Proof of Ubiquity AP Tampering

uart_log.txt

DRAM cfg init type(1): predefined first

U-Boot SPL 2018.03 [UniFi,v1.1.49.79] (Apr 01 2021 - 13:07:30 +0800)
Trying to boot from MTK-MMAP
\x02\x02\x02\x02\x1B\x1B\x1B\x02

U-Boot 2018.03 [UniFi,v1.1.49.79] (Apr 01 2021 - 13:07:30 +0800)

MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
DRAM:  256 MiB
Loading Environment from SPI Flash... SF: Detected mx25l25635f with page size 256 Bytes, erase size 64 KiB, total 32 MiB
OK
In:    uartlite0@1e000c00
Out:   uartlite0@1e000c00
Err:   uartlite0@1e000c00
Net:   eth0: eth@1e100000
SF: Detected mx25l25635f with page size 256 Bytes, erase size 64 KiB, total 32 MiB
load ubntapp ok
Board: Ubiquiti Networks MT7621 board (a612-15.0000)
UBNT application initialized 
 *WARNING*: Could not parse FW version, please check FW format
is_default true
is_ble_stp = true

~~~ p_device_model:U6-LITE
~~~ is_default:1 ~~~
~~~ p_macaddr:78:45:58:46:fe:64 ~~~
~~~ is_ble_stp:1 ~~~
=========================GPIO INIT=====================
GPIO_16, action is output low
GPIO_16, action is output high
GPIO_19, action is output low
GPIO_19, action is output high
=========================UART_3 INIT=====================
uartlite0@1e000c00, 1e000c00
uartlite0@1e000e00 bring up, 1e000e00
=========================FLOW 1=====================
[BT Power On Result] Success

=========================FLOW 2=====================
[HCI RESET Result] Success

=========================Extend FLOW=====================
[HCI LE BT MAC ADDR Result] Success

=========================FLOW 3=====================
[HCI LE SET ADVERTISING PARAMETER Result] Success

=========================FLOW 4=====================
[HCI LE  SET ADVERTISING DATA Result] Success

=========================FLOW 5=====================
[HCI LE  SET SCAN RESPONSE Result] Success

