Exploring the Ubiquiti USW Flex Mini

image of Ubiquiti USW-Mini

Note: a very casual exploration that really puts the “notes” in tech notes. More or a sketch so I remember where I stopped if I pick this up again.

In the immediate aftermath of digging into the UniFi inform protocol, one of the responses on reddit was basically that some UniFi devices used an embedded OS, not Linux, so one couldn’t expect them to have a proper crypto stack.

From experience, I know that modern MCUs generally do have featureful crypto stacks available, but thought it might be fun to explore one of (the only?) UniFi devices that does not run Linux. Certantly more fun than arguing with someone on reddit ­čśŐ

Hardware

image of MCU and switch ICs After disassembly, we see an odd ARM Cortex MCU labeled Nuvoton (UB10 / U810) 2922B037-ZZ2 938ACLA. Perhaps a custom spin for Ubiquiti because there’s no trace of the chip’s part numbers online.

It appears to be a ARMv8-M (Cortex M23 or M33), not a M0/M4 because TrustZone features (generall the BLXNS instruction) are used in firmware.

Ethernet switching is handled by a RTL8367RB which provides five external and two internal 10/100/1000 Ethernet ports.

Otherwise a fairly normal SoHo switch board. Gaining console access was straightforward:

Console pinout (from the back of the board where back = where USB-C is) is: +3.3VDC, RX, TX, GND

Software

The Mini runs Arm Mbed OS. Mbed is not a general purpose OS like Win/Linux/BSD. Application code is compiled into one multi-threaded application that runs on the metal.

Embedded 2048 bit RSA public key for ??

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnxH+ZiJ+6ppXlNIWZlpE
ywLaUC6bD3N4AxFer3U9CHFmM++JTubnDbQ1bnUCME7jyL8VuhAgjsVIrt0q9ODr
SusQbkV/hErhr2DJFJqUF0kFq5OCScFMCQYV9rd5beANBB4RGgmnsWMIAPZ2JS/z
LJcdDD57fwWPBl1oXF5iX8PS90lKfcOuoN29njcxHkF8aRw8SBvDbtpjXfalAmRK
THAjhHU56qeghYLV4qmFvtiGZ7JGrl/SaqOJ3Hk9xopWRu+4c8gRL1GaKL25PBaD
4dT5FWIL9zGY6bUec3ZjzGyek0tGnFiTcPjtdKvkBM4JCQpxGO5C0AZcR8zEZ8z3
gwIDAQAB
-----END PUBLIC KEY-----

Management

For future exploration, there’s a web server using TLS running on port 22. Is this a way to configure the device from a mobile app? While looking around with Ghidra I saw mention of a standalone config mode but didn’t have a chance to explore further.

Some console log output

Dumping output here because it’s fascinating.

Boot log

######## Bootloader ########
Version      : 1.0.7
DateTime     : May  8 2020 - 14:52:24
Ethernet MAC : 74:83:c2:0f:15:8f
Flash Configurations:
    FLASH_APPLICATION_SIZE    : 0x6d000
    FLASH_APPLICATION_ADDRESS : 0x10000
    FLASH_DATA_ADDRESS        : 0x7d000
    -- FLASH_TLS_ADDRESS         : 0x7d000
    -- FLASH_ENV_ADDRESS         : 0x7e000
    -- FLASH_SIGNED_IMAGE_ADDRESS: 0x7f000

FMC_ReadConfig:FFFFFFBE, 7D000
ENV CRC correct: FA8F2BE4
do_fwupgrade=0
dhcp_enable=1
recovery_enable is unset
recovery_enable=0
Detect reset-button 8
do_fwupgrade=0, no need upgrade firmware

==> Run application from: 0x10000 <==

[SERIAL] Serial Ready!!


        FW Version   : 1.7.5.636
        OS Version : 51300
        Build Info   : May 26 2020 14:45:52


[WDT] Initial
[WDT] Disable WatchDog ......
[WDT] Start
[FLASH_DEV] Flash init. start 00000000 sz 00080000 sector size 00001000
[FLASH_DEV] Register Flash 3 oft 00000000 sz 00010000
[FLASH_DEV] Register Flash 0 oft 0007e000 sz 00001000
[ENV] flash offset 0007e000 size 00001000
[LED] Started!
[FLASH_DEV] Register Flash 1 oft 0007f000 sz 00001000
[FLASH_DEV] Register Flash 2 oft 0007d000 sz 00001000
[SSL] service started!!

