OpenWrt Forum Archive

Topic: ALFA R36 Router Hacking

The content of this topic has been archived between 25 Mar 2018 and 1 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hello, I have this router too.
Mine's is basically identical to the OP's, but it have a label says "WR6202-1U" on the inside, and the MAC are different to the mark on case. So this router should have the same hardware as Accton WR6202-1U, they may even share same company using different brand name and model number.
Sam

(Last edited by sam1275 on 21 Jan 2017, 06:44)

dear members, ive had some experience with openwrt and generally quite some.
however the process for getting it on the r36 seems very very vague to me.
could someone be so kind to share some failsafe steps as i want to avoid by any means bricking it since i will try to flash it

and yes it happened im with the blinking wps thing.. is this fixable through factory recovery through serial port?

xwrt wrote:

latest stable works fine on the r36, i'll recap everything I needed to do to install it as it will be easier to find

and watch out for the links in this post, i had to cut them because the forum software is dumb

you need to open the case (2 screws under the leg pads on the USB port side), and connect a serial uart cable to 3 of the 4 pins on the left side when looking at the board with the usb port facing you, there's a picture posted on page 2 of this post htp image-share.com/ijpg-1793-285.html

openwrt image is here htps downloads.openwrt.org/chaos_calmer/15.05.1/ramips/rt305x/

after you download, move it for tftp (debian/apt-get install tftpd-hpa), i had to use a shorter name as it seems uboot clipped it

apt-get install tftpd-hpa
cd /tmp/
wget htps downloads.openwrt.org/chaos_calmer/15.05.1/ramips/rt305x/openwrt-15.05.1-ramips-rt305x-w502u-squashfs-sysupgrade.bin
wget htps downloads.openwrt.org/chaos_calmer/15.05.1/ramips/rt305x/md5sums
md5sum -c md5sums 2>/dev/null | grep openwrt-15.05.1-ramips-rt305x-w502u-squashfs-sysupgrade.bin
mv openwrt-15.05.1-ramips-rt305x-w502u-squashfs-sysupgrade.bin /srv/tftp/openwrt.bin
ifconfig eth0 10.10.10.3 netmask 255.255.255.0
/etc/init.d/tftpd-hpa restart

connect an ethernet cable from your eth0 10.10.10.3 to the wan port (or was it the lan i used?)

you also need a serial uart connection for the bootloader and initial openwrt config
i used the bus pirate v3.6 stable, i had to flash the 6.2-beta1 firmware but i dont think it was needed, it was a problem of the initial config of the bus pirate which i'll post below - problem was as reported by someone on the first page, the bootloader passed too fast over the option selection and didnt seem to take my keyboard input at all
and not sure if its minicom or screen that was the issue
i ended up using "minicom -b 115200 -8 -D /dev/ttyUSB0 -s" and Serial Port setup, make sure hardware and software flow control are set to NO, then type esc 2 times to get to the minicom screen

for the cable connection i used the sparkfun new bus pirate cable and if you use a similar one you should check the cabling on it as there are several versions and you could burn your bus pirate connecting the cables wrong
bus pirate -> r36 pins (pin 1 closest to the usb port, pins starting from 1 are VDD, RX, TX, GND, and you only need the last 3)
GND -> GND
TX/MOSI -> RX
RX/MISO -> TX

if something isnt working you can check the self test procedure on the bus pirate and also shorting the TX/MOSI to RX/MISO and using a minicom terminal with the bus pirate uart config pasted below (maybe with local echo on), you should see the output as you type, with echo would double it

after you open minicom to the bus pirate, set the bus pirate config:

i
Bus Pirate v3b
Firmware v5.10 (r559)  Bootloader v4.4
DEVID:0x0447 REVID:0x3046 (24FJ64GA002 B8)
htp dangerousprototypes.com
HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)

(1)>3
Set serial port speed: (bps)
 1. 300
 2. 1200
 3. 2400
 4. 4800
 5. 9600
 6. 19200
 7. 38400
 8. 57600
 9. 115200
10. BRG raw value

(1)>9
Data bits and parity:
 1. 8, NONE *default
 2. 8, EVEN
 3. 8, ODD
 4. 9, NONE
(1)>1
Stop bits:
 1. 1 *default
 2. 2
(1)>1
Receive polarity:
 1. Idle 1 *default
 2. Idle 0
(1)>1
Select output type:
 1. Open drain (H=Hi-Z, L=GND)
 2. Normal (H=3.3V, L=GND)

(1)>2 ((<<<i think the problem was here why i couldnt send any input via the uart interface to the boot loader, i used option 1 as seen on several forums>>>))

