO IC and must be recompiled using the following steps.

    $ sudo apt-get install libftdi1
$ sudo apt-get build-dep flashrom
$ cd flashroom-*
$ make

    1. Run the tool and read the contents of the flash chip.

    $ sudo ./flashrom -p ft2232_spi:type=2232h,port=A,divisor=4 -c "MX25L6406E/MX25L6408E" -r sb6141.bin
flashrom v0.9.9-rc1-r1942 on Linux 4.4.0-59-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on ft2232_spi.
Reading flash... done.

    2. Create a backup of the file.

    cp sb6141.bin sb6141-edit.bin

    3. Erase the application partitions. This creates a blank (0xff) file to serve as the erase. (0xff signifies an erased byte) in most SPI flash memory chips. 

    tr '\0' '\377' < /dev/zero | dd of=ubfi_blank.bin bs=1 count=3866624
dd if=ubfi_blank.bin conv=notrunc of=sb6141-edit.bin bs=1 seek=262144

    4. Write the forceWare application to both partitions.

    dd if=forceWare-1.4b1-mod2.bin conv=notrunc of=sb6141-edit.bin bs=1 seek=262144
dd if=forceWare-1.4b1-mod2.bin conv=notrunc of=sb6141-edit.bin bs=1 seek=4128768

    5. Flash the new flash image to the SPI flash.

    $ sudo ./flashrom -p ft2232_spi:type=2232h,port=A,divisor=4 -c "MX25L6406E/MX25L6408E" --layout sb6141.layout --image ubfi1 --image ubfi2 -w sb6141-edit.bin 
flashrom v0.9.9-rc1-r1942 on Linux 4.4.0-59-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org
Using regions: "ubfi1", "ubfi2".
Calibrating delay loop... OK.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on ft2232_spi.
Reading old flash chip contents... done.
Erasing and writing flash chip... Erase/write done.
Verifying flash... VERIFIED.

    6. Disconnect the chip clip and power cycles the modem.

    7. Connect to the modem over SSH using user root password force.

    ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 root@192.168.100.1

    8. Connect to the web interface http://192.168.100.1 using user admin password force.