Making the WR702n run openwrt part 1

After blindly buying a blue tplink router off eBay at 3am, it turns out I bought the WR702n instead of the openwrt friendly WR703n.

The wr702n runs vxworks and only has 2MB flash and 16MB ram and no USB, This isn't enough for openwrt.
It turns out that other fellow hackers have upgraded the flash and ram on the 703 so I'v done the same to the WR702n.

Getting the Parts...

First port of call is to find suitable flash and ram chips.
I have bought MX25L6445EM2I-10G from china and a 512MB sodimm DDR ram stick to harvest the Hynix HY5DU121622DTP-D43 chips.

Replacing the ram...

Changing the ram first seemed best as vxworks would still run once done..
so out with the Hot air and chip Quik and we now have a 64MB ram chip installed.

 

Ram chip removed with flux and hot air

64MB RAM and serial wires.

Vxworks still booted so ram success fully swapped (first boot too).

The flash chip...

I needed an spi flasher of some kind, I had seen the bus pirate being used but I don't have one and didn't fancy buying anymore tools if I dint need to.

Arduino mini pro (3.3v) with spi chip attached to wires. Full size arduino used just for usb to serial.

After spotting  a post on hack a day using an arduino to program the chips, I installed Ubuntu and programmed serprog onto an arduino mini pro. It took a bit of fiddling to get it recognized by flashrom but after a few port speed issues I was able to dump the contents of the new chip.

DAS U-boot...

Now with it all ready to go I needed to find a copy of uboot to install. turns out there's an awesome version with an http server built in for flashing.

Wrote that to the chip with flashrom, verified it and then soldered it in place of the 2MB chip.

Success!!!

powered it up and uboot started to scroll messages in putty. Next was to get openwrt installed.

Turns out the http server is a bit temperamental and only likes firefox 13.0.1? 

after programming the latest sysupgrade file for openwrt it flashed itself and rebooted and was greeted by the boot log of openwrt :)

To be continued...

I still need to recover the unique "ART" partition from the original 2MB flash chip so the wifi will work.

I also need to update uboot for 8mb as it only can access the first 4mb atm. 

Lastly the usb port needs to work so I just need to add some components to get that working too.

State of the Union

Well its been nearly a whole year since my last post, which sucks but there has been some major things happen which have taken up most of my time.

First of all I got a job finally, Yay! working for Geek Squad in Carphone Warehouse, which was totally not what I expected but the job is great and I've nearly been there a year, and hope to stay a few more.

Having a job has opened a lot of other opportunities, the biggest one being I now have a driving licence and a car, and being able to afford new toys like a Galaxy S2 and Rigol Scope.

Well now that I've dusted off the blog and realised I've deleted all the pictures (doh!) I shall start posting again soon, and I have a few things I shall be posting about such as;

• Olimexino - was looking for cheap dev boards with canbus and found this, its based on the maple which is like an Arduino but on speed. Managed to get it to write stuff to an sd card so should have a post about a Megasquirt logger at some point.

• Sony Ericsson Live view - Got one for xmas and the novelty wore off after about a day, mainly due to it dropping connection to my phone, which it gets time data from so its not even good at being a watch. There is a thread on XDA trying to hack it to make it better but seems dead in the water. Strangely enough it has the same processor as the Olimexino so I'm semi familiar to it, so hopefully I can re purpose it for greater things.

• Galaxy S2 - No idea, great phone but I would like to make an few apps, mainly to work with megasquirt. The Tunerstudio dude is making apps but they will probably turn into beggar ware to so a nice open logger would be a good project.

• My Car/ Megasquirt - Now my relationship with megaturd as it is now known is a love hate one. I love the flexibility but the hardware is shit the licence is shit and tunerstudio is beggerware, I'm sick of the db37 and the mess you have to make if you want to do any adjustments or use decent guage wire. Jean has made a nice microsquirt style ecu but its expensive for what it does. Fingers crossed there's an MS3 based microsquirt or they get Quoriva working.  or dare i say it FreeEMS get it act together and gets stable hardware and missing tooth code working. I know theres plenty of off the shelf ecus that just work, but I know ms and for the cost nothing touches it. so you may see some post about custom boards etc for the module but I'm not sure yet.

well thats about it for now.