[SSL]
  [SSL-S] Loading the server cert. and key...
UBNT CLI
/>[SSL]
  [SSL-S] Gen fingerprint [SHA-1 CD:26:3A:8C:AB:0C:49:38:1F:65:BE:CA:88:4E:11:C6                                                                                           :04:22:44:BE] ...
[SSL]  ok

[SSL] Bind on https://Any:22/ ...
[SSL]  ok

[SSL] Seeding the random number generator...
[SSL]  ok

[SSL] Setting up the SSL data....
[SSL]  ok

[BOOT] Post
[NETDEV] Init
[NETDEV] Set static 192.168.1.20 mask 255.255.255.0 gw 192.168.1.1
[NETDEV] Disconnected.
[EMAC] Link Up
[NETDEV] Connected. IP Addr: 192.168.1.20
[NETDEV] Setup STP ... done
[NETDEV] Setup jumbo frame ... done
[NETDEV] Setup flowcontrol ... done
[NETDEV] Setup stormctrl ... done
[NETDEV] Setup egress ratelimit ... done
[NETDEV] Setup port isolation ... done
[NETDEV] Port 1 mirror src port 0 iso 0!
[NETDEV] Setup port mirror ... done
[NETDEV] Setup PVID... done
[NETDEV] Setup Management VLAN... done
[NETDEV] Setup port enable ... done
[NETDEV] Switch configuration done. changed 0!
[NETDEV] DHCPC enabled.
DHCP_DISCO TR=1 TM=4
[NETDEV] Service Started!
Mac Address is 74:83:c2:0f:15:8f
[NETDEV-LLDP] started!
[MCAD] Create reporter
[MCAD] default url http://unifi:8080/inform

[MCAD] [STATE] DEFAULT
[MCAD] set self url http://unifi:8080/inform

[STUN] STUN service started ...
[MCAD] Reporter started!
[FW_UPDATER] Loader version = 1.0.7
[SYSINFO] Set Boot from Loader
[NETDEV] IP changed:  /  gw  -> 192.168.1.20 / 255.255.255.0 gw 192.168.1.1
LLDP Send: len 68
[DISCOVERY] [04:50:22] uptime [  12777942] - Broadcast beacon.
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://unifi:8080/inform] Time 12787704
DHCP_DISCO TR=2 TM=8
DHCP_DISCO TR=3 TM=16
DHCP_DISCO TR=4 TM=32
[INFORM-ERR] prepare_inform 2825:translate inform host [unifi] failed! ret -3009
[CRASH] BOM: 000b230a
[CRASH] emac_stack = 20005ec8, ssl_stack = 2000e928, eloop_stack = 200065d8, reporter_stack = 2000c890
[WDT] Normal system reboot

[CRASH] OS crash reporting completed
DHCP_DISCO TR=5 TM=40
[INFORM-ERR] inform_send 24:HttpRequest failed (error -3009)

[INFORM-ERR] inform_handle_response 2275:Null HTTP response!

[MCAD-ERR] reporter_fail 1093:faile reason: Timeout (http://unifi:8080/inform)
[INFORM-ERR] reporter_fail 1106:initial contact failed #1, url=http://unifi:8080/inform, rc=4
[DISCOVERY] [04:51:00] uptime [  44289772] - Broadcast beacon.
LLDP Send: len 68
[DISCOVERY] [04:51:01] uptime [  45313768] - Broadcast beacon.
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://unifi:8080/inform] Time 48362502
DHCP_DISCO TR=6 TM=40
[INFORM-ERR] prepare_inform 2825:translate inform host [unifi] failed! ret -3009

