Reply
Emerging Member
Posts: 71
Registered: ‎03-09-2014
Kudos: 22

When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC

[ Edited ]

This was my  Previous post This is pretty much the same as the below

 

See here for the mtdblock2 & mtdblock3 files to 3.7.49.6201.zip They seem to be too big to attach to the post. Theres also the firmware.bin file in there too if you want to try the urescue. This is the same firmware file as from the controller.

 

You'll need a TTL to serial converter to access the console within the UAP, available from a popular site for less than a fiver.In a pinch if you have an Arduino then you can hold the CPU in reset and connect to TX/RX/GND on the board. (Another hack)

 

You'll also need a working TFTP server with the files stored in its root directory under 3.7.49.6201 if they are anywhere else then you'll need to change the path below to match your configuration.

 

Its also worth noting that the TFTP server must be listening on 192.168.1.254 for the UAP to find it. A common mistake given by the number of messages I've received in the past. This means you might need to change your network settings or if you are using linux as your TFTP server then just bring up another instance of your adapater under that IP

e.g : ifconfig eth0:0 192.168.1.254 netmach 255.255.255.0 up where eth0 in my case is the primary adapater in the server.

 

The above applies if you want to try the urescue method first. Its well documented on these forums. If you've tried the urescue method and it didnt work this this might be a solution to get your UAP working again.

 

The commands you type are in blue, be careful and make sure that you dont miss type something.

 

U-Boot unifi-v1.2.1.71-g529c499d (Dec 21 2012 - 12:50:21)

Board: Ubiquiti Networks AR7241 board (e502-6.0101.002e)
DRAM:  64 MB
Flash:  8 MB
Net:   eth0, eth1
Hit any key to stop autoboot:  0
## Booting image at 9f050000 ...
   Image Name:   MIPS Ubiquiti Linux-2.6.32.33
   Created:      2017-03-15  18:15:50 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    921625 Bytes = 900 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum at 0x9f050040 ...Bad Data CRC               <- This is the problem that stops the UAP from booting

 

ar7240> tftp 83000000 3.7.49.6201/mtdblock2       <- get mtdblock2 from the TFTP Server and stores it in memory.
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename '3.7.49.6201/mtdblock2'.
Load address: 0x83000000
Loading: #################################################################
         #################################################################
         #################################################################
         ##########
done
Bytes transferred = 1048576 (100000 hex)
ar7240> protect off all                                 <- Turn off the write protect on the flash
Un-Protect Flash Bank # 1
ar7240> erase 0x9f050000 +0x100000          <- Erase the part of the flash ready to copy the memory into.
................ done
Erased 16 sectors
ar7240> cp.b 0x83000000 0x9f050000 0x100000          <- This copies the memory to the flash.
Copy to Flash... write addr: 9f050000
done
ar7240> cmp.b 0x83000000 0x9f050000 0x100000   <- compare the flash with the memory,

                        <- This is the important bit, if it fails try coping again.
                      
ar7240> tftp 83000000 3.7.49.6201/mtdblock3             <- get mtdblock3
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename '3.7.49.6201/mtdblock3'.
Load address: 0x83000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######
done
Bytes transferred = 6684672 (660000 hex)
ar7240> erase 0x9f150000 +0x660000          <- erase another part of the flash
...................................................................................................... done
Erased 102 sectors
ar7240> cp.b 0x83000000 0x9f150000 0x660000  <- copy memory into flash
Copy to Flash... write addr: 9f150000
done
ar7240> cmp.b 0x83000000 0x9f150000 0x660000   <- compare the flash with the memory,
Total of 6684672 bytes were the same                       <- again this is important.
ar7240> reset

Resetting...

U-Boot unifi-v1.2.1.71-g529c499d (Dec 21 2012 - 12:50:21)

Board: Ubiquiti Networks AR7241 board (e502-6.0101.002e)
DRAM:  64 MB
Flash:  8 MB
Net:   eth0, eth1
Hit any key to stop autoboot:  0
## Booting image at 9f050000 ...
   Image Name:   MIPS Ubiquiti Linux-2.6.32.33
   Created:      2018-03-17  18:34:44 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    924639 Bytes = 903 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum at 0x9f050040 ...OK                      <- Looking Good !!
   Uncompressing Kernel Image ... OK                             <- Looking even better !!

Starting kernel ...

Booting...                                                                      <- Cross fingers, drink tea and wait..

*** You wont see anyting more now from the device on the serial connection ***

 

Be paitent if it all went well then it will show up in the controller.

 

Highlighted
New Member
Posts: 5
Registered: ‎01-13-2017

Re: When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC

[ Edited ]

Hello good Morning. I followed the steps outlined above and everything went well, my UAP is calling up and up the operating system, now the problem I have is the following. I bought this used UAP and the reset button is not working and I do not know its username and password to be able to reset. Is there anything I can do ?? The urescue command does not work while inside the TTL console.