UART>(0)
 0.Macro menu
 1.Transparent bridge
 2. Live monitor
 3.Bridge with flow control
UART>(1)

and after this you are connected to the router's console and you can plugin your router to see the bootloader menu.
you cant control the bus pirate anymore so if you need to change anything you need to unplug it first. to exit minicom you type CTRL+A x

you can also use screen instead "screen /dev/ttyUSB0 115200 8N1" but i'm not sure the input problem wasnt because of it

when seeing the uboot prompt, type 2
   2: Load system code then write to Flash via TFTP.
it will ask you for its ip and server ip, mine was something like 10.10.10.3 for the server (server is your tftp box)
and the kernel image, which is openwrt.bin if you copied it like i did above

router will boot with openwrt, keep the serial console open and press enter and you should be logged in
if you are not familiar with vi editor, press i to edit, press escape to end editing, and then press :wq to save and quit

vi /etc/config/network

paste this at the end of the file

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '1 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0 6t'

then restart the network or router, and you should be able to ping it to 192.168.1.1 (remember to set your eth0 interface and switch to lan)

/etc/init.d/network restart

eth should work fine now, the only problem was the missing switch config

one thing i noticed in my r36, i only have a wlan0, while i understood this router has 2 wireless chips and i've seen 2 interfaces on ifconfig output from this router. any idea what i need to do to see both or do i have a different revision?
chipset says RT3050 F

EDIT: nevermind, the second interface is the 5ghz which isnt working

Thank you very much! I successfully hacked my R36!!! So happy now smile
I have a few questions though...
1. As you said, it seems not working out-of-box because of the missing switch config, but why didn't the openwrt team add it to the release image? Can we make an image with it, so we don't need TTL every flash? (It do persist cross reset-to-default right?)
2. Could you please tell us why/how your switch config do the magic? Especially what the "6t" means?

when i connect to serial the bootloader overrides any chosen option does anyone know how this can be fixed?
nmap shows the device ip at 1.1, out of sheer curiosity because i thought it would probably be blocked i flashed through the web interface thought to get lucky since its possible on the r36 on dd-wrt.

s29.postimg.org/8c5jbe2pj/2017_01_29_225815_1824x984_scrot.png
s28.postimg.org/uf83kz225/2017_01_29_223845_1824x984_scrot.png

this is whats happening if im fast enough to choose an option it overrides the option always booting from flash

mrt8 wrote:

s29.postimg.org/8c5jbe2pj/2017_01_29_225815_1824x984_scrot.png
s28.postimg.org/uf83kz225/2017_01_29_223845_1824x984_scrot.png

this is whats happening if im fast enough to choose an option it overrides the option always booting from flash

Do not use invalid option like 0...
Just press down the "2" key while inside the serial while the router power off, then plug in the power while holding the button, that's exactly how I do it.
Do notice to release the key as soon as the option is selected, or you may miss the "y" option time-window to confirm.

(Last edited by sam1275 on 30 Jan 2017, 14:07)

the thing is something is really off i will explain it exactly.

sometimes it shows weird symbols, i also tried different baud rates which does not seem to help.
i manage to select option 2 when being fast enough many times and as you say releasing it on time but it skips the Y/N by default and goes on from the beginning always choosing option 3.

as for 0 i dont press 0 but many times it shows up even when i press option 2 and release it before the menu shows up and still it will show something as the screenshots. i tried it many many times and wonder why so.

mrt8 wrote:

the thing is something is really off i will explain it exactly.

sometimes it shows weird symbols, i also tried different baud rates which does not seem to help.
i manage to select option 2 when being fast enough many times and as you say releasing it on time but it skips the Y/N by default and goes on from the beginning always choosing option 3.

as for 0 i dont press 0 but many times it shows up even when i press option 2 and release it before the menu shows up and still it will show something as the screenshots. i tried it many many times and wonder why so.

That sounds like a unstable serial cable. Oh you do use a USB-TTL cable right? Today many of those cables use fake chips and cause many issues.
I don't want those fake cable to bother me, and I did it in a hard way, I set up my beaglebone black to communicate with the router, and it works great. You may not want to buy a SBC if you don't have one, but at least use some genuine chip cable, don't just grub a random one from ebay or amazon...
Off topic: The RT3050 is a bullet proof chip, I used to be so stupid and use a RS232 cable on it... That is +-13v instead of single 3.3v... But the RT3050 survives anyway.

i appreciate the help tremendous since the information on the net over the r36 is scarce.
i did it using linux on the raspberry 2.
since i thought is was the safest option.
i have ordered rs232 2 models to be sure but haven't received it yet.
i also have an internal serial on my computer motherboard which has the z77 chipset for additional info,
a port labeled jcom1 however as u say i feared the same of excessive voltage.
however what i find odd is the raspberry supposedly should have good support while it has the functions of GPIO pins.
didn't seem to be so for me, it should have just been working i don't think i have been doing anything wrong after countless hours of reading. however yes to be sure ill wait for my USB tty and only if after that using it on windows itself i don't have success i might try the internal motherboards serial port which as u say might be of a voltage of 12+

by the way to clarify since i explained it vaguely i meant rs232 USB ttl not rs232 port or cable. which im still awaiting to receive, do you mean these have a higher output voltage as well?

Use the same cable you'd use to connect to the serial pins on a Pi.  The logic level cables have either pigtail wires or bare pins.  That is what you need.  The RS232 level cables have a 9 pin D connector. That is not what you want.

wiki.openwrt.org/_media/doc/hardware/usbtors232.ttl.jpeg

2 of these i bought just brandless 4 pins yes

the description states "USB To RS232 TTL UART PL2303HX Auto Converter Module Converter"

for the moment i didnt have any cable so i made them myself and isolated them not to short the cable used only the tx rx and gnd as when i tried it with the 3.3v vdd just in case it might have been different it worked the same and it stated overvoltage detected.

so no 9 pin serial cable.