/>help
Commands:
help            This help
echo            Echo controlling
alias           Handle aliases
unset           unset variables
set             print or set variables
clear           Clears the display
history         View your command Line History
true
false
reset           Reboot
uid             Show UID
model           Show Model ID
setenv          Set env variable
printenv        Print env variable
saveenv         Save env to flash
version         Show firmware version
led             LED: led blue/white on/off
build           Show build info
ip              Show/Set IP
mac             Show MAC address
ip2mac          Translate IP to MAC address
resetenv        Reset ENV variables
stack           Show thread stack status
heap            Show heap status
thread          Show thread status
state           Show reporter state
uptime          Show uptime
port            Show port status/stats/mac
locate          Set locate status
fwupdate        Update firmware
bootloader      Show bootloader version
wdt             Start/Stop watchdog
board           Board info
/>board
eth0            : 74:83:c2:0f:15:8f
Magic           : 40344b42
SubSystem_ID    : ed30
SubVendor_ID    : 0777
BOM Rev         : 000b230a
/>[INFORM-ERR] inform_send 24:HttpRequest failed (error -3009)

[INFORM-ERR] inform_handle_response 2275:Null HTTP response!

[MCAD-ERR] reporter_fail 1093:faile reason: Timeout (http://unifi:8080/inform)
[INFORM-ERR] reporter_fail 1106:initial contact failed #2, url=http://unifi:8080/inform, rc=4

Some casual poking around

/>build 
Build 
-- DateTime : May 26 2020 14:45:52
-- Extra Tag: 0-ge163613-dirty
-- Mbed OS  : 51300
-- CPU ID   : 0x410fc241
-- Compiler : 0x00000001-0x004d388e
-- Region 0 : RAM 0x20000000 Size 0x00028000
            : ROM 0x00000000 Size 0x00080000
-- Region 1 : RAM 0x00000000 Size 0x00000000
            : ROM 0x00000000 Size 0x00000000
-- Region 2 : RAM 0x00000000 Size 0x00000000
            : ROM 0x00000000 Size 0x00000000
-- Region 3 : RAM 0x00000000 Size 0x00000000
            : ROM 0x00000000 Size 0x00000000
/>DHCP_DISCO TR=8 TM=40

>ip 
Interface: up
IP      : 192.168.1.20
Netmask : 255.255.255.0
Gateway : 192.168.1.1
/>printenv 
dhcp_enable=1
do_fwupgrade=0
gateway=192.168.1.1
ipaddr=192.168.1.20
mgmt.authkey=6844C8C509E477C24A859FEC14B056AA
mgmt.capability=notif,fastapply-bg,notif-assoc-stat
mgmt.cfgversion=216318a06802e8ab
mgmt.is_default=0
mgmt.led_enabled=0
mgmt.selfrun_guest_mode=pass
mgmt.servers.1.url=http://192.168.128.2:8080/inform
mgmt.use_aes_gcm=true
mgmt_url=https://192.168.128.2:8443/manage/site/default
netmask=255.255.255.0
password=uioL/HMR0lLDg
stun_url=stun://192.168.128.2:3478/
switch.port.1.pvid=1
system_cfg=# switch\
switch.power_source.status=disabled\
switch.managementvlan=1\
switch.wevent.idp=enabled\
switch.wevent.mcip=239.254.127.63\
switch.wevent.key=464d87f2c7077ba74a0c1d7fc5d7d1da\
switch.jumboframes=disabled\
switch.mtu=9216\
switch.routing_enabled=false\
switch.port.1.name=Port 1\
switch.port.1.opmode=switch\
switch.port.1.pvid=10\
switch.port.2.name=Port 2\
switch.port.2.opmode=switch\
switch.port.2.pvid=10\
switch.port.3.name=Port 3\
switch.port.3.opmode=switch\
switch.port.3.pvid=10\
switch.port.4.name=Port 4\
switch.port.4.opmode=switch\
switch.port.4.pvid=10\
switch.port.5.name=Port 5\
switch.port.5.opmode=switch\
switch.port.5.pvid=10
username=csadmin

Log from upgrade process

[MCAD-ERR] reporter_fail 1093:faile reason: Timeout (http://192.168.128.2:8080/inform)
[INFORM-ERR] reporter_fail 1114:inform failed #1 (last inform: 7 seconds ago), rc=4
[MCAD] Set default inform url http://192.168.128.2:8080/inform
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://192.168.128.2:8080/inform] Time 258624533
[INFORM-DBG] reporter_inform_send:Send notify [stun] inform to [http://192.168.128.2:8080/inform] Time 265431217
[MCAD] [STATE] UPGRADE
[MCAD] Upgrade http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[MCAD] Upgrade http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[ENV] Set Name reporter_fw_url = http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[ENV] Erasing flash...at 0007e000 size 00001000
[FLASH_DEV] Erase flash 0 oft 516096 sz 4096

