Flashing firmware for the EM7690 in a MOFI 5500 - Failed to parse xml

[memog1]

So, a while back I reset the EM7690 modem in my MOFI 5500 to defaults and it lost it's firmware image. I started poking around and for some reason, MOFI no longer has the modem flasher option in the UI. It was there on the 4500 from what I have seen. So, I found that the 5500 runs on a Linux under the MIPSEL architecture. I was unable to find any pre-compiled firmware tool (fwdwl) so I used QEMU to launch a version of Debian on MIPSEL and compiled it from the source. I am able to run the executable from the MOFI now but the firmware update process fails. Here is the script I am using:

devpath=`ls /dev | grep -i -E 'cdc-wdm0|qcqmi'`
devtype=`expr "$devpath" : '\(cdc-wdm0\|qcqmi\)[0-9]$'`
case $devtype in
cdc-wdm) devtype="MBIM" ;;
qcqmi) devtype="QMI" ;;
*) printf "Unknown Device Type = $devtype\r\nDevice Path = /dev/$devpath\r\n"; exit
esac
printf "Device Type = $devtype\r\nDevice Path = /dev/$devpath\r\n"

./fwdwl-litemipsel \
--devmode $devtype \
--devpath /dev/$devpath \
--modelfamily 4 \
--logfile "fwdwl-lite-$devpath.log" \
-e 1 \
--fwpath "./" \
--dmreset

When I run the script, it stops at waiting for BOOTHOLD so I have to connect to the modem an issue AT!BOOTHOLD. It then starts to load the firmware then stops with the following output:

BOOT and HOLD Mode. Downloading firmware ...
iFWImageType:6
eFW_TYPE_CWE_NVU
Tx(48):02 00 00 00 30 00 00 00 02 00 00 00 02 00 00 00 .. 00 00 00
Tx(12):0d 00 00 00 0c 00 00 00 00 ff 00 00
Tx(12):0f 00 00 00 0c 00 00 00 00 ff 00 00

The end of the log file shows:

[1674][7]Send Empty Block
[1674][7]Send Empty Block Done
[1674][7]payload [232]

[1674][7]Lite9x07Download Rx:<?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to parse xml, error at offset 506, 512" /></data><?xml version="1.0" encoding="UTF-8" ?>
<data>
<log value="ERROR: Failed to run the last command -1" /></data>

[Rich Hathaway]

Open the xml file in notepad+ and go to line 506 and have a look, that data part is usually protected in sierra devices and may only be write-able from 9008 mode (emergency) and not 900E (download) mode which is what you are writing from, however this image you are using is not write-able from 9008, I suggest if your image is complete that you try to use fdt to write it instead.

[memog1]

Thanks for the reply Rich. I am assuming I will need a tool to open the firmware file to be able to look at the XML as the 2 files I have are cwe and nvu. I'll do some digging. Yeah, the FDT method has crossed my mind but I would like to avoid taking the modem out of the router if possible. That is why I have gone through all the trouble to build the fwdwl tool for MIPSEL but I might just have to bite the bullet.