Exploring the Ubiquiti USW Flex Mini
Saturday, January 2, 2021
Note: a very casual exploration that really puts the “notes” in tech notes. More or a sketch so I remember where I stopped if I pick this up again.
In the immediate aftermath of digging into the UniFi inform protocol, one of the responses on reddit was basically that some UniFi devices used an embedded OS, not Linux, so one couldn’t expect them to have a proper crypto stack.
From experience, I know that modern MCUs generally do have featureful crypto stacks available, but thought it might be fun to explore one of (the only?) UniFi devices that does not run Linux. Certantly more fun than arguing with someone on reddit 😊
Hardware
After disassembly, we see an odd ARM Cortex MCU labeled Nuvoton (UB10 / U810) 2922B037-ZZ2 938ACLA.
Perhaps a custom spin for Ubiquiti because there’s no trace of the chip’s part numbers online.
It appears to be a ARMv8-M (Cortex M23 or M33), not a M0/M4 because TrustZone
features (generall the BLXNS instruction) are used in firmware.
Ethernet switching is handled by a RTL8367RB which provides five external and two internal 10/100/1000 Ethernet ports.
Otherwise a fairly normal SoHo switch board. Gaining console access was straightforward:
Got tired of popping the cover off my lab Ubiquiti USW-Mini to access debug headers so added angle headers and cut out the case for access.
— Jade Angrboða (@jda) January 4, 2021
I couldn't get the ground pins hot enough on old station so used clip on ground. New one worked perfectly. pic.twitter.com/Fe7lngkYzq
Console pinout (from the back of the board where back = where USB-C is) is: +3.3VDC, RX, TX, GND
Software
The Mini runs Arm Mbed OS. Mbed is not a general purpose OS like Win/Linux/BSD. Application code is compiled into one multi-threaded application that runs on the metal.
Embedded 2048 bit RSA public key for ??
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnxH+ZiJ+6ppXlNIWZlpE
ywLaUC6bD3N4AxFer3U9CHFmM++JTubnDbQ1bnUCME7jyL8VuhAgjsVIrt0q9ODr
SusQbkV/hErhr2DJFJqUF0kFq5OCScFMCQYV9rd5beANBB4RGgmnsWMIAPZ2JS/z
LJcdDD57fwWPBl1oXF5iX8PS90lKfcOuoN29njcxHkF8aRw8SBvDbtpjXfalAmRK
THAjhHU56qeghYLV4qmFvtiGZ7JGrl/SaqOJ3Hk9xopWRu+4c8gRL1GaKL25PBaD
4dT5FWIL9zGY6bUec3ZjzGyek0tGnFiTcPjtdKvkBM4JCQpxGO5C0AZcR8zEZ8z3
gwIDAQAB
-----END PUBLIC KEY-----
Management
For future exploration, there’s a web server using TLS running on port 22. Is this a way to configure the device from a mobile app? While looking around with Ghidra I saw mention of a standalone config mode but didn’t have a chance to explore further.
Some console log output
Dumping output here because it’s fascinating.
Boot log
######## Bootloader ########
Version : 1.0.7
DateTime : May 8 2020 - 14:52:24
Ethernet MAC : 74:83:c2:0f:15:8f
Flash Configurations:
FLASH_APPLICATION_SIZE : 0x6d000
FLASH_APPLICATION_ADDRESS : 0x10000
FLASH_DATA_ADDRESS : 0x7d000
-- FLASH_TLS_ADDRESS : 0x7d000
-- FLASH_ENV_ADDRESS : 0x7e000
-- FLASH_SIGNED_IMAGE_ADDRESS: 0x7f000
FMC_ReadConfig:FFFFFFBE, 7D000
ENV CRC correct: FA8F2BE4
do_fwupgrade=0
dhcp_enable=1
recovery_enable is unset
recovery_enable=0
Detect reset-button 8
do_fwupgrade=0, no need upgrade firmware
==> Run application from: 0x10000 <==
[SERIAL] Serial Ready!!
FW Version : 1.7.5.636
OS Version : 51300
Build Info : May 26 2020 14:45:52
[WDT] Initial
[WDT] Disable WatchDog ......