=========================FLOW 6=====================
[HIC LE  SET ADVERISTING ENABLE Result] Success
MT7915 BLE broadcasting successfully
Autobooting in 2 seconds, press "<Esc><Esc>" to stop
ubnt boot ...
SF: Detected mx25l25635f with page size 256 Bytes, erase size 64 KiB, total 32 MiB
Erasing cfg partition ...... SF: 1048576 bytes @ 0xd0000 Erased: OK
done.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T \xFE\xF0\0\0\xFF\xF8\0\0\0\0T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T T T T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08\xE0\xFF\xFE\xFF\xFF\xFE\xFE\xF8\xFF\x7F\xFF\0\xFF\xF8\xF0\xFF\xF0\x80\xF8\xFF\xFF\0\xFF\xFE\xFE\xFF\xFF\xFF\xE0\xFE\xFF\xFC\xFE\xE0\xFF\x1F\0\xFC\x80\xC0\xFC\0\xC0\xC0\xC0\xFF\xC0\xF8\xF0\0\0\0\xFC\xFC\xF0\x10\xFF\x7F?\xFF\x7F\xFF\xE0\xFC\xFF\0\0\xFF\xFC\xC0\0\xFF\xFE\x7F\xFF?\xC0\xFC\xF0\xFE\xF8?\xFF\x7F\xFC\xFE\xE0\xF0\xC0\xFE?\xF8\xFC\xF0\xFE\xFE\xFE\xFF\xC0\xF8\xFF\xE0\0~\xF8\xC0\0\0\0\0\xE0\0\xFF\xFF\xFF\xF0\xFE\0\xFF\xFF\0\0\xFF\0\0\0~\0\0\0\0\0\0\0\0\xFF\0\0\0\0T \xFC\xE0\xF8T \0\0\xFF\xF8\xFE\0T \xFC\0\xFF\0\0\xFF\0\x03\x01\0\xFE\0\0\0\0\0\0\0\0\0\xFC\0\0\xF8\xF0\0\0T \0\0\0\0\0\0\0\x14\xFF\xE1\xFF\0\0\0\0\0\x04\xFF\0\0\0\0\xFC\x0F\0\0\xE0\xF3\xFE\0\xC1\xE0\xFF\x88\xE6\xE0\xFC\0\0\xE0\0\0\0\xC0\x80\0\xFF\x80\xF8\xFC\0\xFE\0\0\0\x01\0\xFE0\0\0\0T \0T T \0\0\0\xF0T \0\0\0\0\0\xF9\xC0\0\xFF\xE0\0\0\xFE\0\xFET \0\x18\xFF\0\0\0\0\x80\0\0\0\0\x03\xF0\xFC\x0E\0?\xF7\xE0\x84\0\xFE\0\0\0\0\0\0\xFC\0\xE0\0\0\0\0T \0T T \0P \xFE\0T \xFCT \xF8\x01!\xC1\xFE\xFE\xFC\x80\xF0\xFF\0\x1C\xFC8\xCC\0\x02\xFEA\x8A\x04\0\xF7\x01\0\xFF\x1F\xE0\xE3\xFF\xF9\0\0\0\xFF\x80\xFC\0\x02\0\0\x80\0\0\xC0\0\xFC\0\0\0\0\x10\0\x90\0\0\xC0\0\xFF\0\xFF\x80<\xEF\0\x0C\xFF\xE0\0\xFF\xFE\x80\xF8\0\0\0T \0\x80\xFF\0\xF8\xFF\xFF\x80\0<\0\0\0\0\0\0\0\xC0\0\0\xFE\0T \0T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08\0\x80T T \xFFT T T T T T T \xFF\xF0T \xF0\0\xE0\0\0\xFF\0\x80\xF8\xFC\0\xBF\xFE\0\0\0\0\xFC\0
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08\0\0\0\0\0\0\x97\0\x01\xC0\0\0\0\xFE\x01\0\xFF\0\x04\0\0T \0T \xFFT T \0\0T \0T \xFF\0\xC0\0\0\0\xFFT \0\xFF\0T \0\xE0\0\xE0\xC0\0{\0\xF6\0\xFC\0\0|\xF8\0\x83\0\0\0\0\xFF\0\xF8\xF8\0\xFE\0\0\xFF\0\0\xF0\xFE\0\xF8\xFE\0\0\0\xF8\0T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T T T T \xF8T T |T \0\0\0\0\0T \0
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08\0\xFC\xFE\xF8\0\xFF\xF0\0\0\xC0\xFE\xFF\0\0\0\0`\xF0\0\0\xF0\0\xFF\0\0\0\0\x02\x80\x02\0\0\0\0\0\0\0\xF8\xFE\xBF/\xFE\0\0\0\0\xFC\0\xFC\xE3\xF8\x80\xFF\xFF\xFF\0\0\xC0\0\xFF\xF8\xFF\0\0\xF8\xF9\xFC\0\0\x18\xF8\xFE\0\0 \0\xC0`\xFE\xFF\xFF\0\0~\0\xE0\0\0\xF0\0\xF8\x7F\xF0\xE0\0\0\xC0\xFF\x08\x80\0\0\0\0\0\xFE\xFF\0\0\0\xF8\xFE\x80\0\xFE \x18\xFE\xF0\0\0\0\0\xC0\0T T \0\xC0\0T \0\0\xFE\0\xFE\xF0\xE0\0\0\x07\xEET T T T T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08\0\0\xF0\0\0\0\0\0\0\0\0\x03\0\x80\0T \x80\0T \0\0\xE7\xFF\0<\xC0\0\xF8\0\xE00\xFC\0 \xFF\x06\0\xF8\x0E\0\0\0\0\xFE\x1E\0\0\0\x1E\0\0\xFC\0\0\xF8\xFE\0\xFE\0\0\xF8\xF8\0\xFE\0\xF3\x0C\0#\0\xF8\0\x1C\0\x0E\0\0\xC0\0\0T T \0T \0\xFF\xFC\0\x0E\0\xE0\xDF\0\xFF\xE0r\xF8\0T \xFE\xFE\0