[ENV] Writing to flash... done
[STUN] STUN service is stopped ...
[SYSINFO] Set System Upgrading1
[FW_UPDATER] App Required version 1.7.3
[FW_UPDATER] 
===> Check FW url=http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[INFORM-DBG] reporter_inform_send:Send alert [Upgrade] inform to [http://192.168.128.2:8080/inform] Time 265983623
[FW_UPDATER] Image Magic = aa5555aa
[FW_UPDATER] -- Image Protocol Version = 0002
[FW_UPDATER] -- Image Flags             = 0000
[FW_UPDATER] 
[FW_UPDATER] FW Magic = 11223344
[FW_UPDATER] -- FW Type          = 0002
[FW_UPDATER] -- FW Product ID    = 0001
[FW_UPDATER] -- FW Flags         = 0000 (Unsigned)
[FW_UPDATER] -- FW Version       = 00000000 (1.0.7.0)
[FW_UPDATER] -- FW CRC           = e12222e8
[FW_UPDATER] -- FW Size          = 0000e2c8 (58056)
[FW_UPDATER] -- FW Payload Size  = 0000e2dc (58076)
[FW_UPDATER] Loader FW version 1.0.7.0 is same. Skip it
[FW_UPDATER] -   536
[FW_UPDATER] FW Magic = 11223344
[FW_UPDATER] -- FW Type          = 0001
[FW_UPDATER] -- FW Product ID    = 0001
[FW_UPDATER] -- FW Flags         = 0001 (Signed)
[FW_UPDATER] -- FW Version       = 000002a2 (1.8.4.674)
[FW_UPDATER] -- FW CRC           = 5f1f2ebe
[FW_UPDATER] -- FW Size          = 0006cf6c (446316)
[FW_UPDATER] -- FW Payload Size  = 0006cfc8 (446408)
[FW_UPDATER] App FW version 1.8.4.674. check required version OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 560723d2
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 560723d2 OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 90c0109e
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 90c0109e OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = b5db20ba
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC b5db20ba OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 48ac9a5c
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 48ac9a5c OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 34fb0a61
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 34fb0a61 OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = 9a587482
[FW_UPDATER] -- Seg Size = 00010000
[FW_UPDATER] -- Calc CRC 9a587482 OK!
[FW_UPDATER] Seg Magic = 01020304
[FW_UPDATER] -- Seg CRC = b4df2d31
[FW_UPDATER] -- Seg Size = 0000cf6c
[FW_UPDATER] -- Calc CRC b4df2d31 OK!
[FW_UPDATER] EOF Marker OK!
[FW_UPDATER] 
[FW_UPDATER] FW Magic = 11223344
[FW_UPDATER] -- FW Type          = 0005
[FW_UPDATER] -- FW Product ID    = 0001
[FW_UPDATER] -- FW Flags         = 0000 (Unsigned)
[FW_UPDATER] -- FW Version       = 000002a2 (1.8.4.674)
[FW_UPDATER] -- FW CRC           = 7320131f
[FW_UPDATER] -- FW Size          = 00000100 (256)
[FW_UPDATER] -- FW Payload Size  = 00000108 (264)
[FW_UPDATER] Sign size: 256
[FW_UPDATER] Verify App signature ... OK!
[SYSINFO] Set System Upgrading0
[INFORM-DBG] reporter_inform_send:Send alert [Upgrade] inform to [http://192.168.128.2:8080/inform] Time 272449630
[FW_UPDATER] App FW check done. Prepare to update flash from bootloader ... 
[SYSINFO] Set Boot from Loader
[ENV] Set Name fw_crc = 5F1F2EBE
[MCAD] Upgrade Success!
[ENV] Set Name fw_url = http://fw-download.ubnt.com/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
[ENV] Set Name do_fwupgrade = 1
[ENV] Erasing flash...at 0007e000 size 00001000
[FLASH_DEV] Erase flash 0 oft 516096 sz 4096

