MDI Clones and Techline

[ironduke]

If you google there is a way to do it.. I haven't done it in so long I'm rusty about it, might have to find my half dead one and practice. I've posted some so s instructions on here and I know it's on mhh as well. It's kinda involved if you don't work with linux and do this type of thing. I can do it, but not my much, lol.. Instructions are below but there is a little better way instead of using telnet where I just copied mtd10 to SD card, took the card out and put in a computer, then modded mtd10 and put it back on card, reinserted card into mdi and copied back to flash. I'll tyr to find it. Below is copied from mhh and this web site copied it and posted it up as well. http://blog.obdexpress.co.uk/2018/12/06 ... al-number/

The serial number is in the 16mb on board flash memory - the intel chip on the computer sub-board.

You can get u-boot access by making up a serial cable. Signals are available on the 8 pin mini din on the outside of the MDI case. pin 1 goes to PC TX (MDI RX), pin 2 goes to PC RX (MDI TX). Pin 3 goes to ground.

Mount the sdcard parition 1 under linux on your computer, and rename telnetd.sh-disabled to telnet.sh in /bin. While there I also edited the init script and added this near the start to make the prompt nicer:
Quote:
export PS1='[\u@mdi \W]\$ '

Access u-boot (38400 baud), and at the prompt type:

Quote:
>>askenv setbootargsprimary

Please enter 'setbootargsprimary':run normalargs addinit addconsole addeth addprimary;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(lin?ux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(?macaddress),128k@16256k(id);

>>boot

The MDI will boot and start a telnet server on its IP and have a new flash partition configured as /dev/mtd10 called 'id'. This will align with the erase block so can be updated. Check in /var/log/messages for the presence of 'id' without it being forced readonly.

Telnet in and rip a copy of mtd10 with dd, and send it to an ftp server you have setup on your lan.

Quote:
[root@mdi ~]# cd /tmp
[root@mdi tmp]# dd if=/dev/mtd10 of=mtd10.img
256+0 records in
256+0 records out
[root@mdi tmp]# ls -l mtd10.img
-rw-r--r-- 1 root root 131072 Jan 1 00:07 mtd10.img
[root@mdi tmp]# ftpput -u <user> -p <pass> <ip> mtd10.img mtd10.img

Now load up mtd10.img on your pc in HxD or Hexworkshop. The serial is at 0x10000 with a crc32 checksum of 0x10000->0x17FFB at 17FFC (LSB).

MAC is at 18000 with a crc32 checksum 0x18000->0x1FFFB at 1FFFC.

Update both (just change the last couple of numbers), and use the calculate checksum feature of the hexeditor to calculate crc32 the sums of of the ranges and save the new sums in the bin (remember to enter them in LSB format).

Now pull the files back to the mdi, and update flash:

Quote:
[root@mdi ~]# cd /tmp
[root@mdi tmp]# ftpget -u <user> -p <pass> <ip> mtd10-new.img mtd10-new.img
[root@mdi tmp]# cd /usr/local/mtd/
[root@mdi mtd]# ./flash_unlock /dev/mtd10
[root@mdi mtd]# ./flash_erase /dev/mtd10
Erase Total 1 Units
Performing Flash Erase of length 131072 at offset 0x0 done
[root@mdi mtd]# ./flashcp /tmp/mtd10-new.img /dev/mtd10
[root@mdi mtd]# dd if=/dev/mtd10 of=/tmp/mtd10-readback.img
256+0 records in
256+0 records out
[root@mdi mtd]# md5sum /tmp/mtd10-new.img /tmp/mtd10-readback.img
1a1f4fb7db878218c558b45c0db50c9f /tmp/mtd10-new.img
1a1f4fb7db878218c558b45c0db50c9f /tmp/mtd10-readback.img

Now reboot the MDI, and hold down the power button so it goes in to recovery mode. Use MDI manager to recover the device. Once completed it'll have the new serial and mac.

[hjtrbo]

Awesome. Guess I'm trying out Linux

[ironduke]

Awesome. Guess I'm trying out Linux

There is a way to read the SD card in windows, I can't remember what I used.. something like extfsd or something.. It was on github.. I think windows 10 or windows 11 is supposed to be easier to read a linux sd card with but I don't remember where I read that? Wit hthe program I found on github the newest version almost borked my hard drive so careful, I'd recoment a vm or a old laptop or something your not too concerned with. I had to remove the program and use an older version with windows 7.. I think it was windows 7, lol it was a while ago..

[beeradoc]

Awesome. Guess I'm trying out Linux

There is a way to read the SD card in windows, I can't remember what I used.. something like extfsd or something.. It was on github.. I think windows 10 or windows 11 is supposed to be easier to read a linux sd card with but I don't remember where I read that? Wit hthe program I found on github the newest version almost borked my hard drive so careful, I'd recoment a vm or a old laptop or something your not too concerned with. I had to remove the program and use an older version with windows 7.. I think it was windows 7, lol it was a while ago..

So I have a laptop with unbuntu on it that i use for navigation sd cards sometimes, will that allow me to connect and do it?

[antus]

Should do, it also doesn't need to be installed, you can boot and run off of a live copy on USB. Or in a VM etc.

[ironduke]

Looks like I'll be changing the serial on one shortly.