[WDT] Start
[FLASH_DEV] Flash init. start 00000000 sz 00080000 sector size 00001000
[FLASH_DEV] Register Flash 3 oft 00000000 sz 00010000
[FLASH_DEV] Register Flash 0 oft 0007e000 sz 00001000
[ENV] flash offset 0007e000 size 00001000
[LED] Started!
[FLASH_DEV] Register Flash 1 oft 0007f000 sz 00001000
[FLASH_DEV] Register Flash 2 oft 0007d000 sz 00001000
[SSL] service started!!
[SSL]
[SSL-S] Loading the server cert. and key...
UBNT CLI
/>[SSL]
[SSL-S] Gen fingerprint [SHA-1 CD:26:3A:8C:AB:0C:49:38:1F:65:BE:CA:88:4E:11:C6 :04:22:44:BE] ...
[SSL] ok
[SSL] Bind on https://Any:22/ ...
[SSL] ok
[SSL] Seeding the random number generator...
[SSL] ok
[SSL] Setting up the SSL data....
[SSL] ok
[BOOT] Post
[NETDEV] Init
[NETDEV] Set static 192.168.1.20 mask 255.255.255.0 gw 192.168.1.1
[NETDEV] Disconnected.
[EMAC] Link Up
[NETDEV] Connected. IP Addr: 192.168.1.20
[NETDEV] Setup STP ... done
[NETDEV] Setup jumbo frame ... done
[NETDEV] Setup flowcontrol ... done
[NETDEV] Setup stormctrl ... done
[NETDEV] Setup egress ratelimit ... done
[NETDEV] Setup port isolation ... done
[NETDEV] Port 1 mirror src port 0 iso 0!
[NETDEV] Setup port mirror ... done
[NETDEV] Setup PVID... done
[NETDEV] Setup Management VLAN... done
[NETDEV] Setup port enable ... done
[NETDEV] Switch configuration done. changed 0!
[NETDEV] DHCPC enabled.
DHCP_DISCO TR=1 TM=4
[NETDEV] Service Started!
Mac Address is 74:83:c2:0f:15:8f
[NETDEV-LLDP] started!
[MCAD] Create reporter
[MCAD] default url http://unifi:8080/inform
[MCAD] [STATE] DEFAULT
[MCAD] set self url http://unifi:8080/inform
[STUN] STUN service started ...
[MCAD] Reporter started!
[FW_UPDATER] Loader version = 1.0.7
[SYSINFO] Set Boot from Loader
[NETDEV] IP changed: / gw -> 192.168.1.20 / 255.255.255.0 gw 192.168.1.1
LLDP Send: len 68
[DISCOVERY] [04:50:22] uptime [ 12777942] - Broadcast beacon.
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://unifi:8080/inform] Time 12787704
DHCP_DISCO TR=2 TM=8
DHCP_DISCO TR=3 TM=16
DHCP_DISCO TR=4 TM=32
[INFORM-ERR] prepare_inform 2825:translate inform host [unifi] failed! ret -3009
[CRASH] BOM: 000b230a
[CRASH] emac_stack = 20005ec8, ssl_stack = 2000e928, eloop_stack = 200065d8, reporter_stack = 2000c890
[WDT] Normal system reboot
[CRASH] OS crash reporting completed
DHCP_DISCO TR=5 TM=40
[INFORM-ERR] inform_send 24:HttpRequest failed (error -3009)
[INFORM-ERR] inform_handle_response 2275:Null HTTP response!
[MCAD-ERR] reporter_fail 1093:faile reason: Timeout (http://unifi:8080/inform)
[INFORM-ERR] reporter_fail 1106:initial contact failed #1, url=http://unifi:8080/inform, rc=4
[DISCOVERY] [04:51:00] uptime [ 44289772] - Broadcast beacon.
LLDP Send: len 68
[DISCOVERY] [04:51:01] uptime [ 45313768] - Broadcast beacon.