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08\0T T \0\xFC\0\0T \0\0\xFC\0T T \0\0\xF8\0\xFC<\xE0\xFF\0T \0\x02\xF0\x04\xFF\0\0\0\xFF\xC0\xFC\0\0\0\xFF\x04\x7F\xFE\xFD\xF8\x01C\0\0\0\0\0\0\xE0\0\0\0\0\0\0\xFF\xF8\0\0\0\xFF\x80\0\0\xF0
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08T \0T \0\0\xFCT T T \0T \0\0\0\x04\xFEP\x80\xFC\xE0\0\xFF\0\0p\0>\xFF\0\0\0\0\0\x80\x0C\xFE\xFF\0a\xFE\xFF\x80\x01\0\0\xFC\0\x0F\xF8\xF8\xF8\0\x01\xFC\0\0\0\0~\xFC\0\0\0\0\0\xE2\0\x9F\0\xF8\0\0\0\0\xFF\xFE\xFE\x18\xFF\x0C\0\x0F\0\0\xF0\xFF\0\xFF\x80\0 \xFF\xC0\xFC?\x98\x7F\x01    \0\\0\xE0\x8C\xFE\xF8\xFF\xDF>\0\0\0\0\0\08\xFF\0\xFC\0\0\0\0\0\0\0\0\0\0\0\0\0T \xFET \0\0\0\x80\0\0\xFF\0\xFF\0\xF8\0\xFE\xE0\xFF\0\x03\0\xC0\0\xFF>\xFF\xF8\xFC\xCC\xFF\xFF\xF0\xE0\0\0\xF0\x80\xC0\0\xFE\xFE\0\xC0\0\0\0\xE0\xFF\0\0\x04\0\0?\0\x1C\0x\xF8\xFF\0\0\0\xE0\xFC\0\0\xC0\0\0\0\0\0\xFE\0\0\x03\xFE\0\0\0\xFF\xFF|\0\0\0\0\0\0\0\xFE\0\0\0\xE3\x80\xFC\xFF\0\xFE\xC0\0\0\xFF\0\0\xFC\xF6\0\0\0\xF8\xFE\0\0\xFF\0\xF0\0\0\xF2\0\0\xFE \0\0\0\xE0\0\0\xC0\0\xFC\0\xFE\0\0\0\0T 
Retry count exceeded; starting again
No download file address.
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.31
Load address: 0x86000000
Loading: *\x08\0#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###########################################################\0#\xF2\x93#
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################################################
         34.2 KiB/s
done
Bytes transferred = 13261691 (ca5b7b hex)
Firmware Version: BZ.mt7621.v5.60.18+13041.211030.0107
 RSA Signed Firmware. Verfiying please wait... 
\0\0(\0\0\xE0\0\0\0\xFE\0\xFF\xFF\xFE\xD0\0\xFC\0\0\x03\xFF\0\0\xFC\0\xC0\0\0\00>\0\xFE\xFC\0\x01\xFC\0\0\xFF\0\xFF\xFE\0\0\0\0\0\0@\0\x80\xF0\xF0\0\0\x03\0\xFF\xF0\0\0\0\0\0\0\xFC\00\0\xFF\0\x02\0\0\xFF\xFF\0\0\0\0\0\xFF\0\0\0\xF1\0\0\x81\0\xFF\0\0\0\0\xFC\0\0\0\xF8\0\x03\xC0\0\0\x0F\0\0\xC0\0\0\0\0\xFC\xFE\0\0\0\x80\0\0\xC0\0\xFC\0\xE0\xFF\xFE\0\xFC\xFC\0\0\xC0\0\0\x8\0\0\xFE\0\0\xF0\0\xC0\0\0\xF8\0\0\0\0\xFE\xFF\xFF\xFE\xFE\xF0\xFE\xFC\xFE\xFF\xF0\xFF\xFC\0\0\0\xF0\xFC\0\x80\xF8\xE0\xE4\xFF\xFF\0\xC0\0\0\x0F\0\0\xC0\0\0\xF0\0\xE0\0\0\0\x01\x0F\0\xFE\xFC\0\0\xFC\0\xFF\x08\xFF\xFF\0\xC0\xFF\0\xFF\x03\xE0\0\0\xFF\0\xC2\0\x03\0\0x\0\xFF\0\xFF\0\0\xFF\0\x01\0\0\xFF\0\x17>\xE0\0\0\0\xF0\x03\0\xFF\0\xFC\0\xFC\0\xFF\0>\xF8\xFF\xF8\xB3\0\xFC\0\0\xFF\xFF\0\0\xF0\xF0\x80\x06\xFF\0\0\0\0\0\xC0\0\0\xFF\xFF\xFF\x1E\xF0\xFC\0\xD0\xFF\0\x10\0\xFF\0\0\0\0\x0F\x06\x04\xF0\0\xFC\0\0\xFF\0\0\0\x1C\xF8\0\0\xFF\0\0\0\0\xF8\0\0\xFE\x01\0\x80\0\xEF\x7F\x01o\0\x1F\0\0\xE0\0\x1D\0\xFC\0@\0\x80>\0\0\0\0\xFF\0`\0\0\x08\x0F\0\0\xFE\0\xE0\xFC\xFA\xF8\x80\0\0\0\0\0\xC0\x1F\0\0\0\xF0\xFF\0\x02@np`\x10\x80\xE1\0\0\x92"\0\0\0\xF8\0\xFF\0\0\0\0\0\0\0\0\0\0\0\0\0\xF8\0\xFF\xFF\0[    3.252175] random: nonblocking pool is initialized
[    3.321307] mt753x 1e110000.gsw: loaded MT7530 driver
[    3.514022] Freeing unused kernel memory: 43352K
[    3.518656] This architecture does not have kernel memory protection.
[    3.536618] init: Console is alive
[    3.540374] init: - watchdog -
