What you'll need:
* A Netcomm NB5PLUS4W router (well duh)
* A computer
* An ethernet cable

First, a few things to understand about the Netcomm NB5PLUS4W.

The processor is a Texas Instruments AR7WRD SoC processor - a MIPS 4KEc @  approx 212MHz (with a 125MHz system bus).  It has 16mb of RAM and 4mb of flash memory.  The router boots using the PSPBoot bootloader (similar to the ADAM2 bootloader, and even has the same username and password for the bootloader).  The stock firmware runs off a modified version of MontaVista Linux.

The flash memory is segmented into 5 MTD groupings - mtd0 contains the readonly filesystem that the kernel mounts as root, mtd1 contains the actual kernel image.  mtd2 contains the PSPBoot binary, with mtd3 being used as NVRAM for the PSPBoot's environment and configuration.  mtd4 encompasses mtd0 and mtd1 - this is the group that the firmware image must be written to so that the kernel can be booted and the root filesystem mounted.  mtd5 is usually mapped to an empty portion at the end of mtd0/mtd4 and can be formatted with minixfs to be used as a writeable storage partition.  At most you could get around 1400kb in Kamikaze 8.09.1 but this is clearly better than the alternative.

In any case, since the base of the stock firmware is Linux, you can get OpenWrt running on this router with a little effort (and some maths too).

First things first, ssh into your router and type

cat /proc/ticfg/env | grep '^mtd.'

# cat /proc/ticfg/env | grep '^mtd.'
mtd2    0x90000000,0x90010000
mtd3    0x90010000,0x90020000
mtd5    0x903f0000,0x90400000
mtd4    0x90020000,0x90400000
mtd1    0x90020090,0x9009f000
mtd0    0x9009f000,0x90400000

A quick note on the numbers here: the 9 (binary sequence 1001) indicates that this is an address to the flash memory, the remaining numbers point to a location in the flash memory - with the maximum for this router being 0400000 (which equates to 4MB of flash).

Now, first things first - let's find out where the boundary between the kernel and the filesystem lies.  Get a hex editor (if you're on a Linux system, hexer is a good one).  Do a search for 'hsqs' and note the location of this string - this is where the root filesystem begins.  In my example (Kamikaze 8.09.1), this occurred at byte 000d0000 - or 851,968 bytes.  Note the start of the mtd1 block - this will have to be altered to reflect the beginning of the image - otherwise 144 bytes won't get accessed and the router won't boot. 

For the end of the mtd1 block, you'll have to add the address to the beginning of the root filesystem.  If you're in Windows, the trusty Calculator will help - set it to scientific mode and choose Hex (for hexadecimal).  In this example, add d0000 to 90020000, which should result in 900f0000.  This, your address range for mtd1 will be 0x90020000,0x900f0000, and mtd0 will be 0x900f0000,0x90400000 (because the root filesystem begins at 900f0000 and ends at the end of the flash memory, which is 90400000).

This will give you the configuration of mtd0, mtd1, mtd4 and mtd5 as follows

mtd0    0x900f0000,0x90400000
mtd1    0x90020000,0x900f0000

Keep a note of these - you will need to later.

The next step is to prepare your router for the upload.  Switch off your router, plug an Ethernet cable into it, then plug the other end into your computer.  Set a static IP address on your computer (choose address 192.168.1.8, subnet address 255.255.255.0).  Start up PCTool, then turn the router on.  Wait for Windows to tell you that the Local Area Connection has been connected, then click "Retrieve/Assign IP Address".  You have a 2-3 second window to do this in, so you may need a few tries.  Once you are connected, click "Close", go to Start -> Run, then type ftp 192.168.1.1.  The username and password are both adam2.

Copy and paste the following into the FTP session:

quote SETENV mtd0,0x900f0000,0x90400000
quote SETENV mtd1,0x90020000,0x900f0000
quote MEDIA FLSH
binary
debug
hash
put "openwrt-ar7-squashfs.bin" "c mtd4"
quote REBOOT
quit

And that's it.  In a couple of minutes you'll be able to telnet in and set the password.