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://unifi:8080/inform] Time 48362502
DHCP_DISCO TR=6 TM=40
[INFORM-ERR] prepare_inform 2825:translate inform host [unifi] failed! ret -3009
/>help
Commands:
help This help
echo Echo controlling
alias Handle aliases
unset unset variables
set print or set variables
clear Clears the display
history View your command Line History
true
false
reset Reboot
uid Show UID
model Show Model ID
setenv Set env variable
printenv Print env variable
saveenv Save env to flash
version Show firmware version
led LED: led blue/white on/off
build Show build info
ip Show/Set IP
mac Show MAC address
ip2mac Translate IP to MAC address
resetenv Reset ENV variables
stack Show thread stack status
heap Show heap status
thread Show thread status
state Show reporter state
uptime Show uptime
port Show port status/stats/mac
locate Set locate status
fwupdate Update firmware
bootloader Show bootloader version
wdt Start/Stop watchdog
board Board info
/>board
eth0 : 74:83:c2:0f:15:8f
Magic : 40344b42
SubSystem_ID : ed30
SubVendor_ID : 0777
BOM Rev : 000b230a
/>[INFORM-ERR] inform_send 24:HttpRequest failed (error -3009)
[INFORM-ERR] inform_handle_response 2275:Null HTTP response!
[MCAD-ERR] reporter_fail 1093:faile reason: Timeout (http://unifi:8080/inform)
[INFORM-ERR] reporter_fail 1106:initial contact failed #2, url=http://unifi:8080/inform, rc=4
Some casual poking around
/>build
Build
-- DateTime : May 26 2020 14:45:52
-- Extra Tag: 0-ge163613-dirty
-- Mbed OS : 51300
-- CPU ID : 0x410fc241
-- Compiler : 0x00000001-0x004d388e
-- Region 0 : RAM 0x20000000 Size 0x00028000
: ROM 0x00000000 Size 0x00080000
-- Region 1 : RAM 0x00000000 Size 0x00000000
: ROM 0x00000000 Size 0x00000000
-- Region 2 : RAM 0x00000000 Size 0x00000000
: ROM 0x00000000 Size 0x00000000
-- Region 3 : RAM 0x00000000 Size 0x00000000
: ROM 0x00000000 Size 0x00000000
/>DHCP_DISCO TR=8 TM=40
>ip
Interface: up
IP : 192.168.1.20
Netmask : 255.255.255.0
Gateway : 192.168.1.1
/>printenv
dhcp_enable=1
do_fwupgrade=0
gateway=192.168.1.1
ipaddr=192.168.1.20
mgmt.authkey=6844C8C509E477C24A859FEC14B056AA
mgmt.capability=notif,fastapply-bg,notif-assoc-stat
mgmt.cfgversion=216318a06802e8ab
mgmt.is_default=0
mgmt.led_enabled=0
mgmt.selfrun_guest_mode=pass
mgmt.servers.1.url=http://192.168.128.2:8080/inform
mgmt.use_aes_gcm=true
mgmt_url=https://192.168.128.2:8443/manage/site/default
netmask=255.255.255.0
password=uioL/HMR0lLDg
stun_url=stun://192.168.128.2:3478/
switch.port.1.pvid=1
system_cfg=# switch\
switch.power_source.status=disabled\
switch.managementvlan=1\
switch.wevent.idp=enabled\
switch.wevent.mcip=239.254.127.63\
switch.wevent.key=464d87f2c7077ba74a0c1d7fc5d7d1da\
switch.jumboframes=disabled\
switch.mtu=9216\
switch.routing_enabled=false\
switch.port.1.name=Port 1\
switch.port.1.opmode=switch\
switch.port.1.pvid=10\
switch.port.2.name=Port 2\
switch.port.2.opmode=switch\
switch.port.2.pvid=10\
switch.port.3.name=Port 3\
switch.port.3.opmode=switch\
switch.port.3.pvid=10\
switch.port.4.name=Port 4\
switch.port.4.opmode=switch\
switch.port.4.pvid=10\
switch.port.5.name=Port 5\
switch.port.5.opmode=switch\
switch.port.5.pvid=10
username=csadmin
Log from upgrade process
[MCAD-ERR] reporter_fail 1093:faile reason: Timeout (http://192.168.128.2:8080/inform)
[INFORM-ERR] reporter_fail 1114:inform failed #1 (last inform: 7 seconds ago), rc=4
[MCAD] Set default inform url http://192.168.128.2:8080/inform
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://192.168.128.2:8080/inform] Time 258624533
[INFORM-DBG] reporter_inform_send:Send notify [stun] inform to [http://192.168.128.2:8080/inform] Time 265431217
[MCAD] [STATE] UPGRADE
[MCAD] Upgrade http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[MCAD] Upgrade http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[ENV] Set Name reporter_fw_url = http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[ENV] Erasing flash...at 0007e000 size 00001000
[FLASH_DEV] Erase flash 0 oft 516096 sz 4096
[ENV] Writing to flash... done
[STUN] STUN service is stopped ...
