hang about m8 might have good news been reading the forum read this
Yep there sure is and here it is
not my work this guy jimbotheho
Ambit 200 Modem Unlocking, How to restore shell locked 200 modems
Requirements:
Copy of preupdate image. Either from flash dump , Image one can easily extracted from and dump in hexeditor (it needs byteswapping) or can be extracted from an unlocked modem.
Boot your working preupdated modem with hyperterminal loaded and power, feed & rs232 connected.
Let it finish booting to CM> prompt then follow guide below.
TFTP server - i used solarwinds
Connect enthernet to pc and manually set ip addy of 192.168.100.2
run the tftp server and host the image file.
Terminal into the locked modem and reboot it.
You need to press p immediatly when promted.
Terminal capture continues
Enter '1', '2', or 'p' within 2 seconds or take default... Press P
.
Board IP Address [0.0.0.0]: p 192.168.100.1
Board IP Mask [255.255.255.0]: enter
Board IP Gateway [0.0.0.0]: enter
Board MAC Address [00:10:18:ff:ff:ff]: enter
Internal/External phy? (i/e) enter
Init EMAC, DMA, and MII PHY...
Autonegotiation started, waiting for completion...Autonegotiation successful...
MAC setup for FullDuplex
Main Menu:
==========
d) Download and save to flash Select D
g) Download and run from RAM
c) Store icePROM bootloader to flash
b) Boot from flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
r) Read memory
w) Write memory
TFTP Get Selected
Board TFTP Server IP Address [0.0.0.0]: 192.168.100.2
Enter TFTP filename []: image2.bin
Free store: a0300000
Starting TFTP of image2.bin from 192.168.100.2
Getting image2.bin using octet mode
.................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................
Tftp complete
Received 917504 bytes
Image's compatible list length may be incorrect! (length > 1024)
Image 0 Program Header:
Signature: 3348
Control: 0000
Major Rev: 0002
Minor Rev: 0000
Build Time: 2003/7/16 09:12:24 Z
File Length: 906823 bytes
Load Address: 80010000
Filename: vxram_sto.bin
HCS: 3639
CRC: 69db5de2
CRC Verified
Destination image
0 = bootloader
1/2 = CM image
3 = specify flash sector
(0-3)[1]: 1
Stored 65536 bytes
Stored 131072 bytes
Stored 196608 bytes
Stored 262144 bytes
Stored 327680 bytes
Stored 393216 bytes
Stored 458752 bytes
Stored 524288 bytes
Stored 589824 bytes
Stored 655360 bytes
Stored 720896 bytes
Stored 786432 bytes
Stored 851968 bytes
Stored 906916 bytes
Verified 65536 bytes
Verified 131072 bytes
Verified 196608 bytes
Verified 262144 bytes
Verified 327680 bytes
Verified 393216 bytes
Verified 458752 bytes
Verified 524288 bytes
Verified 589824 bytes
Verified 655360 bytes
Verified 720896 bytes
Verified 786432 bytes
Verified 851968 bytes
Verified 906916 bytes
Store parameters to flash ? [n] y
Main Menu:
==========
d) Download and save to flash
g) Download and run from RAM
c) Store icePROM bootloader to flash
b) Boot from flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
r) Read memory
w) Write memory
Broadcom BootLoader Version: 3.13.2
Build Date: Dec 28 2002
Build Time: 12:22:36
Image 1 Program Header:
Signature: 3348
Control: 0000
Major Rev: 0002
Minor Rev: 0000
Build Time: 2003/7/16 09:12:24 Z
File Length: 906823 bytes
Load Address: 80010000
Filename: vxram_sto.bin
HCS: 3639
CRC: 69db5de2
Image 2 Program Header:
Signature: 3348
Control: 0000
Major Rev: 0002
Minor Rev: 0000
Build Time: 2003/7/16 09:12:24 Z
File Length: 906823 bytes
Load Address: 80010000
Filename: vxram_sto.bin
HCS: 3639
CRC: 69db5de2