I have a working unifis on my park

Emerging Member
Posts: 71
Registered: ‎03-09-2014
Kudos: 22

Re: When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC


@matheussalerno wrote:

Hello good Morning. I followed the steps outlined above and everything went well, my UAP is calling up and up the operating system, now the problem I have is the following. I bought this used UAP and the reset button is not working and I do not know its username and password to be able to reset. Is there anything I can do ?? The urescue command does not work while inside the TTL console.

I have a working unifis on my park


HI,

If you have the AP open then you could short out the button if the button its self is damaged ?

 

I'm not aware of a way to reset the config via the TTL serial console.

New Member
Posts: 5
Registered: ‎01-13-2017

Re: When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC

Hi stevebird, tankyou for your reply

 

I think the button itself is not broken, it just does not perform any operation, the urescue command also does not work, Is there a way to extract the settings from one of my antennas that are working and insert this one?

So that I could access it through the ssh port and perform a reset of the settings.

Could you tell me which mtdblock file containing information on the configurations of the UIP unifi and how I would do to flash this information by TTL

Emerging Member
Posts: 71
Registered: ‎03-09-2014
Kudos: 22

Re: When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC

here are the mtdblocks and what they are each used for :
dev: size erasesize name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00100000 00010000 "kernel"
mtd3: 00660000 00010000 "rootfs"
mtd4: 00040000 00010000 "cfg"
mtd5: 00010000 00010000 "EEPROM"

Be cautious about the first two, if you damage these then you will have efrectively bricked the device.

You can exract these from a working AP, the way I have done it is via piping the output via a SSH shell from another linux box. eg -

ssh -l APadmin 192.168.0.210 cat /dev/mtdblock0 >./mtdblock0

where 192.168.0.210 is the source AP I am extracting the partion from , APadmin in my case is the admin user and then it will prompt for the passwod defined in the control manager etc.. once you have done this for all the individual partitions you can use the above method to write them to a new AP.

Be aware that if you write mtdblock5 to a new AP then that new AP will effectively be a clone including the MAC address of the source AP. You can edit the image with a hex editor, one to watch out for though..

I only ever write mtdblocks 2 & 3 and sometimes 4 although with a factory reset and re-adopting that gets overwritten anyway.

if you can SSH into the AP (not via the TTL method) then you can do type syswrapper.sh restore-default to factory reset it. However from what you describe you're not at that stage yet that its even booting properly?
New Member
Posts: 5
Registered: ‎01-13-2017

Re: When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC

Ok, this is what I was thinking, I already extract all mtd blocks, but I did not know what cfg was.
So now I have two new questions.

Is there any problem in performing the CFG flash on the same APs with different firmware versions?

And how do I perform the flash only from mtdblock4?

 

And tankyou very much 

New Member
Posts: 5
Registered: ‎01-13-2017

Re: When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC

Yes, its booting properly, and cames up with the seller configuration, and i dont know the user and password to ssh into it. 

I think the best shot is flashing the mtdblock4 with a clean UAP settings, but i  dont know how to do it. 

I did the flash of mtdblock2 and mtdblock3 follow your guide, and thats came the UAP back to life, now the problem its only the cfg it self

 

Emerging Member
Posts: 71
Registered: ‎03-09-2014
Kudos: 22

Re: When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC

[ Edited ]

@matheussalerno wrote:

Yes, its booting properly, and cames up with the seller configuration, and i dont know the user and password to ssh into it. 

I think the best shot is flashing the mtdblock4 with a clean UAP settings, but i  dont know how to do it. 

I did the flash of mtdblock2 and mtdblock3 follow your guide, and thats came the UAP back to life, now the problem its only the cfg it self

 


Hello.

To answer your previous question about using a partition from a different version, I'm not sure what the effect would be, but given its easy to avoid I wouldnt bother trying.

 

Attached is mtdblocks from version 4.0.15.9872

 

I've not included the EPPROM partition as if you wrote that you would end up with a clone of my AP. These mtdparts are from a newly flashed AP waiting to be adopted and therefore in a default state. username/password for the ssh is ubnt/ubnt but you'll probably not need that as after a reboot it should show in your controller waiting to be adopted and then it'll provision with your settings.

Attachment
New Member
Posts: 5
Registered: ‎01-13-2017

Re: When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC

Thank you one mor time, you are the best

 

But tell me one thing, which mtdblocks I should flashing, yesterday I made the flash of mtdblock4 and with that I got access to UAP, I was able to perform the default factory, but now it is called Error A12, it is working and I can on the console, but this error persists. Yesterday I got access to it and I already performed the update for version 4.0.15.9872

Emerging Member
Posts: 71
Registered: ‎03-09-2014
Kudos: 22

Re: When urescue doesnt work or you have Verifying Checksum at 0x9f050040 ...Bad Data CRC


@matheussalerno wrote:

Thank you one mor time, you are the best

 

But tell me one thing, which mtdblocks I should flashing, yesterday I made the flash of mtdblock4 and with that I got access to UAP, I was able to perform the default factory, but now it is called Error A12, it is working and I can on the console, but this error persists. Yesterday I got access to it and I already performed the update for version 4.0.15.9872


If its showing on the controller I would as a starting point 'forget it' and then re-adopt it. That should remove the config and restore it back to factory settings and then provision it with current settings again.

Reply