[SYSINFO] Set System Upgrading1
[FW_UPDATER] App Required version 1.7.3
[FW_UPDATER]
===> Check FW url=http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[INFORM-DBG] reporter_inform_send:Send alert [Upgrade] inform to [http://192.168.128.2:8080/inform] Time 265983623
[FW_UPDATER] Image Magic = aa5555aa
[FW_UPDATER] -- Image Protocol Version = 0002
[FW_UPDATER] -- Image Flags = 0000
[FW_UPDATER]
[FW_UPDATER] FW Magic = 11223344
[FW_UPDATER] -- FW Type = 0002
[FW_UPDATER] -- FW Product ID = 0001
[FW_UPDATER] -- FW Flags = 0000 (Unsigned)
[FW_UPDATER] -- FW Version = 00000000 (1.0.7.0)
[FW_UPDATER] -- FW CRC = e12222e8
[FW_UPDATER] -- FW Size = 0000e2c8 (58056)
[FW_UPDATER] -- FW Payload Size = 0000e2dc (58076)
[FW_UPDATER] Loader FW version 1.0.7.0 is same. Skip it
[FW_UPDATER] - 536
[FW_UPDATER] FW Magic = 11223344
[FW_UPDATER] -- FW Type = 0001
[FW_UPDATER] -- FW Product ID = 0001
[FW_UPDATER] -- FW Flags = 0001 (Signed)
[FW_UPDATER] -- FW Version = 000002a2 (1.8.4.674)
[FW_UPDATER] -- FW CRC = 5f1f2ebe
[FW_UPDATER] -- FW Size = 0006cf6c (446316)
[FW_UPDATER] -- FW Payload Size = 0006cfc8 (446408)
[FW_UPDATER] App FW version 1.8.4.674. check required version OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 560723d2
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 560723d2 OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 90c0109e
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 90c0109e OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = b5db20ba
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC b5db20ba OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 48ac9a5c
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 48ac9a5c OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 34fb0a61
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 34fb0a61 OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 9a587482
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 9a587482 OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = b4df2d31
[FW_UPDATER] -- Seg Size = 0000cf6c
[FW_UPDATER] -- Calc CRC b4df2d31 OK!
[FW_UPDATER] EOF Marker OK!
[FW_UPDATER]
[FW_UPDATER] FW Magic = 11223344
[FW_UPDATER] -- FW Type = 0005
[FW_UPDATER] -- FW Product ID = 0001
[FW_UPDATER] -- FW Flags = 0000 (Unsigned)
[FW_UPDATER] -- FW Version = 000002a2 (1.8.4.674)
[FW_UPDATER] -- FW CRC = 7320131f
[FW_UPDATER] -- FW Size = 00000100 (256)
[FW_UPDATER] -- FW Payload Size = 00000108 (264)
[FW_UPDATER] Sign size: 256
[FW_UPDATER] Verify App signature ... OK!
[SYSINFO] Set System Upgrading0
[INFORM-DBG] reporter_inform_send:Send alert [Upgrade] inform to [http://192.168.128.2:8080/inform] Time 272449630
[FW_UPDATER] App FW check done. Prepare to update flash from bootloader ...