[ENV] Writing to flash... done
[MCAD] Reboot now...
[SYSINFO] Reset Sys´┐Ż

######## Bootloader ########
Version      : 1.0.7 
DateTime     : May  8 2020 - 14:52:24
Ethernet MAC : 74:83:c2:0f:15:8f
Flash Configurations:
    FLASH_APPLICATION_SIZE    : 0x6d000
    FLASH_APPLICATION_ADDRESS : 0x10000
    FLASH_DATA_ADDRESS        : 0x7d000
    -- FLASH_TLS_ADDRESS         : 0x7d000
    -- FLASH_ENV_ADDRESS         : 0x7e000
    -- FLASH_SIGNED_IMAGE_ADDRESS: 0x7f000

FMC_ReadConfig:FFFFFFBE, 7D000
ENV CRC correct: 8DD43BD9
do_fwupgrade=1
dhcp_enable=1
recovery_enable is unset
recovery_enable=0
Server ip:fw-download.ubnt.com:80, fileName:/data/unifi-firmware/4e36-USMINI-1.8.4-d12d41bc0d1e4b42adc75f8030ceed07.bin
fw_crc: 5f1f2ebe
Static IP: 192.168.1.20
NetMask: 255.255.255.0
Gateway: 192.168.1.1
Can't get nameserver1
Can't get nameserver2


Detect reset-button 8
WatchDog config ....
Use DHCP
[STATE] 0 -> 1 , UIP-Flags ffffffff
DHCP Info
-- IP address 192.168.128.223 mask 255.255.255.0 gw 192.168.128.1
-- DNS server 192.168.128.1
-- Lease expires in 3600 seconds
[STATE] 1 -> 2 , UIP-Flags ffffffff
[STATE] 2 -> 1 , UIP-Flags ffffffff
resolve_found: IP address 13.35.121.72
[STATE] 1 -> 3 , UIP-Flags ffffffff
[mainStatus] Resolv domain, start downloading file
[STATE] 3 -> 4 , UIP-Flags ffffffff
[mainStatus] GET_HEADER: The connection was initiated: 0
[STATE] 4 -> 1 , UIP-Flags ffffffff
[webclient_connected]
#
Image Header
--> Image Header Version : 0200 2
--> Image Header Flags   : 0000

FW Header
--> FW Type            : 0002
--> FW Product ID      : 0001
--> FW version         : 05f6f270 100070000
--> FW CRC             : e12222e8
--> FW Size            : c8e20000 58056
--> FW payload size    : dce20000 58076
Skip non-app firmware!!! payload size 58076
[STATE] 1 -> 5 , UIP-Flags 00000023
#[STATE] 5 -> 1 , UIP-Flags 00000023
###############################################################################-- 

Skip firmware ... done!!

FW Header
--> FW Type            : 0001
--> FW Product ID      : 0001
--> FW version         : 067091e2 108040674
--> FW CRC             : 5f1f2ebe
--> FW Size            : 6ccf0600 446316
--> FW payload size    : c8cf0600 446408
Verify Firmware CRC 5f1f2ebe OK


Segment Offset 0 / 446316
--> Segment Header
--> SegCrc  : 560723d2
--> SegSize : 00010000
[STATE] 1 -> 6 , UIP-Flags 00000023
#[STATE] 6 -> 1 , UIP-Flags 00000023
###############################################################################-- 
###########
Check CRC 560723d2 OK!
Write flash Firmware oft 0 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 676


Segment Offset 65536 / 446316
--> Segment Header
--> SegCrc  : 90c0109e
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################-- 
##########
Check CRC 90c0109e OK!
Write flash Firmware oft 65536 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 198


Segment Offset 131072 / 446316
--> Segment Header
--> SegCrc  : b5db20ba
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################-- 
###########
Check CRC b5db20ba OK!
Write flash Firmware oft 131072 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 443


Segment Offset 196608 / 446316
--> Segment Header
--> SegCrc  : 48ac9a5c
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################-- 
###########
Check CRC 48ac9a5c OK!
Write flash Firmware oft 196608 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 688


Segment Offset 262144 / 446316
--> Segment Header
--> SegCrc  : 34fb0a61
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################-- 
##########
Check CRC 34fb0a61 OK!
Write flash Firmware oft 262144 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 210