This time I will try to document better and maybe save the info online instead of losing everything when I lose a hard drive or change computers.
I swear I remember an easier way of doing it. Using the serial port, setting up the file system and booting the mdi, changing the serial and then restoring but I'll be damned if I can find it complete, just notes here and there.

As far as reading the SD card, anything that can read it and modify the card data should be fine. Your renaming and text editing files, nothing too serious.

[hjtrbo]

Looks like I'll be changing the serial on one shortly.

This time I will try to document better and maybe save the info online instead of losing everything when I lose a hard drive or change computers.
I swear I remember an easier way of doing it. Using the serial port, setting up the file system and booting the mdi, changing the serial and then restoring but I'll be damned if I can find it complete, just notes here and there.

As far as reading the SD card, anything that can read it and modify the card data should be fine. Your renaming and text editing files, nothing too serious.

[ironduke]

ok.. I haven't even compared these instructions to the ones above. Please try one or the other. The ones below I just did.. I still feel there is an easier way but I couldn't get the web page loaded renaming testmode so I gave up after a few minutes. In any case I need someone to work with me to validate these since I'm not so good at typing these out.

Instructions to change serial number on a clone MDI. Have NOT tested on a fake MDI2 and I do not have one to test with. Feel free to try and let us know how it goes.

new instructions..

Code: Select all

1) This is modifying the SD card files a little. Need the card from the MDI installed in something that can read and write linux.
  a)Take SD card  from MDI and install into reader.
  b)find bin/telnetd.sh-disable and rename  to "telnetd.sh"
  c)Add  << export  PS1='[\u@mdi \W]\$ ' >> to the top of init_script.sh   **everything between the << and >> including the '


2) Booting up MDI with serial cable connected and serial terminal running. This is so we can modify the boot and add a partition.
  a)Now you need the serial cable connected to the MDI.
  b)Reinstall the modified SD card with the modified files into the MDI and power it up.
  c)With a serial program connected at 38,400 press any key during boot at the prompt.
  d) type in  "askenv setbootargsprimary"
  e) type in "run normalargs addinit addconsole addeth addprimary;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress),128k@16256k(id);"  
  f) now type "boot" and the mdi should restart and boot.

3)  Now we have the MDI booted up with the changed files and telnet should be running.
 a)open up a telnet program. I used the windows 10 built in program by typing in telnet into the search prompt on taskbar.
 b)type in o 192.168.171.2 to open a  telnet session.
 c) type in "dd bs=512 if=/dev/mtd10 of=/usr/local/include/mtd10" and this copies mtd partition as a file to sd card.
 
4)Now shut down MDI, install SD card into the computer and locate the mtd file in the include folder.
 
5)modify the file time!! Load up mtd10 on your pc in HxD or Hexworkshop. 
 The serial is at 0x10000 with a crc32 checksum of 0x10000->0x17FFB written at 17FFC-17FFFF (LSB).
 The MAC is at 18000 with a crc32 checksum 0x18000->0x1FFFB at 1FFFC.  << this is not needed to change serial.

 Update both (just change the last couple of numbers), and use the calculate checksum feature of the hexeditor to calculate crc32 the sums of of the ranges and save the new sums in the bin (remember to enter them in LSB format).
 Check that you understand how the crc is written before changing anything. Setup the checksum, get the crc and see how it's entered LSB format. 
 Again. CRC32 is written back to front here!!! If in doubt send me or someone else the file who knows how to do this. or post it up here.
 Don't forget to SAVE THE FILE!!! You can rename it but you'll need to modify the instructions below accordingly if you do.. 
 
6)now that  the mtd10 file is changed with the new serial number put it back in the mdi and serial cable connected.
  a) Boot up the mdi but stop boot using serial terminal again.
  b) Type in  "askenv setbootargsprimary"
  c) Type in "run normalargs addinit addconsole addeth addprimary;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress),128k@16256k(id);"  
  d) Now type "boot" and the mdi should restart and boot again with the added partition again.
  
7) Time to  telnet in and finish up.. almost done!!
 a)open up the telnet program again.
 b)type in "o 192.168.171.2" to open a  telnet session again. 
 c)now type  cd /usr/local/mtd/" and the next prompts should change to "[root@mdi mtd]#"
 d)Type in "./flash_unlock" /dev/mtd10 to unlock the flash partition. do NOT stop now!!!
 e)Type in "./flash_erase" /dev/mtd10 to erase the flash partition do NOT stop now!!!
 f)type in "dd bs=512 if=/usr/local/include/mtd10 of=/dev/mtd10" and this copies mtd file back into flash partition.
 
 Congrats!!! You should have seen 
256+0 records in
256+0 records out

As long as you saw it write the modified file back go ahead and shut down the MDI, power it back up holding down the power button to put it in recovery mode and recover the MDI.. all done!!!

[beeradoc]

Those instructions look great, looks like a project for a rainy day.

Can the serial connection to the mdi be made using a usb cable or does it require a proper serial connector at the pc end?

[ironduke]

Those instructions look great, looks like a project for a rainy day.

Can the serial connection to the mdi be made using a usb cable or does it require a proper serial connector at the pc end?

Requires a serial connection. Ground,serial in, serial out. Only 3 wires needed..
IF you are asking about a USB to serial adapter than I believe that would work.

copied this pic from viewtopic.php?p=50399&hilit=gm+mdi#p50399

MDI serial connector external.png (245.2 KiB) Viewed 497 times