The only lingering issue is that the onboard wireless doesn't get picked up.  If anybody knows how to get the wireless working, I'm open to suggestions. :-)

(Last edited by thirdwheel on 27 Aug 2009, 06:29)

Below is a shell script I wrote that you can use to install OpenWrt on any PSPBoot based AR7 device, encompassing the steps above.  It assumes a memory size of 4MB and that the bootloader and NVRAM are in the first 64kb.  Use the method I described above to make sure that this is the case for yours and change this script as necessary.  You'll need some form of Unix - though I can't see it not working on Windows if you install UnxUtils,  MinGW or (shudder) Cygwin.  The script is untested, use at your own risk.  If you don't specify a file on the command line as the first argument, it will attempt to download the latest stable squashfs image.

#!/bin/sh

# Small shell script to install OpenWrt on a Netcomm NB5PLUS4W
# or any generic AR7-powered PSPBoot-based device

# First, we get an image if one hasn't been specified:
if [ ! "$1" ]; then
    wget "http://kamikaze.openwrt.org/release.txt" -o /dev/null

    url=$(grep -o -m 1 'http://downloads.openwrt.org/kamikaze/[^/]*' release.txt)
    rm -f release.txt

    if wget -O image.bin ${url}/ar7/openwrt-ar7-squashfs.bin; then
        file=image.bin
    fi
    
elif [ ! -e $1 ]; then
    echo "Cannot use $1 for an image: No such file or directory" >&2
    exit 1
elif [ ! -r $1 ]; then
    echo "Cannot use $1 for an image: Permission denied" >&2
    exit 1
else
    file=$1
fi

echo "Searching for kernel/squashfs boundary in $file..."

bound=$(grep -abo 'hsqs' $file | cut -d: -f 1)

echo "Found boundary at $bound (0x$(printf %x $bound))"

start=0x90020000
end=0x90400000
middle=$((bound + $(printf %d $start)))
middle=0x$(printf %x $middle)

cat <<EOF
So, our MTD blocks will be:

mtd0    $middle,$end
mtd1    $start,$middle
EOF

echo "Press enter when you have disconnected power to the router."
read null

echo "Right.  Plug it in now."
echo

echo "Waiting for router to power up..."
while true; do
    nc -n -w 1 -z 192.168.1.1 21 && break
done
echo "Ok, we're ready.  Let's roll."

ftp 192.168.1.1 <<EOF
adam2
adam2
quote SETENV mtd0,$middle,end
quote SETENV mtd1,$start,$middle
quote MEDIA FLSH
binary
put "$file" "c mtd4"
quote REBOOT
quit
EOF

echo "Done!"
exit 0

(EDIT 18/09/2009: Fixed a bug where downloading an image only logged wget output rather than saving the image to image.bin.  Thanks matthewhandau)

(Last edited by thirdwheel on 18 Sep 2009, 04:42)

Wireless sort of works for me on the latest svn using the acx driver.  This driver only supports wep.  The acx-mac80211 driver probably will work with wpa, however this driver is currently broken.

The ADAM2 FTP server in PSPBoot appears rather flakey.  Many upload request timeout with only 8 or 16 k transmitted.  It works better if you have a means to throttle you connection down.

Once you have OpenWrt installed, you can rewrite using the following procedure to bypass the adam2 ftp server

cat openwrt-ar7-squashfs.bin | ssh root@192.168.1.1 '(cat > /tmp/upgrade.bin)'

followed by:

mtd -e linux -r -f write /tmp/upgrade.bin linux

If the kernel size has changed then you need to adjust the size of the mtd1 partition in the boot loader using ftp and the quote SETENV mtd1 command.

(Last edited by jj on 28 Aug 2009, 17:46)

Thank you for this script. 

I had some difficulties making it work with OSX ftp.  So I ended up using Linux ftp instead.

Also the script uses -o instead of -O, logging the wget output to image.bin instead of the firmware.

Can anyone confirm if this works for the Netcomm NB5Plus4 (non wireless version) ?

I have been trying over and over to get this done yet i continually get no success trying to even connect to the 'adam' ftp server, it is only once it has booted into the standard operation i can FTP in but into the typical root / adam FTP

Here's some ideas for you, morphix:
- Try all the ethernet ports. 
- Try using the "PC Tool" software the RouterTech.org guys use to flash firmwares - http://www.routertech.org/viewtopic.php?t=335 (maybe even try installing the RT firmware).
- Confirm it's a nb5plus4 and not an nb6plus4 (the latter is supposedly brcm not ar7).

Yeah, the nb6s are bcm63xx based.

Please help.
When I shh the router and typ thr command " cat /proc/ticfg/env | grep '^mtd.' " it returns " % invalid input at caret. "

what am I doing wrong, I am a complete newbie at this kind of stuff