Segment Offset 327680 / 446316
--> Segment Header
--> SegCrc  : 9a587482
--> SegSize : 00010000
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################-- 
###########
Check CRC 9a587482 OK!
Write flash Firmware oft 327680 / 446316 , size 65536
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 455


Segment Offset 393216 / 446316
--> Segment Header
--> SegCrc  : b4df2d31
--> SegSize : 0000cf6c
[STATE] 8 -> 1 , UIP-Flags ffffffff
################################################################################-- 
##################################################################
Check CRC b4df2d31 OK!
Write flash Firmware oft 393216 / 446316 , size 53100
[STATE] 1 -> 7 , UIP-Flags 00000033
[STATE] 7 -> 8 , UIP-Flags ffffffff
Do remain data process len 122
Firmware EOF Marker OK! Got Firmware Size 446316
[STATE] 8 -> 9 , UIP-Flags ffffffff
[STATE] 9 -> 11 , UIP-Flags ffffffff

Set upgrade_retcode = 0
ENV CRC correct: 8DD43BD9
Can't get upgrade_retcode, add to the end position
Update ENV completed!!!!
[webclient_closed] Status 11
[STATE] 11 -> 12 , UIP-Flags ffffffff

==> Run application from: 0x10000 <==

[SERIAL] Ready!!


	FW Version   : 1.8.4.674
	OS Version : 51300
	Build Info   : Dec 10 2020 10:03:21


[WDT] Initial
[WDT] Disable WatchDog ...... 
[WDT] Start
[FLASH_DEV] Flash init. start 00000000 sz 00080000 sector size 00001000
[FLASH_DEV] Register Flash 3 oft 00000000 sz 00010000
[FLASH_DEV] Register Flash 0 oft 0007e000 sz 00001000
[ENV] flash offset 0007e000 size 00001000
[SYSINFO] Set LED enabled 0
[SYSINFO] Set System Default 0
[LED] Started!
[FLASH_DEV] Register Flash 1 oft 0007f000 sz 00001000
[FLASH_DEV] Register Flash 2 oft 0007d000 sz 00001000
[SSL] 
  [SSL-S] Loading the server cert. and key...
[SSL] service started!!

UBNT CLI
/>[SSL] 
  [SSL-S] Gen fingerprint [SHA-1 CD:26:3A:8C:AB:0C:49:38:1F:65:BE:CA:88:4E:11:C6:04:22:44:BE] ...
[SSL]  ok

[SSL] Bind on https://Any:22/ ...
[SSL]  ok

[SSL] Seeding the random number generator...
[SSL]  ok

[SSL] Setting up the SSL data....
[SSL]  ok

[BOOT] Post
[NETDEV] Init
[NETDEV] Set static 192.168.1.20 mask 255.255.255.0 gw 192.168.1.1
[NETDEV] Disconnected.
[EMAC] Link Up
[NETDEV] Connected. IP Addr: 192.168.1.20
[NETDEV] Setup STP ... done
[NETDEV] Setup jumbo frame ... done
[NETDEV] Setup flowcontrol ... done
[NETDEV] Setup stormctrl ... done
[NETDEV] Setup egress ratelimit ... done
[NETDEV] Setup port isolation ... done
[NETDEV] Port 1 mirror src port 0 iso 0!
[NETDEV] Setup port mirror ... done
[NETDEV] Setup PVID... done
[NETDEV] Setup Management VLAN... done
[NETDEV] Setup port enable ... done
[NETDEV] Switch configuration done. changed 1!
[NETDEV] DHCPC enabled.
DHCP_DISCO TR=1 TM=4
[NETDEV] Service Started!
Mac Address is 74:83:c2:0f:15:8f
[NETDEV-LLDP] started!
[MCAD-DBG] reporter_create:Create reporter
[SYSINFO] Set System Default 1
[MCAD] default url http://unifi:8080/inform

[SYSINFO] Set System Default 0
[MCAD] set self url http://192.168.128.2:8080/inform

