Stay Freehttps://zlion.top/Firefly6.15.4https://github.com/CuteLeaf/Firefly2026年8月1日 16:45:03https://zlion.top/posts/e2633-e2638-ttl-ax3000/https://zlion.top/posts/e2633-e2638-ttl-ax3000/记录 E2633/E2638 通过 TTL 进入 u-boot 后，使用 TFTP 写入官方巡天 AX3000 版本固件的流程，并附保留 tag 与 wifi 分区的可选做法。Mon, 20 Jul 2026 00:00:00 GMT<div><div><div></div><div>风险提示</div></div><div><p>本教程涉及刷写 NAND 闪存，存在变砖风险。请自行评估风险后操作。内容仅适用于 256 MB 内存、WSON8 封装版本。</p></div></div> <section><h2>说明<a href="#说明"><span>#</span></a></h2><ol> <li>标题写“理论可行”，是因为原作者实际采用编程器整片写入；后来在刷 WiFi 分区时发现也可以直接通过 u-boot 刷入。</li> <li>由于是整片写入，刷完后默认 WiFi 名称会变为 <code>ZTE-Q2QHKu</code>，密码为 <code>bhdh3954</code>。</li> <li>无线校准数据 WiFi 分区、TAG 分区（SN 和 MAC 信息）都会被覆盖。原作者测试下来影响不大；如果想尽量完美保留这两个分区，可以参考文末的可选步骤。</li> <li>仅适用于 256 MB 内存、WSON8 封装的版本。</li> </ol></section> <section><h2>准备工作<a href="#准备工作"><span>#</span></a></h2><ul> <li>USB 转 TTL 模块 CH340G 一个，最好带杜邦线，方便连接。</li> <li>由编程器固件去掉 OOB 后生成的 <a href="https://wwbnc.lanzoub.com/idNc33xkhc4f" target="_blank">128 MB 镜像</a>。原教程中编程器固件来自 <a href="https://www.right.com.cn/forum/thread-8472425-1-1.html" target="_blank">hzw521</a>。</li> <li>MobaXterm 等串口工具。</li> <li>TFTP 服务工具。</li> <li>网线一根。</li> </ul></section> <section><h2>操作步骤<a href="#操作步骤"><span>#</span></a></h2><section><h3>1. 拆机<a href="#1-拆机"><span>#</span></a></h3><p>快拆可参考原教程中提到的<a href="https://www.bilibili.com/video/BV1ic7y6wE3E/" target="_blank">拆机视频</a>。</p></section><section><h3>2. 连接 TTL<a href="#2-连接-ttl"><span>#</span></a></h3><p>参考下图连接 TTL：</p><p></p><figure><img src="https://www.right.com.cn/forum/data/attachment/forum/202607/22/111254flissfe9fz4f9efe.jpeg" alt="TTL 接线参考" /><figcaption>TTL 接线参考</figcaption></figure><p></p></section><section><h3>3. 进入 u-boot<a href="#3-进入-u-boot"><span>#</span></a></h3><p>连接好后，使用 MobaXterm 等软件打开串口，波特率设置为 <code>115200</code>。</p><p>路由器上电后马上按 <code>1</code> 中断系统启动，输入密码进入 u-boot（密码来源见<a href="https://voz.vn/t/unlock-mesh-zte-e1600-2603-2615-thanh-phien-ban-quoc-te.903294/" target="_blank">原帖引用资料</a>）：</p><div><figure><figcaption></figcaption><pre><code><div><div><div>1</div></div><div><span>5cE080@fyBD</span></div></div></code></pre><div><div></div><div></div></div></figure></div></section><section><h3>4. 配置电脑网络和 TFTP<a href="#4-配置电脑网络和-tftp"><span>#</span></a></h3><p>使用网线连接电脑和路由器，关闭防火墙，将电脑 IPv4 改为手动配置：</p><ul> <li>IP 地址：<code>192.168.10.1</code></li> <li>子网掩码：<code>255.255.255.0</code></li> </ul><p>设置固件存放目录。此时先不要开启 TFTP 服务。</p><p></p><figure><img src="https://www.right.com.cn/forum/data/attachment/forum/202607/20/221326v8t5l45tv4k66mlj.png" alt="电脑 IPv4 配置参考" /><figcaption>电脑 IPv4 配置参考</figcaption></figure><p></p><p></p><figure><img src="https://www.right.com.cn/forum/data/attachment/forum/202607/20/221333x8qwa6o5aytx6tki.png" alt="TFTP 目录配置参考" /><figcaption>TFTP 目录配置参考</figcaption></figure><p></p></section><section><h3>5. 在串口终端设置 IP<a href="#5-在串口终端设置-ip"><span>#</span></a></h3><p>在 u-boot 串口终端中输入：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>setenv</span><span> </span><span>ipaddr</span><span> </span><span>192.168.10.2</span></div></div><div><div><div>2</div></div><div><span>setenv</span><span> </span><span>serverip</span><span> </span><span>192.168.10.1</span></div></div><div><div><div>3</div></div><div><span>ping</span><span> </span><span>192.168.10.1</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p>看到类似下面的提示即表示通信正常：</p><div><figure><figcaption></figcaption><pre><code><div><div><div>1</div></div><div><span>host 192.168.10.1 is alive</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p>此时再开启前面配置好的 TFTP 服务。