[SYSINFO] Set Boot from Loader
[ENV] Set Name fw_crc = 5F1F2EBE
[MCAD] Upgrade Success!
[ENV] Set Name fw_url = http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[ENV] Set Name do_fwupgrade = 1
[ENV] Erasing flash...at 0007e000 size 00001000
[FLASH_DEV] Erase flash 0 oft 516096 sz 4096
[ENV] Writing to flash... done
[MCAD] Reboot now...
[SYSINFO] Reset Sys�
######## Bootloader ########
Version : 1.0.7
DateTime : May 8 2020 - 14:52:24
Ethernet MAC : 74:83:c2:0f:15:8f
Flash Configurations:
FLASH_APPLICATION_SIZE : 0x6d000
FLASH_APPLICATION_ADDRESS : 0x10000
FLASH_DATA_ADDRESS : 0x7d000
-- FLASH_TLS_ADDRESS : 0x7d000
-- FLASH_ENV_ADDRESS : 0x7e000
-- FLASH_SIGNED_IMAGE_ADDRESS: 0x7f000
FMC_ReadConfig:FFFFFFBE, 7D000
ENV CRC correct: 8DD43BD9
do_fwupgrade=1
dhcp_enable=1
recovery_enable is unset
recovery_enable=0
Server ip:fw-download.ubnt.com:80, fileName:/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
fw_crc: 5f1f2ebe
Static IP: 192.168.1.20
NetMask: 255.255.255.0
Gateway: 192.168.1.1
Can't get nameserver1
Can't get nameserver2
Detect reset-button 8
WatchDog config ....
Use DHCP
[STATE] 0 -> 1 , UIP-Flags ffffffff
DHCP Info
-- IP address 192.168.128.223 mask 255.255.255.0 gw 192.168.128.1
-- DNS server 192.168.128.1
-- Lease expires in 3600 seconds
[STATE] 1 -> 2 , UIP-Flags ffffffff
[STATE] 2 -> 1 , UIP-Flags ffffffff
resolve_found: IP address 13.35.121.72
[STATE] 1 -> 3 , UIP-Flags ffffffff
[mainStatus] Resolv domain, start downloading file
[STATE] 3 -> 4 , UIP-Flags ffffffff
[mainStatus] GET_HEADER: The connection was initiated: 0
[STATE] 4 -> 1 , UIP-Flags ffffffff
[webclient_connected]
#
Image Header
--> Image Header Version : 0200 2
--> Image Header Flags : 0000
FW Header
--> FW Type : 0002
--> FW Product ID : 0001
--> FW version : 05f6f270 100070000
--> FW CRC : e12222e8
--> FW Size : c8e20000 58056
--> FW payload size : dce20000 58076
Skip non-app firmware!!! payload size 58076
[STATE] 1 -> 5 , UIP-Flags 00000023
#[STATE] 5 -> 1 , UIP-Flags 00000023
###############################################################################--
Skip firmware ... done!!
FW Header
--> FW Type : 0001
--> FW Product ID : 0001
--> FW version : 067091e2 108040674
--> FW CRC : 5f1f2ebe
--> FW Size : 6ccf0600 446316
--> FW payload size : c8cf0600 446408
Verify Firmware CRC 5f1f2ebe OK
Segment Offset 0 / 446316
--> Segment Header
--> SegCrc : 560723d2
--> SegSize : 00010000
[STATE] 1 -> 6 , UIP-Flags 00000023
#[STATE] 6 -> 1 , UIP-Flags 00000023
###############################################################################--
###########
Check CRC 560723d2 OK!
Write flash Firmware oft 0 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 676
Segment Offset 65536 / 446316
--> Segment Header
--> SegCrc : 90c0109e
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################--
##########
Check CRC 90c0109e OK!
Write flash Firmware oft 65536 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 198
Segment Offset 131072 / 446316
--> Segment Header
--> SegCrc : b5db20ba
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################--
###########
Check CRC b5db20ba OK!
Write flash Firmware oft 131072 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 443
Segment Offset 196608 / 446316
--> Segment Header
--> SegCrc : 48ac9a5c
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################--
###########
Check CRC 48ac9a5c OK!
