I was able to un-brick a Bullet M2 today. I wrote this quick instruction document on how to do it. I want to write a more detailed explanation later, but for now these instructions should be adequate for anyone trying to un-brick an AirMAX device.
If a device that is loaded with U-Boot 220.127.116.11-s956 (Jun 10 2015 — 10:54:50), which is
installed by default any time AirOS v5.6.2 or v5.6.3, has OpenWRT or Gargoyle firmware loaded
on top of it, the device will not work correctly.
The configurations made to Gargoyle or OpenWRT will not survive a reboot, and everything will be back to default.
If you then try to re-upload a version of AirOS the device would get stuck in an endless reboot
loop. Previously it was thought that the device was un-recoverable.
However, there is an option when using the urescue command that overwrites the bootloader.
When using urescue without this option the bootloader would not be overwritten.
1 USB-TTL Cable
2 Ethernet Cables
1 POE Converter
1 Bricked Device
1 TFTP Server Application (Example: Solar Winds)
1 AirOS v5.5.10 Firmware File
Tera-term or another Serial Port program
The following is the Procedure to unbrick the device:
1. Open up the device and locate the serial jumper, labeled J1.
2. Connect the USB-TTL Cable to the jumper, which has the following pinout:
—1. 3.3V+ (Red: Do not connect)
—2. S-in (GREEN)
—3. S-out (White)
3. Open up a terminal program, such as tera-term, and configure it to the following settings:
—Bits per second: 115200
—Data Bits : 8
—Stop Bits : 1
—Parity : None
—Flow control : None
4. Plug the POE adapter into the wall.
5. Plug the LAN side of the device into your PC.
6. Configure your PC IP settings to the following:
—IP Address: 192.168.1.123
—Netmask : 255.255.0.0
7. Connect the POE side of the POE adapter into the Bullet M2 (or any other AirMax device).
8. Continually press any key while the tera-term window is selected. Doing this will interrupt
the boot sequence and allow you to enter terminals while the device is in the bootloader.
9. Once the boot has been stopped, enter the following into the terminal: urescue -f -e
—It is vital that the -f and -e are there. This allows the bootloader to be over written.
10. Now start the TFTP application on your PC.
11. Open a command prompt on your PC and use the cd command to navigate to the location of your
AirOS v5.5.10 firmware file.
12. Type the following command in the command prompt:
tftp -i 192.168.1.20 put XM.v18.104.22.16841.141001.1649.bin
13. You should now see text being written in the terminal screen.
14. Keep watching the text until it says the device is resetting. When it does reset,
continually press any key to interrupt the boot.
15. When the boot has been interrupted, type the following in the serial console, pressing enter after each line:
16. The device will now boot. Wait about 2 minutes, and then access the webpage of AirOS by
typing 192.168.1.20 in the web address bar.
17. Login to the page and navigate to the system tab. Upload the same firmware version, AirOS
v5.5.10, that you used in the urescue command.
18. Once the device reboots you will have a non-bricked, perfectly functional, wireless device.