Topic: D-Link DIR600M (China model)

The content of this topic has been archived on 29 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

superspost

5 Mar 2011, 14:28

Dear all,

I have bought an DIR600M router from D-link while i was living in China and would love to install openwrt on it because the shipped firmware is only in Chinese which I can´t read.

What i have done so far:

+ searched on the internet for any information on the particular model (no results)
+ tried to patch the openwrt firmware for the DIR600 A1 through the web interface (not accepted, just comes back to original firmware)
+ tried to enter the recovery mode as documented for the DIR600 (not working)
+ read the documentation of openwrt and how to start hacking hardware

I understand that the first step would be to gather information on the hardware and the bootloader used. I have opened the device
and found some pins which look like a SERIAL connection to me. (Second picture lower right, VCC, RX, TX, GND)

PICTURES:

I have not used a serial connection before, but am familiar with soldering. Could someone guide me as to which serial cable i should use? (I could build my own cable and I have an old laptop with a rs232 connection)
If you think that i am on the wrong track, or if there would be an easier way to find out what the difference between the DIR-600 and the DIR-600M is, I would greatly appreciate it. I would document my progress with this model here, so it would serve anybody who would is interested.

Post #2

superspost

9 Mar 2011, 23:26

UPDATE:

I now have read up about serial cables here: http://wiki.openwrt.org/doc/hardware/serial.cable

after some thinking i realized that i had an arduino micro-controller lying around which has an FTDI usb to serial connection. This seemed like the fastest way to gain access to the serial console for me... you can find details on this site: http://www.zoobab.com/use-the-arduino-a … al-adaptor After wiring and soldering i hooked everything up and started to listen on the serial port with this command:

screen /dev/ttyUSB0 115200

and after a reset i got the following output:

Restarting system.
Decompressing...done


CFE version 5.10.56.46 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Tue Mar  2 00:17:21 CST 2010 (root@lqdesk)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 131072(0x20000)
Found a 2MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.46
CPU type 0x19749: 333MHz
Tot mem: 16384 KBytes

CFE mem:    0x80700000 - 0x8079A310 (631568)
Data:       0x80730640 - 0x807338F0 (12976)
BSS:        0x807338F0 - 0x80734310 (2592)
Heap:       0x80734310 - 0x80798310 (409600)
Stack:      0x80798310 - 0x8079A310 (8192)
Text:       0x80700000 - 0x80730638 (198200)

Device eth0:  hwaddr 1C-AF-F7-C2-29-BC, ipaddr 192.168.0.1, mask 255.255.255.0
        gateway not set, nameserver not set
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .... 1798144 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU ProcId is: 0x00019749, options: 0x000021cd
Primary instruction cache 32kb, linesize 32 bytes (4 ways)
Primary data cache 32kb, linesize 32 bytes (4 ways)
Linux version 2.4.20 (liqi@softdev) (gcc version 3.2.3 with Broadcom modifications) #77 Mon May 24 12:10:35 CS
T 2010
Found a 2MB ST compatible serial flash
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
CPU: BCM5356 rev 1 at 333 MHz
Calibrating delay loop... 166.29 BogoMIPS
Memory: 14240k/16384k available (1550k kernel code, 2144k reserved, 116k data, 68k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)   
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)  
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)   
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: no core
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au) 
devfs: boot_options: 0x1
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xb8000300 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
sflash: squash filesystem with lzma found at block 762
Creating 4 MTD partitions on "sflash":
0x00000000-0x00020000 : "boot"
0x00020000-0x001f0000 : "linux"
0x000bea70-0x001f0000 : "rootfs"
0x001f0000-0x00200000 : "nvram"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (128 buckets, 2048 max) - 352 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
ipt_time loading
BCM fast NAT: INIT
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com> 
All bugs added by David S. Miller <davem@redhat.com>
GPIO LED and Button support for BCM535X
Copyright(C) 2009 Allwins Technology
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 68k freed
Starting Architecture code for broadcom

Wireless Router D-Link Wireless N Router DIR-600M (c) 2009
Release: 2010-05-24 12:12:02 v1.0.12
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Operation not supported
eth1: Invalid argument
eth1: Invalid argument
eth1: Operation not supported
HTTPD Starting on /www at port 80
legal_total_ip=[254] legal_start_ip=[1] legal_end_ip=[254] dhcp_start_ip=[100]
Legal DHCP Start IP: We need to check DHCP num.
br0 192.168.0.100  86400

Could someone more experienced comment on the output and what i should do next?
Thanks

Post #3

KanjiMonster

10 Mar 2011, 00:57

Unfortunately there are two big problems:

superspost wrote:

Found a 2MB ST compatible serial flash

2 MB devices aren't supported with OpenWrt (you have to really strip it to make it fit, so e.g. no web gui).

superspost wrote:

CPU: BCM5356 rev 1 at 333 MHz

This is a newer AI based Broadcom, which isn't supported in OpenWrt at all (there is some effort going on though).

Post #4

superspost

10 Mar 2011, 12:52

Hi Kanji,

thanks for the reply. I could live without webinterface, but there is not much i can do regarding the second problem: CPU: BCM5356 rev 1 at 333 MHz beeing not supported.

Bummer. I had high hopes after the successful connection yesterday... :-)

What i thought was interesting anyway was that ethernet controller seems to be Gigabit capable but the current firmware (et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.46) only supports 100Mbit.

Is there a thread going on somewhere regarding the work on BCM5356 ?

Thanks again

Post #5

KanjiMonster

11 Mar 2011, 16:53

superspost wrote:

What i thought was interesting anyway was that ethernet controller seems to be Gigabit capable but the current firmware (et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.56.46) only supports 100Mbit.

Broadcom probably just recycles the ethernet cores for both gigabit and fast ethernet capable SoCs.

superspost wrote:

Is there a thread going on somewhere regarding the work on BCM5356 ?
Thanks again

While not for the BCM5356, see the Ticket for the RT-N16, which contains some patches for getting the newer broadcom stuff to work. The BCM5356 is a newer Broadcom, but there is probably no support for the integrated switch core, or the serial flash.

Post #6

ironfox

19 Apr 2011, 11:05

Hi Superpost,
I am very interested in what you did on this device. Did you find some other way to access the linux system except a serial cable?
Is there any programs like telnetd or sshd running on the system?
I just want to change some configurations but the web UI didn't provide the interface.

Post #7

superspost

6 Oct 2011, 17:27

Hi Ironfox,

sorry for the late reply i had not seen your reply before. Unfortunately my router is collecting dust at the moment. Since it seemed that i will not succeed with flashing it i did not continue to investigate. If you want though i can check some things and post back... let me know if you are still interested...

Post #8

chargz

13 Jul 2017, 18:29

superspost, is your router still collecting dust or you managed to change the firmware?

The discussion might have continued from here.

Page 1 of 1