Write flash Firmware oft 196608 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 688
Segment Offset 262144 / 446316
--> Segment Header
--> SegCrc : 34fb0a61
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################--
##########
Check CRC 34fb0a61 OK!
Write flash Firmware oft 262144 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 210
Segment Offset 327680 / 446316
--> Segment Header
--> SegCrc : 9a587482
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################--
###########
Check CRC 9a587482 OK!
Write flash Firmware oft 327680 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 455
Segment Offset 393216 / 446316
--> Segment Header
--> SegCrc : b4df2d31
--> SegSize : 0000cf6c
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################--
##################################################################
Check CRC b4df2d31 OK!
Write flash Firmware oft 393216 / 446316 , size 53100
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 122
Firmware EOF Marker OK! Got Firmware Size 446316
[STATE] 8 -> 9 , UIP-Flags ffffffff
[STATE] 9 -> 11 , UIP-Flags ffffffff
Set upgrade_retcode = 0
ENV CRC correct: 8DD43BD9
Can't get upgrade_retcode, add to the end position
Update ENV completed!!!!
[webclient_closed] Status 11
[STATE] 11 -> 12 , UIP-Flags ffffffff
==> Run application from: 0x10000 <==
[SERIAL] Ready!!
FW Version : 1.8.4.674
OS Version : 51300
Build Info : Dec 10 2020 10:03:21
[WDT] Initial
[WDT] Disable WatchDog ......
[WDT] Start
[FLASH_DEV] Flash init. start 00000000 sz 00080000 sector size 00001000
[FLASH_DEV] Register Flash 3 oft 00000000 sz 00010000
[FLASH_DEV] Register Flash 0 oft 0007e000 sz 00001000
[ENV] flash offset 0007e000 size 00001000
[SYSINFO] Set LED enabled 0
[SYSINFO] Set System Default 0
[LED] Started!
[FLASH_DEV] Register Flash 1 oft 0007f000 sz 00001000
[FLASH_DEV] Register Flash 2 oft 0007d000 sz 00001000
[SSL]
[SSL-S] Loading the server cert. and key...
[SSL] service started!!
UBNT CLI
/>[SSL]
[SSL-S] Gen fingerprint [SHA-1 CD:26:3A:8C:AB:0C:49:38:1F:65:BE:CA:88:4E:11:C6:04:22:44:BE] ...
[SSL] ok
[SSL] Bind on https://Any:22/ ...
[SSL] ok
[SSL] Seeding the random number generator...
[SSL] ok
[SSL] Setting up the SSL data....
[SSL] ok
[BOOT] Post
[NETDEV] Init
[NETDEV] Set static 192.168.1.20 mask 255.255.255.0 gw 192.168.1.1
[NETDEV] Disconnected.
[EMAC] Link Up
[NETDEV] Connected. IP Addr: 192.168.1.20
[NETDEV] Setup STP ... done
[NETDEV] Setup jumbo frame ... done
[NETDEV] Setup flowcontrol ... done
[NETDEV] Setup stormctrl ... done
[NETDEV] Setup egress ratelimit ... done
[NETDEV] Setup port isolation ... done
[NETDEV] Port 1 mirror src port 0 iso 0!
[NETDEV] Setup port mirror ... done
[NETDEV] Setup PVID... done
[NETDEV] Setup Management VLAN... done
[NETDEV] Setup port enable ... done
[NETDEV] Switch configuration done. changed 1!
[NETDEV] DHCPC enabled.
DHCP_DISCO TR=1 TM=4
[NETDEV] Service Started!
Mac Address is 74:83:c2:0f:15:8f
[NETDEV-LLDP] started!
[MCAD-DBG] reporter_create:Create reporter
[SYSINFO] Set System Default 1
[MCAD] default url http://unifi:8080/inform
[SYSINFO] Set System Default 0
[MCAD] set self url http://192.168.128.2:8080/inform
[STUN] STUN service started ...
[MCAD] Reporter started!
[FW_UPDATER] FW upgrade success!