(Last edited by mrt8 on 30 Jan 2017, 19:21)

Hello mrt8.
Sad to say the cable you ordered is more fake than genuine, especially it says "TTL" and "RS232" at the same time. From the picture I think it's a TTL, not RS232, but I do not recommend use it anyway.
Technically, RS232 and TTL are different and cannot be done in the same cable, RS232 not only have a much higher voltage level, but it's reversed: https://www.sparkfun.com/tutorials/215, although it didn't destroy my router, it cannot work either.
You should have no problem using Raspberry pi, that should be way more stable and safe over those fake cables, your problem is very odd.
Sam

(Last edited by sam1275 on 31 Jan 2017, 05:27)

finally got into a state with the raspberry when i can choose the option and it actually goes to Y/N so from this side this is solved.

the issue if more people happen to face it is that with the raspbian distro for the raspberry after every reboot you have to kill all processes that are associated with the serial. it is buggy because thereafter immediately the console must be started for connecting with the router, otherwise it ends up not allowing you to choose by overriding the option.

the hard part solved, the easy part tftp. it isnt even working tried almost all including on windows and the raspberry

mrt8 wrote:

finally got into a state with the raspberry when i can choose the option and it actually goes to Y/N so from this side this is solved.

the issue if more people happen to face it is that with the raspbian distro for the raspberry after every reboot you have to kill all processes that are associated with the serial. it is buggy because thereafter immediately the console must be started for connecting with the router, otherwise it ends up not allowing you to choose by overriding the option.

the hard part solved, the easy part tftp. it isnt even working tried almost all including on windows and the raspberry

Glad to know it's solved.
The tftp is not a problem for me on this router, could you tell more detail about why yours didn't work? Such as error or debug message on serial or computer, anything you think it's worth mention.
For a quick trouble shoot:
Did you connect the physical rj45 correctly between router Lan port and PC?
Did the firewall on your PC prevent the connection? (My nod32 did block it)
Did you manually assign the IP address to the PC, the same as you set in router serial?
Did you put the bin image with a short file name in the TFTP server directory?
PS: the above assume you use your PC as TFTP server.
I use tftpd32 on windows 7, set the router IP in the firewall exception, and everything is fine.
Good luck.

im not sure anymore what exactly the issue has been i double checked the cables they seem fine, i followed serial troubleshooting. i killed some processes associated with serial and it just worked if i opened it fast enough. trying to reproduce the same results i fail.

i think something is off with my raspberry pi it cant be explained otherwise.

as for the tftp first i tried with linux did all according to how it should but it didnt work. next i tried it with many variants of software on windows. and as you say creating rules in the firewall etc. however since im back at getting the router to respond in the bootload, btw i would like to mention that i tried various methods which all had a same result minicom, putty, screen.

i think i might receive the usb ttl today or tomorrow heard they usually have a voltage switch of 3,3 to 5 v. ive been wasting so much time just to get it to accept a keystroke so ill just try my luck with it using windows via usb.

will update about how the process goes i have hope it will work however since i got it working for a bit im sure it will be fixed in the end.

really appreciate the support by the way

I use picocom with USB adapters under Linux.  It's a very basic program.

To test your serial host, when you connect the TX and RX wires together (not to a router) you should be able to see what you type.  This is known as a hardware loop-back test.  If you break the connection you should not see what you type.

(Last edited by mk24 on 1 Feb 2017, 17:02)

what is weird however is i couldnt push a file within linux but when i opened my tftp share i suddenly found a file openwrt.bn (the router has been bricked due to incorrect flashing openwrt)

i cant remember if i did a pull request to test it but it should have worked both ways, forgot to mention yes did the ips manually both in windows and linux. however i just had an hour window where the router would process my keystrokes so cant say too much with too much confidence yet.

just got the usb ttl it worked like magic it is selectively 3.3v.
it was more effort to get the tftp running on windows.
finally its fixed
i want to thank you all tremendously for the support !

(Last edited by mrt8 on 1 Feb 2017, 21:47)

i have one last question,
my current setup is using the r36 as a repeater
it consists of 24 dbi parabolic, awus036h (rtl8187) and a 9dbi omni on the router itsself.
does someone know what else i could do for finetweaking it for such a setup and furthermore,
since its my first time working on the r36 with openwrt are there any packages or setup types for this hardware that are worth mentioning?

im having a bit of struggle yet since the AP sometimes resets, the connection has great signal quality but fluctuates from high speed to low or not responding alltogether and sometimes the web interface or the router itsself does not respond.

i flashed the latest build, this all is happening with standard settings and/or minimal changes
________________________________________________edit

got it stable for now nothing helped, an external powered usb hub did the trick if it is due to this

(Last edited by mrt8 on 2 Feb 2017, 15:12)

The discussion might have continued from here.