Thomson TCW770 - freebsd/freebsd-wifi-build GitHub Wiki

Overview

Thomsom TWC770 is Broadcom-based cable modem with:

• BCM3380 SoC, 1 BMIPS43xx core with multi-threading, 300 MHz (unconfirmed)
• 64MiB RAM
• 8MiB SPI Flash (mx25l, SOP16)
• PCI-e based WiFi card (BGN)
• Ethernet Roboswitch BCM53115 with 4 1Gbit ports
• 1 USB2.0 port

BootLoader

Stock bootloader doesn't provide TFTP server/console. But it does:

• UART configuration (0xb4e00200)
• Stop other threads different from first
• Configure I/D caches
• Configure SDRAM
• Unpack (LZMA) stage2 bootloader (Firmware with magic = 0x3380)

Firmware

Aligned on 0x010000 (found - 0x020000, 0x400000). Flash may contains several firmware images (upgrade redundancy?)

Header (92 bytes):

• base + 0x00 = 0xa81c0005 (firmware header magic + control)
• base + 0x04 = 0x010001ff (version?)
• base + 0x08 = 0x5317fda2 (timestamp) = 1394081186 = 06 Mar 2014 04:46:26 GMT
• base + 0x0c = 0x00363851 (firmware size except header)
• base + 0x10 = 0x80004000 (load address)
• base + 0x14 = firmware name char[64] = "TCW770-B6.07.03.T4-140306-F.bin"
• base + 0x54 = 0x6af8 0000 (header checksum)
• base + 0x58 = 0x11757d30 (CRC)

Body starts with +0x5c = assumed LZMA start