[ENV] Set Name do_fwupgrade = 0
[ENV] Erasing flash...at 0007e000 size 00001000
[FLASH_DEV] Erase flash 0 oft 516096 sz 4096
[ENV] Writing to flash... done
[FW_UPDATER] Loader version 1.0.7
[SYSINFO] Set Boot from Loader
[NETDEV] IP changed: / gw -> 192.168.1.20 / 255.255.255.0 gw 192.168.1.1
LLDP Send: len 68
[DISCOVERY] [05:03:28] uptime [ 4923812] - Broadcast beacon.
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://192.168.128.2:8080/inform] Time 4
DHCP_DISCO TR=2 TM=8
NETDEV-LLDP: upd idx 0 74:ac:b9:e3:96:9f TTL 120 Port 1 PORTID Port VID 0
NETDEV-LLDP: upd idx 0 74:ac:b9:e3:96:9f TTL 120 Port 1 PORTID Port VID 0
DHCP_DISCO TR=3 TM=16
NETDEV-LLDP: upd idx 0 74:ac:b9:e3:96:9f TTL 120 Port 1 PORTID Port VID 0
DHCP_DISCO TR=4 TM=32
[INFORM-ERR] inform_send 24:HttpRequest failed (error -3004)
[INFORM-ERR] inform_handle_response 2321:Null HTTP response!
[MCAD-ERR] reporter_fail 1110:faile reason: Timeout (http://192.168.128.2:8080/inform)
[INFORM-ERR] reporter_fail 1123:initial contact failed #1, url=http://192.168.128.2:8080/inform, rc=4
[DISCOVERY] [05:03:46] uptime [ 19375906] - Broadcast beacon.
[MCAD-DBG] set_inform_default_url:Set default inform url http://192.168.128.2:8080/inform
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://192.168.128.2:8080/inform] Time 23
[MCAD-DBG] find_uplink:Uplink port changed to 1 from 0
[MCAD] [STATE] MANAGED
[INFORM-DBG] reporter_handle_response:cfgversion: 560ac6c863220b2a -> f961b469723293b4
[INFORM] selfrun_guest_mode : pass
[INFORM] capability: notif,fastapply-bg,notif-assoc-stat
[INFORM-DBG] reporter_handle_response:system_cfg set username <***>
[ENV] Set Name username = <***>
[INFORM-DBG] reporter_handle_response:system_cfg set password <***>
[ENV] Set Name password = <***>
[NETDEV] Setup STP ... done
[NETDEV] Setup jumbo frame ... done
[NETDEV] Setup flowcontrol ... done
[NETDEV] Setup stormctrl ... done
[NETDEV] Setup egress ratelimit ... done
[NETDEV] Setup port isolation ... done
[NETDEV] Port 1 mirror src port 0 iso 0!
[NETDEV] Setup port mirror ... done
[NETDEV] Setup PVID... done
[NETDEV] Setup Management VLAN... done
[NETDEV] Setup port enable ... done
[NETDEV] Switch configuration done. changed 0!
[ENV] Set Name system_cfg = <***>
[MCAD] Save mgmt
[ENV] Set Name mgmt.is_default = 0
[ENV] Set Name mgmt.led_enabled = 0
[ENV] Set Name mgmt.report_crash = 1
[ENV] Set Name mgmt.cfgversion = f961b469723293b4
[ENV] Set Name mgmt.authkey = <***>
[ENV] Set Name mgmt.selfrun_guest_mode = pass
[ENV] Set Name mgmt.capability = notif,fastapply-bg,notif-assoc-stat
[ENV] Set Name mgmt.use_aes_gcm = true
[ENV] Set Name mgmt.servers.1.url = <***>
[ENV] Set Name stun_url = <***>
[ENV] Set Name mgmt_url = <***>
[ENV] Erasing flash...at 0007e000 size 00001000
[FLASH_DEV] Erase flash 0 oft 516096 sz 4096
[ENV] Writing to flash... done
[INFORM-DBG] reporter_inform_send:Send notify [setparam] inform to [http://192.168.128.2:8080/inform] Time 25
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://192.168.128.2:8080/inform] Time 26