[    3.568340] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.579809] input: gpio-keys-polled as /devices/platform/gpio-keys-polled/input/input0
[    3.588273] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.600501] init: - preinit -
[    4.088848] ramoops: pstore: pstore_read bprz type: -1940959232 count 1 id 8e8ee4e08e8ee4e0
[    4.117953] ubnt_common: module license 'Proprietary' taints kernel.
[    4.124404] Disabling lock debugging due to kernel taint
[    4.132695] [UBNT_STA_HT] Initialize hash table
[    4.137299\x01|\x03\0\xF8\0 \xF0\0\0\0\x08\xFE\xFE\0\0\0\xFF\x06\xFF\xFF\0\xFE\xF8\x80<\0\0\x80\0\xFF\0\0\0\xFF\0\xE0\0\xFC\08\0\x17\0~\0\xFC\x02\0\0\0\x80\0\0\xFF\0\xE0\0\0\xFE\xF8\0\x80\xFE\0\0\0\0\0\0\xF0\08\xFF\xD8o\xFC\xFF\0\x1F\0\0\0\0\x04\0@\0\xE0\0Could not find cfg type: 2
[   10.046061] sh (423): drop_caches: 1
do_swconfig: started
[   11.891927] procd: - early -
[   11.894936] procd: - watchdog -
[   12.520346] procd: - watchdog -
[   12.523810] procd: - ubus -
[   12.582238] procd: - init -
Please press Enter to activate this console.
[   12.631565] reset-handler[734]: [error] reset-handler.reset_handler_main(): Failed to register reset listener, error -5
[   12.800856] kmodloader: loading kernel modules from /etc/modules.d.sysinit/*
[   12.811382] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   12.830916] nf_conntrack version 0.5.0 (3964 buckets, 15856 max)
[   13.020369] kmodloader: failed to load nf_nat_ipv6
[   13.029675] Bridge firewalling registered
[   13.043910] Ebtables v2.0 registered
[   13.049114] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.184446] Netfilter messages via NETLINK v0.30.
[   13.197171] reset-handler[816]: [error] reset-handler.reset_handler_main(): Failed to register reset listener, error -5
[   13.201063] xt_time: kernel timezone is -0000
[   13.205684] ip_set: protocol 6
[   13.213868] kmodloader: 2 modules could not be probed
[   13.213986] kmodloader: dependency not loaded nf_nat_ipv6
[   13.214055] kmodloader: - ip6table_nat - 1
[   13.214135] kmodloader: - nf_nat_ipv6 - 0
[   13.245735] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.293431] i2c /dev entries driver
[   13.305445] hidraw: raw HID events driver (C) Jiri Kosina
[   13.317112] Mirror/redirect action on
[   13.336967] Bluetooth: Core ver 2.21
[   13.340742] NET: Registered protocol family 31
[   13.345194] Bluetooth: HCI device and connection manager initialized
[   13.351590] Bluetooth: HCI socket layer initialized
[   13.356472] Bluetooth: L2CAP socket layer initialized
[   13.361575] Bluetooth: SCO socket layer initialized
[   13.368940] [btmtk_info] main_driver_init, BTMTK uart version: 7.0.20120401
[   13.376000] [btmtk_info] btmtk_cif_register
[   13.380201] [btmtk_info] uart_register
[   13.383949] [btmtk_info] uart_register done
[   13.388126] [btmtk_info] btmtk_cif_register: Done
[   13.392837] [btmtk_info] btmtk_fops_init: Start
[   13.397365] [btmtk_info] btmtk_fops_init: g_fwlog init
[   13.402799] Bluetooth: btmtk_fops_init: BT_majorfwlog 250, devIDfwlog 262144000
[   13.410128] [btmtk_info] main_driver_init: Done
[   13.415025] kmodloader: done loading kernel modules from /etc/modules.d/*
