Hi all,
I just came across this thread, lots of great info here. About a year ago I got a free ECW220v2 from Engenius, I liked it enough that I bought a second one and have been running them without any issues. This seems like as good a place as any to share some info.
I decided that I wanted to move away from their cloud management so last week, and before I found this thread, I foolishly tried to flash the Netgear WAX610 firmware via web interface knowing that the hardware was the same. I didn't actually expect the fw would be accepted, turns out it was and the device went into a boot loop. Power light would be orange for 30 seconds and then briefly turn off and repeat indefinitely. Oops.
On the corner of the board there is a socketed header, an OpenWRT post indicates it is a 4 pin 1.25mm pitch JST connector but I can't verify. Without having the proper connector I very crudely hooked into the UART (115200 8N1) and could read the console output no problem but had no ability to input anything. No idea if that's an error on my end or if the device is simply read only. I was sure I could tftp a proper fw back on if only I could input commands but seemed stuck.
Through the console logs I learned the first ~2 seconds after power on are a POST for IPQ60xxLZB-2, then "U-Boot 2016.01-ECW220v2-uboot_version:V1.0.0 [Attitude Adjustment 12.09.1,cb397a1] (Apr 28 2020 - 17:14:32 +0800)" loads and tries to start the device. If using POE it self assigned 192.168.1.1 and tried to upload a dump file, EBICS0.BIN, via tftp to 192.168.1.10 and then reboot. If on power only it would try to boot, fail and reboot and retry after approx 30 sec.
There was something more interesting in the log: "Booting from NAND FW1"
Could there be a FW2? There is as a matter of fact and you don't need console access to switch to it. On the board, right next to the UART connector there is a tiny unsoldered area marked SW2, there is no actual switch there but I decided I'd try to short the solder points with a bent paper clip to trigger the switch. I didn't entirely figure out the process and this was very tricky with only two hands but I'm pretty sure if you short SW2 while powering on or at the very beginning of POST, it will switch to the other FW image and you do seem to have to hold it for at least a few seconds. The button didn't seem to do anything after the boot process has begun. This successfully got me booting into FW2 and up and running again on the Engenius image. Thanks goodness for the dual images.
I ran on FW2 for several days without issues and then decided to see if I could fix FW1. If I recall correctly, I think updating the fw via the cloud interface only updates whatever image you're booted into but updating locally with the web gui using ecw220v2-1.5.60-24.bin updates both FW1 and FW2. The web interface rejected my attempt to upload EWS357APv2-v3.9.3.2_c1.9.51.bin
The main lesson here, which seems obvious, is don't do what I did and expect the device to prevent you from doing dumb things. The second point is that not all hope is lost if you do, even without console access.
I'm really impressed to see what Dave Corder pulled off, it gives me hope that the ECW220 can be converted into the EWS357. I'm just probably not the man for that job if I can't figure out how to get the console working.
Hope someone finds this interesting or perhaps even helpful!