</p></section><section><h3>6. 通过 TFTP 传输并刷写固件<a href="#6-通过-tftp-传输并刷写固件"><span>#</span></a></h3><p>在串口终端中通过 TFTP 将固件传到 RAM：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>tftp</span><span> </span><span>0x43000000</span><span> </span><span>e2631_no_oob_full_128MiB.bin</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p>传输完成后，确认下载大小必须为：</p><div><figure><figcaption></figcaption><pre><code><div><div><div>1</div></div><div><span>Bytes transferred = 134217728 (8000000 hex)</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p>确认无误后，擦除整片 NAND：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>nand</span><span> </span><span>erase</span><span> </span><span>0x0</span><span> </span><span>0x8000000</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p>然后一次性写入整片：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>nand</span><span> </span><span>write</span><span> </span><span>0x43000000</span><span> </span><span>0x0</span><span> </span><span>0x8000000</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p></p><figure><img src="https://www.right.com.cn/forum/data/attachment/forum/202607/22/111042clhollaa7jdk4xlo.png" alt="刷写过程参考" /><figcaption>刷写过程参考</figcaption></figure><p></p></section><section><h3>7. 重启<a href="#7-重启"><span>#</span></a></h3><p>刷写完成后执行：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>reset</span></div></div></code></pre><div><div></div><div></div></div></figure></div></section></section> <section><h2>可选：保留原机 tag 和 wifi 分区<a href="#可选保留原机-tag-和-wifi-分区"><span>#</span></a></h2><p>如果想保留原机的 tag 与 wifi 分区，可以在执行第 6 步整片擦写前，先把这两个分区读到内存中。</p><p>读取 tag 分区到 <code>0x42000000</code>：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>nand</span><span> </span><span>read</span><span> </span><span>0x42000000</span><span> </span><span>0x100000</span><span> </span><span>0x100000</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p>读取 wifi 分区到 <code>0x42100000</code>：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>nand</span><span> </span><span>read</span><span> </span><span>0x42100000</span><span> </span><span>0x200000</span><span> </span><span>0x100000</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p>两个分区读取完成后，再执行第 6 步擦写整片。整片写入完成后，将前面读取的 tag 和 wifi 分区写回。</p><p>写回 tag 分区：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>nand</span><span> </span><span>write</span><span> </span><span>0x42000000</span><span> </span><span>0x100000</span><span> </span><span>0x100000</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p>写回 wifi 分区：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>nand</span><span> </span><span>write</span><span> </span><span>0x42100000</span><span> </span><span>0x200000</span><span> </span><span>0x100000</span></div></div></code></pre><div><div></div><div></div></div></figure></div><p>最后重启：</p><div><figure><figcaption><span></span><span>Terminal window</span></figcaption><pre><code><div><div><div>1</div></div><div><span>reset</span></div></div></code></pre><div><div></div><div></div></div></figure></div></section>