\0\0\xE0\0\0\xFF\xFE \x1D\0\0\xF0\0\0>\xFE\0\0\0 \0\xFC\0\0\0\xFC\x1E\xC0\0?\0\0\0\0\0\0\0\0\0\xE0?\xFE\0\xFF\xFC\0\xFF?\0\0\xC0\xF0\0\0\00\0\0\x1D\xE0\0\xFE\0\xFC\xEEp\0\x03\0\0\xFE\0\0\0\0\0\0\0\0\0\x01\xFC\xFC\0\xE0\0\0\x0F\xF0\0\x01\xE0\0\xFF\0\0\0\0\0\0\xE4\0<\xF0\x0C\0\x80\0\0\0\xF8\x0E\xF0\x80\0\0\x80\0\0\0\x18\0\0\x13~\xFE\xC0\0\xFC\0\0\xFE\x04\x02\x03\0\x1B\0\xFF\0\x01\0\xF6\0\xFD\0\xF0\xDF\xF0\0\0\0\xFF\xF6\0\xC0\xFF\xFC\0\0\x80\0\xFC\xFF\0\xF0\0\0\xE0\0\0\0\xFE\0\x02\xFE\xCC\0\0\0\xCC\x01\0\x07\x03\xC0\0\xF9\x02\xE0\0\xFD\xFB\xFF\0\0_\xFE\0\0\0\xF8\xFC\xE8\xC0\xFF\0\0\xFF\0\x1E\xFF\0\0\xE1\xFF\xFF\0\0\0\xEC\0\0\xC0\xFF\xFF\0?\x1E\0\xFE\x80\0\xFF\xE3\xFF\xFF\xFE\xF6\0\x80\xFF\0\0; ~\x80\x80\0\xC0\0\xA0\0\0\0x\0\xFF\xF0\xC0\xEC0\0\xC0\x03\xC3\x81\0|\xCF\0\x08\0\0\xF8\x80\x1E\x80\0\x18\x02\x1E\0\0\0\0\xF8\0\0`\0O\x01\x87\0\x01\0\0\xF3\xFF\0\0\0\0|\0w\x80\x01\0\0\x02\0\xE6\0\0\x03\0\0\0\0\xFC\xFC\0\x01\0\xFE\0\xF8\xF3\0\xFF\xEC\x80\0\0\x03\xE0\0\0\0`\0\xFF\0\x08\0\x03\xFF\x0F\0\0\0\0\xFE\0\0\0\xFE\xFF\0\xC1\0\xFC\xF0\x9C\xFC\xFE8<\xFC\0\0\xDF\xC4\x88\xF0.\0\0\x01\0\xC6\0\xFF\0\xFC\xFF\xE3\xFC\x0E\xF8\0@\x80\xFF\x03`\0\xFC?\xFF\xEC\xFF\xFC\xF0\xF0\xF0\xF1\x10\xF8\xFF\0\xFC\0\x1F\xFC\xFE\xFF\0\xFF\xFE\xFF\xFC\xFF\xFF{\0\0\0\0\0\x18\xFC\0\xFF\0\0\0\0\0\xFC\x08\xFF\xFF\xFF\xFE\0\0\xFF\xF8\xF0\xFC\0\xFF\x80\xFE\xF0\0\xFE\xFF\0\xFF\0\0\x88\xFD\xDF\xFE\xFF\0\0\xFF\xF8\0\0\0\0\x10\0\0\08\0\xFF\0\0\0\xF0\xF8\xCF\xFF\0\xF6\xE0\xFF\xF6\xFB\x08\xFC\0\xE5\x06\0\xEC\xF0\x0C\x06\0\0\0\x0E\0\0\xFC\xFF \xFF\xF0\x11\x7F\0\0\x1C\xF0\x1F\x07\0\x03\xC7\0\x0E\0\xFF\0\x02\xFF\0\x0C\xFF\xFFA\xF8\xFF\xC0\xFF\xFC\xFF\xFF\xE0\xFC\x04\x03\xF8\xF8\xFF\xFF\xFF\xFF\xFC\xFF\0\xC0\xFF\xFE\xE0\xFF\0?\xFF\0\x05\xBE\0\xF3\x80\0\0\0\xC0\0\0\0\xE0\xDE\xF8\0\0\0\xFE\0?>\xFE\0\x04\xFF\xFF\x80\xFC\x01\xF8\0@\xFF\xFF\x1Cq\0\0\0\0\xFE\0\x806\xFA\0\0\xFC\0\xFF\0\0\xFC\xC00x\0\xFC\xFF\x01\xE0\0\0\0\x80\xFF\xFE\0\0\xFF\xFF\xFF\xFC\xFF\0\xFC\0\0\0\xC0\x81\xFD\0\xFF\0\x03\0\0\0\x04\xFE\xFC\xF1\xEF\xFF\x7F\xF8\x10\0\0\x01|\xFF\xC0\0\x8F\xF0\xFE\x80\0\x1F<`\0\0\x06\xFF\0\xFD\x8E\0\0\0`\xC0\0\0\x08\0\0O_\0\x0F\xFF\0\x04\0\0\x80\xC0\0p\xFE\0\0\0\xE7\xFE\xFC\x0E\xFF\x07\xFC\x8C\xFF\0\x80\x7F\x1F\0\xE0\xC0\xF8\xFF\xFF\x80\0\xF8\0$\0\0\x7F\0\0\x01\0\0\0|\x90\xE0\xF8\xFF_\0\0\0\xF8\x06\xE1\xFE\xFF\xFC\xFF\xFC\0\x80\0\x1E\xFC\xF4\0\0\0\xFC\xFE\xFF\0\xF0\x80\xFF\xFE\xFF\x7F\x01\xF0\xFE\0\x1F\x1F\xFF\xFC\xFF\xFC\xFE\xFF\xF0\0\0\xF5\xE5\0\xFE\0\0\xC0\0\x80\x10\xFC\xFE\0\0\0\0\xE0\0\xFC\xFE\xE0\xC0\x03\xF8\0\xFE\xF0\xC0\0\0\0\0\0\0\0\xE0\xFC\xF8\x80\0\0\0\0\xE0\0\0\xFC\0\0\0\xFF\0\xFC\x02\0\xF9\0\0\0\0\0\0\0\xB1\0\xFC\0?\xF8\0\0\0\xFE\xE0\xC0p\0\xFF\x9F\xFE\xFE\0\x80\xFC\0\0\0\0\0\0\0\x7F\0\0\xF0\0\0\x0E\0\0\x04\x01\xFF\0\0\0\x07\0\xFF\0\0<\0\0\xFF\0\xE0\xF3g\xFF\0|\xFC\x02\0\0\xD8\0\0\0\xF0\xC0\xFF\0\0\0\0\0\xFC\xFF\xF6\0\xFF\xF0\x02\xEE\xFF?\xF3\xFF\xCE\0\0\xF0\0\0\0\0\0 \xF8|\xFE\0\0\xFC\0\x01\xFC\0\xFF\xEB\xFF\0\xFF\xFE\0\0\0\0\0\x0CDRAM cfg init type(1): predefined first
\0\0\0\0\xFE\0\0\0\xFF\0\xFC\0\xF8
U-Boot SPL 2018.03 [UniFi,v1.1.49.79] (Apr 01 2021 - 13:07:30 +0800)
Trying to boot from MTK-MMAP
\x02\x02\x02\x02\x1B\x1B\x1B\x02