[STUN] STUN service started ...
[MCAD] Reporter started!
[FW_UPDATER] FW upgrade success!
[ENV] Set Name do_fwupgrade = 0
[ENV] Erasing flash...at 0007e000 size 00001000
[FLASH_DEV] Erase flash 0 oft 516096 sz 4096

[ENV] Writing to flash... done
[FW_UPDATER] Loader version 1.0.7
[SYSINFO] Set Boot from Loader
[NETDEV] IP changed:  /  gw  -> 192.168.1.20 / 255.255.255.0 gw 192.168.1.1
LLDP Send: len 68
[DISCOVERY] [05:03:28] uptime [   4923812] - Broadcast beacon.
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://192.168.128.2:8080/inform] Time 4
DHCP_DISCO TR=2 TM=8
NETDEV-LLDP: upd idx 0 74:ac:b9:e3:96:9f TTL 120 Port 1 PORTID Port VID 0
NETDEV-LLDP: upd idx 0 74:ac:b9:e3:96:9f TTL 120 Port 1 PORTID Port VID 0
DHCP_DISCO TR=3 TM=16
NETDEV-LLDP: upd idx 0 74:ac:b9:e3:96:9f TTL 120 Port 1 PORTID Port VID 0
DHCP_DISCO TR=4 TM=32
[INFORM-ERR] inform_send 24:HttpRequest failed (error -3004)

[INFORM-ERR] inform_handle_response 2321:Null HTTP response!

[MCAD-ERR] reporter_fail 1110:faile reason: Timeout (http://192.168.128.2:8080/inform)
[INFORM-ERR] reporter_fail 1123:initial contact failed #1, url=http://192.168.128.2:8080/inform, rc=4
[DISCOVERY] [05:03:46] uptime [  19375906] - Broadcast beacon.
[MCAD-DBG] set_inform_default_url:Set default inform url http://192.168.128.2:8080/inform
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://192.168.128.2:8080/inform] Time 23
[MCAD-DBG] find_uplink:Uplink port changed to 1 from 0
[MCAD] [STATE] MANAGED
[INFORM-DBG] reporter_handle_response:cfgversion: 560ac6c863220b2a -> f961b469723293b4
[INFORM] selfrun_guest_mode : pass
[INFORM] capability: notif,fastapply-bg,notif-assoc-stat
[INFORM-DBG] reporter_handle_response:system_cfg set username <***>

[ENV] Set Name username = <***>
[INFORM-DBG] reporter_handle_response:system_cfg set password <***>

[ENV] Set Name password = <***>
[NETDEV] Setup STP ... done
[NETDEV] Setup jumbo frame ... done
[NETDEV] Setup flowcontrol ... done
[NETDEV] Setup stormctrl ... done
[NETDEV] Setup egress ratelimit ... done
[NETDEV] Setup port isolation ... done
[NETDEV] Port 1 mirror src port 0 iso 0!
[NETDEV] Setup port mirror ... done
[NETDEV] Setup PVID... done
[NETDEV] Setup Management VLAN... done
[NETDEV] Setup port enable ... done
[NETDEV] Switch configuration done. changed 0!
[ENV] Set Name system_cfg = <***>
[MCAD] Save mgmt
[ENV] Set Name mgmt.is_default = 0
[ENV] Set Name mgmt.led_enabled = 0
[ENV] Set Name mgmt.report_crash = 1
[ENV] Set Name mgmt.cfgversion = f961b469723293b4
[ENV] Set Name mgmt.authkey = <***>
[ENV] Set Name mgmt.selfrun_guest_mode = pass
[ENV] Set Name mgmt.capability = notif,fastapply-bg,notif-assoc-stat
[ENV] Set Name mgmt.use_aes_gcm = true
[ENV] Set Name mgmt.servers.1.url = <***>
[ENV] Set Name stun_url = <***>
[ENV] Set Name mgmt_url = <***>
[ENV] Erasing flash...at 0007e000 size 00001000
[FLASH_DEV] Erase flash 0 oft 516096 sz 4096

[ENV] Writing to flash... done
[INFORM-DBG] reporter_inform_send:Send notify [setparam] inform to [http://192.168.128.2:8080/inform] Time 25
[INFORM-DBG] reporter_inform_send:Send normal inform to [http://192.168.128.2:8080/inform] Time 26
Want to keep reading? / go back