War-1a JTAG Instructions

Posted by on Jul 4, 2013 in jtag, tips & tricks | 0 comments

Quick guide to using a Wiggler JTAG to reprogram a Compex WP543 Access Point (Siam WAR-1a)

 

Download the supporting files here

Download war1a-jtag.zip

 

The steps are quite easy, but different than those used to reprogram other hardware primarily due the WAR-1a’s use of a Serial flash, which cannot be programmed by the standard Macraigor flash programmer.

What you will need include:

  • Macraigor Wiggler (or suitable clone) – LPT, USB, or Ethernet will do.
  • OCD Commander (Free software)
  • Serial converter for the WAR-1a (supplied by Compex) – consists of a serial port, and a small cable to plug into the WAR-1a
  • Serial terminal – Putty can be used for this
  • Web server that can be accessed via 192.168.1.1 IP address (on the same subnet is preferred) – any webserver will do.

If you are using an LPT based Wiggler, you must use Windows XP with your LPT port set to EPP (ECP is not supported), and OCD Commander v2.5.6 or earlier (latest is v2.5.8).

In the attached archive you will find screenshots, and these three important files

  1. redboot.ram
    • This is a RAM-based bootloader that will be used to reprogram the WAR-1a.
  2. init-war1a.mac
    • This is a macro used in OCD Commander to initialize the WAR-1a, and then upload the redboot.ram file.
  3. firmware.bin
    • This is the GeckoV4 4.1.9.4 release we will be flashing to the WAR-1a
The following instructions will assume you are using the more common LPT-based Wiggler.

1.

Place the firmware.bin file into / (root) of your web server, and ensure you can access it via http://192.168.1.2/firmware.bin

2.

Launch OCD Commander (not OCD Commander – JAVA)

On the connection dialog, please ensure MIPS is selected, along with EJTAG 2.5, 32 bit, and OCD Speed of 1: 380 KHz, then click Ok.

connection-dialog

Press the reset button at the top left of your OCD Commander window, and ensure no errors occur.

Go to the menu Commands->Macro, and navigate to, and select the war1a.mac file you previously unpacked.  Ensure all supporting files are in the same location.

You will see a bunch of macros executing, programming the WAR-1a, but will soon encounter a dialog that says “Write large: target bus error (40 : 11)

error

Do not be alarmed when you encounter this dialog, as it is expected and part of the WAR-1a initialization.  It occurs when the WAR-1a’s PLL is adjusted, and is completely harmless.

Simply click Ok, then click No on the following dialog that asks if you wish to cancel the macro execution. You should see no further errors.

The final “download redboot.ram…” message will take some time, about 4 1/2 minutes so do not be alarmed.  Your WAR-1a will reboot into redboot after this is complete.

3.

On your serial console, you will see a redboot prompt.

redboot

Everything to this point is temporary, and your WAR-1a can be restored to it’s previous firmware by simply rebooting it.

4.

Copy, and paste these lines one at a time to reprogram your system.

  1. ip_address -l 192.168.1.1/24 -h 192.168.1.253
  2. load -r -m HTTP -b 0x81000000 firmware.bin
  3. fis write -f 0xbf000000 -b 0x81000000 -l 0x634bc7

When prompted to continue, press y for yes.  The screenshot below illustrates a successful upgrade.

redboot-done

Your WAR-1a now has a factory GeckoV4 4.1.9.4 release installed, and can now be rebooted.  You can obtain your original license from license-keys.com.

Note: You must unplug the jtag from your WAR-1a in order for it to boot properly.

GeckoV4 4.1.9.4 is the latest release as of this article, however if there is a newer one, you can upgrade your system again after it has been re-licensed. Please do not substitute firmware.bin for a newer / older release as it will not program correctly given the values shown above.