U-Boot 2018.03 [UniFi,v1.1.49.79] (Apr 01 2021 - 13:07:30 +0800)

MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 1200MHz, Bus: 220MHz, XTAL: 40MHz
DRAM:  256 MiB
Loading Environment from SPI Flash... SF: Detected mx25l25635f with page size 256 Bytes, erase size 64 KiB, total 32 MiB
OK
In:    uartlite0@1e000c00
Out:   uartlite0@1e000c00
Err:   uartlite0@1e000c00
Net:   eth0: eth@1e100000
SF: Detected mx25l25635f with page size 256 Bytes, erase size 64 KiB, total 32 MiB
load ubntapp ok
Board: Ubiquiti Networks MT7621 board (a612-15.0000)
UBNT application initialized 
 *WARNING*: Could not parse FW version, please check FW format
is_default true
is_ble_stp = true

~~~ p_device_model:U6-LITE
~~~ is_default:1 ~~~
~~~ p_macaddr:78:45:58:46:fe:64 ~~~
~~~ is_ble_stp:1 ~~~
=========================GPIO INIT=====================
GPIO_16, action is output low
GPIO_16, action is output high
GPIO_19, action is output low
GPIO_19, action is output high
=========================UART_3 INIT=====================
uartlite0@1e000c00, 1e000c00
uartlite0@1e000e00 bring up, 1e000e00
=========================FLOW 1=====================
[BT Power On Result] Success