Woo my goodfet boards came!

Many thanks to Travis Goodspeed for posting some GoodFet41 boards to me, still not got all the parts yet [ skint :( ] but here's a few snaps of my semi assembled board, all hand soldered :D

openwrt on Edimax NS-1500N working?

gWell I wasn't expecting that to happen.

I thought I'd try the fon 2.0n openwrt build environment on it as they are similar chips, anways  I messed around with kernel configs abit and seemed I broke something so I had to manually select setting, so I picked rt3050 options and proper memory size an hey presto a stock fon2.0n flashed fine :O

wifi and usb all seem to work, next is how to remove all the fon branding etc. but for now I can start writing my data logging software now yay!

With a bit of fat cut out the firmware I bet this would work on other edimax stuff  like the 3g-6200n and maybe even the 36-6200nl?

Change of plans?

Had a tiny bit more progress on the zoom, managed to dump the firmware, and now I've been able to distinguish the header and checksums, all the info will be documented in a wiki once working.

Also another ebay bargin an Edimax NS-1500N, this listed on their site as a wireless NAS but has an RT3050.

This thing is tiny! its like 1/2 the size of the zoom. its listed as having 4MB flash on the edimax site but Amazingly it seems to have 8MB of flash inside :O so I'll be moving focus to that.

Hacking Zoom 4501 part 2.5

while randomly searching ebay for bargin rt305x devices i spotted a LEVEL ONE WBR-6800 which looks  very familiar to the zalip CDW530AM...
Found the manufactures website and hey presto its the same and there's a gpl zip for it.
Followed the instructions that came with it and make fails, it seems a lot has bee stripped out, but I've spotted the make file and program that builds the firmware.

I've also had reply from zoom with a link for gpl stuff and it look like it has come from the same place (amit) but dated older so fingers crossed that compiles.

Still no luck dumping the flash, httpd wont budge from /var/www which is read only and the tftp doesn't allow the put command.

built a wiggler and tried some jtag but that was a waste of time, none of the software made any sense and they all seem to be written in the stone age.

Hacking zoom 4501 part 2

I emailed zoom for sources and got the response "sorry- this is not possible." so unless they miss understood the  email they are violating gpl by not releasing it., noobs.
Any way it seems it is also known as Aluratek CDW530AM and Zalip CDW530AM, I've downloaded some firmware for the aluratek model to see if I could flash that.


They have different headers but even after changing that the zoom router wouldn't accept the firmware. :( so its not just headers that it needs.


I was using hyperterm to connect to the serial console but I didn't have much success, I'm now using putty and that seems to work.


So I now have console access :D 


The bootloader (jboot?) can be stopped by pressing enter after boot up, and has a prompt for commands typing 'help'
spits out this.


# help
command list...
reboot
info
load
go
dm
wm
rm
copy
ip [ip]
mac [mac]
ping
areacode


it also responds to 'erase' and 'flash'
I'm not sure what to do with any of the commands yet but hopefully I can figure out how to get around only using zoom firmware. 


Also the router is not as linux friendly as I'd hoped, there are no open source wifi drivers for it so it relies on binary drivers from ralink, the only ones avaliable only work with 2.6.21 kernel, so no backfire :/


Fortunately the fonera 2.0n and simpl use the same chipsets and use older openwrt and seem to have stable firmware. yay!


Update: The bootloader has a built in tftp so pressing enter to stop the boot process then "putting" a firmware file over seems to do the trick now to test non zoom firmware!


it also has http server which directs to a page called "jon recovery system" with just a browse and upgrade button.


I''ve done some more messing with headers and non zoom firmware and it seems theres a checksum of some sort as well, so more guess work needed :@