=========================FLOW 2=====================
[HCI RESET Result] Success

=========================Extend FLOW=====================
[HCI LE BT MAC ADDR Result] Success

=========================FLOW 3=====================
[HCI LE SET ADVERTISING PARAMETER Result] Success

=========================FLOW 4=====================
[HCI LE  SET ADVERTISING DATA Result] Success

=========================FLOW 5=====================
[HCI LE  SET SCAN RESPONSE Result] Success

=========================FLOW 6=====================
[HIC LE  SET ADVERISTING ENABLE Result] Success
MT7915 BLE broadcasting successfully
Autobooting in 2 seconds, press "<Esc><Esc>" to stop
ubnt boot ...
SF: Detected mx25l25635f with page size 256 Bytes, erase size 64 KiB, total 32 MiB
reading kernel 0 from: 0x1d0000, size: 0x00c6f000
\0\0\0\0\0sha1,rsa2048:uap6_mt7621+ sha1,rsa2048:uap6_mt7621+ ## Loading kernel from FIT Image at 86000000 ...
   Using 'config@1' configuration
   Verifying Hash Integrity ... sha1,rsa2048:uap6_mt7621+ sha1,rsa2048:uap6_mt7621+ OK
   Trying 'kernel@1' kernel subimage
     Description:  Ubiquiti Linux 60.18+13041.211030.0107
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x86000108
     Data Size:    12960968 Bytes = 12.4 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x81001000
     Entry Point:  0x81001400
     Hash algo:    sha1
     Hash value:   5d94bb9f2e8079ae3efc793ac1baf6dbbbd989bc
     Sign algo:    sha1,rsa2048:uap6_mt7621 (required)
     Sign value:   3c0992e45cff613f6f44c5e75a280ddf3e597dda2dd34269799952c7c20bfd566209195bde6bd48e8f2151e3cced65f164f6091e80d4707f4e48fcf75d15eb1b64a61328d0ada4f58311a4f8c9a3a1ed21e232568344cc6d9c09b6cc39252b8b68ca29cb33adc7f991a212f4023ac705624c386bbcff36140c075c8320bd446a37502002f60750aac49a2a2a1aa75c8ebaaebe4e4bc5799f9f5b53c3018331fed9c9ccbe54fbc7c0d550645e955c7f9855826fcd390e3635f812a9a2caf693847216dd6570da093a012580fc0f3fa674e2c5f0a4209c060155249e6cf889d2ec53e3c49e16815e3b68ba1f6c5e2b1c29bdf3cce57351e48ff5031c4cdea8265e
   Verifying Hash Integrity ... sha1+ sha1,rsa2048:uap6_mt7621+ OK
## Loading fdt from FIT Image at 86000000 ...
   Using 'config@1' configuration
   Trying 'fdt@1' fdt subimage
     Description:  u6Lite-fdt
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x86c5c868
     Data Size:    11129 Bytes = 10.9 KiB
     Architecture: MIPS
     Hash algo:    sha1
     Hash value:   0d848a514b18d61da3343fb5e56bece54dd4068a
     Sign algo:    sha1,rsa2048:uap6_mt7621 (required)
     Sign value:   c11995e9a4901525a922b97dab165d580e47e59fa4fac65d56ea261ef0ca167b65ebbd22947bd78c039a51a24ba77e6508e096924b2ca12b8cc624ebc7d8c61b97bcca09e75e46e91c88afbed4bc527dedaa049b7ee0b525eb504bfef3f15ab0c28f4c88ef52bc8e0b4a35a2b98e512b647fe5829da44146baf18ee0b31c58d94e8e28d79498eccace0ec9ac4c517946f951e39fcd86e7aef92224f709a1ce8033d5d4529b1621e84f56f3e6e96da7f0c84332722c627f4fc931a2bab7ffa244fd8d06e246229accedae79463b6e9a061f0318be9dd1a583698b3a6a23ece7e51ab8da32aad20f79291715db56240aeeaf668bd9a971ac900723e2bc97f109e3
   Verifying Hash Integrity ... sha1+ sha1,rsa2048:uap6_mt7621+ OK
   Booting using the fdt blob at 0x86c5c868
   Uncompressing Kernel Image ... \0\xE0\xC0\xFF\0\xF8\x7F\0\xE0\xE7\0\0\0\0\0\0\x07\xFF\xFE\xF0\0\0\xC0\xFF\xFC\x0C\0\0\xFC\0\0\0\0\xFC\x03\xFC\0\x80\0\0\0\0\xFC\0\0\0\0\0\0\0\0\0k\xAD\xA5\xB9\x9D\x81pool is initialized
[    3.322368] mt753x 1e110000.gsw: loaded MT7530 driver
[    3.515216] Freeing unused kernel memory: 43352K
[    3.519849] This architecture does not have kernel memory protection.
[    3.537258] init: Console is alive
[    3.540935] init: - watchdog -
[    3.568324] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.579542] input: gpio-keys-polled as /devices/platform/gpio-keys-polled/input/input0
[    3.588005] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.600217] init: - preinit -
[    4.090410] ramoops: pstore: pstore_read bprz type: -2091760640 count 1 id 8e8400008e840000
[    4.119484] ubnt_common: module license 'Proprietary' taints kernel.
[    4.125937] Disabling lock debugging due to kernel taint
[    4.134045] [UBNT_STA_HT] Initialize hash table
[    4.138654] [UBNT_STA_HT] done
[    4.141733] creating /proc/ubnt_peek/
[    4.145410] creating /proc/ubnt_peek/peek_disable
[    4.150128] creating /proc/ubnt_peek/loop_check
[    4.154659] creating /proc/ubnt_peek/loop_debug
[    4.159187] creating /proc/ubnt_peek/loop_uif
[    4.163561] creating /proc/ubnt_peek/tcp_debug_mac
[    4.168365] creating /proc/ubnt_peek/tcp_debug_connections
[    4.173876] qos: registered
[    4.176667] creating /proc/ubnt_frame_id/
[    4.180691] creating /proc/ubnt_frame_id/netdevs
[    4.185332] ubnt_nfbypass: registered
[    4.188987] creating /proc/nfbypass/
[    4.192575] creating /proc/nfbypass/netdevs
[    4.259390] ubnthal: Ubiquiti U6-Lite
[    4.267402] Registering char device sflash (200) succeeds
[    4.272833] Before ==> 
[    4.275277] mtd->name u-boot
[    4.278151] mtd->flags c00
[    4.280867] Before ==> 
[    4.283310] mtd->name u-boot-env
[    4.286529] mtd->flags c00
[    4.289229] Before ==> 
[    4.291684] mtd->name Factory
[    4.294648] mtd->flags 800
[    4.297347] After ==> 
[    4.299702] mtd->name Factory
[    4.302687] mtd->flags 800
[    4.305389] Before ==> 
[    4.307828] mtd->name EEPROM
[    4.310738] mtd->flags 800
[    4.313441] Before ==> 
[    4.315881] mtd->name bs
[    4.318407] mtd->flags c00
[    4.321127] Before ==> 
[    4.323570] mtd->name cfg
[    4.326183] mtd->flags c00
[    4.328883] Before ==> 
[    4.331341] mtd->name kernel0
[    4.334305] mtd->flags c00
[    4.337005] Before ==> 
[    4.339444] mtd->name kernel1
[    4.342424] mtd->flags c00
[    4.458730] register rlt_drv
[    4.666662] 
[    4.666662] 
[    4.666662] === pAd = c0481000, size = 2123072 ===
[    4.666662] 
[    4.676138] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
[    4.683791] <-- RTMPAllocAdapterBlock, Status=0
[    4.688338] pAd->CSRBaseAddress =0xc0380000, csr_addr=0xc0380000!
[    4.694476] device_id =0x7603
[    4.697453] RtmpChipOpsHook(761): Not support for HIF_MT yet!
[    4.703208] mt7603_init()-->
[    4.706092] mt_bcn_buf_init(296): Not support for HIF_MT yet!
[    4.711847] <--mt7603_init()
[    4.714826] wevent: registered
[    4.717876] ra0: NO2G init ACL table
[    4.722110] 80211> RFICType= 1, NumOfChan= 14
[    4.726472] 80211> Number of rate = 12
[    4.730258] 80211> CurTxPower = 0 dBm
[    4.734354] 80211> CFG80211_Register with max interface 8
[    4.739773] ra0: VLAN features updated vwire/vport[0]!
[    4.744951] ra0: assigned ifindex: 4
[    5.139345] register mt_drv
[    5.371339] 
[    5.371339] 
[    5.371339] === pAd = c1181000, size = 9817024 ===
[    5.371339] 
[    5.382150] <-- RTMPAllocAdapterBlock, Status=0
[    5.386696] PCI CSRBaseAddress =0xc1080000, csr_addr=0xc1080000!
[    5.392764] RTMPInitPCIeDevice():device_id=0x7915
[    5.397474] mt7915_init()-->
[    5.400375] Use 1st iPAiLNA default bin.
[    5.404357] <--mt7915_init()
[    5.408392] wevent: registered
[    5.412593] Rx[0] Ring: total 24576 bytes allocated
[    5.417686] Rx[1] Ring: total 24576 bytes allocated
[    5.425214] Rx[2] Ring: total 8192 bytes allocated
[    5.434900] Rx[3] Ring: total 16384 bytes allocated
[    5.442388] Rx[4] Ring: total 8192 bytes allocated
[    5.447247] <-- pci_alloc_tx_rx_ring_mem, Status=0
[    5.452104] 80211> RFICType= 3, NumOfChan= 48
[    5.456457] 80211> Number of rate = 12
[    5.460237] 80211> CurTxPower = 0 dBm
[    5.463905] 80211> TxStream = 4
[    5.467554] 80211> CFG80211_Register
[    5.471172] rai0: VLAN features updated vwire/vport[0]!
[    5.476404] rai0: assigned ifindex: 5
[    6.400556] mt753x 1e110000.gsw: Port 0 Link is Up - 1Gbps/Full
\0[    7.909567] sh (423): drop_caches: 1
do_swconfig: started
[    9.774346] procd: - early -
[    9.777342] procd: - watchdog -
\0[   10.4\xF1\0\xFF[   10.471958] procd: - init -
Please press Enter to activate this console.
[   10.520636] reset-handler[733]: [error] reset-handler.reset_handler_main(): Failed t\xEF\0[   10.693439] kmodloader: loading kernel modules from /etc/modules.d.sysinit/*
[   10.703929] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   10.723833] nf_conntrack version 0.5.0 (3964 buckets, 15856 max)
[   10.950089] kmodloader: failed to load nf_nat_ipv6
[   10.959188] Bridge firewalling registered
[   10.972961] Ebtables v2.0 registered
[   10.978184] ip_tables: (C) 2000-2006 Netfilter Core Team
[   11.079954] reset-handler[814]: [error] reset-handler.reset_handler_main(): Failed to register reset listener, error -5
[   11.113137] Netfilter messages via NETLINK v0.30.
[   11.127104] xt_time: kernel timezone is -0000
[   11.135944] ip_set: protocol 6
[   11.146733] kmodloader: 2 modules could not be probed
[   11.151952] kmodloader: dependency not loaded nf_nat_ipv6
[   11.157413] kmodloader: - ip6table_nat - 1
[   11.161625] kmodloader: - nf_nat_ipv6 - 0
[   11.191531] kmodloader: loading kernel modules from /etc/modules.d/*
[   11.245251] i2c /dev entries driver
[   11.257785] hidraw: raw HID events driver (C) Jiri Kosina
[   11.269861] Mirror/redirect action on
[   11.289434] Bluetooth: Core ver 2.21
[   11.293205] NET: Registered protocol family 31
[   11.297657] Bluetooth: HCI device and connection manager initialized
[   11.304051] Bluetooth: HCI socket layer initialized
[   11.308933] Bluetooth: L2CAP socket layer initialized
[   11.314027] Bluetooth: SCO socket layer initialized
[   11.321476] [btmtk_info] main_driver_init, BTMTK uart version: 7.0.20120401
[   11.328489] [btmtk_info] btmtk_cif_register
[   11.332702] [btmtk_info] uart_register
[   11.336450] [btmtk_info] uart_register done
[   11.340646] [btmtk_info] btmtk_cif_register: Done
[   11.345349] [btmtk_info] btmtk_fops_init: Start
[   11.349874] [btmtk_info] btmtk_fops_init: g_fwlog init
[   11.355301] Bluetooth: btmtk_fops_init: BT_majorfwlog 250, devIDfwlog 262144000
[   11.362662] [btmtk_info] main_driver_init: Done
[   11.367500] kmodloader: done loading kernel modules from /etc/modules.d/*
\0\0\0\0x\xFF\0\xCC\xF0|\xFF\x9C\xF8\x03\x10\0\x87\x01