Aueky PB-W1 seems to be a MPR-A2 clone too https://forum.openwrt.org/viewtopic.php?id=56015

Hello Jfresh,

Good morning.

When you mention "ebay for around 5$" you mean flash 16MB chips? Aren't you going to use Winbond type?
I do have doubts if it will support 64MB ram chips (like with TPLink 703n), I'm going to try when I receive mine.
Unfortunately I didn't saw anyone confirming the 64MB ram support...

Regards,

FJorgeR.

Have you kept the original firmware?

Hello!

I've got the same router, purchased it on Aliexpress.
First of all, the login/password for the telnet are "zorlik/zorlikafter2012".

The flash layout is here:

dev:    size   erasesize  name
mtd0: 00400000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 000f5716 00010000 "Kernel"
mtd5: 002ba8ea 00010000 "RootFS"
mtd6: 003b0000 00010000 "Kernel_RootFS"

The SDRAM chip on-board is Etron em6[3?8]9165ts-6g, that is supposed to be 16mBytes chip.

The bootloadr is U-Boot 1.1.3 (Mar 11 2013 - 07:32:49).

Question is: can I flash the openwrt into it, and what version should I take?

Thank you!

(Last edited by Kitsok on 13 Apr 2015, 16:08)

Hi, I tried to be picked up rx / tx. Now the router is not turn on .
Power 3.3V on ROM exists, rt5350 chip to heated.
sorry my english, i am from Ukraine

Hi.
I have a noname A1 clone from eBay.
cat /proc/mtd: https://drive.google.com/file/d/0Bydyyk … sp=sharing
photo of the PCB: https://drive.google.com/file/d/0Bydyyk … sp=sharing
It has an EtronTech EM639165TS-6G, but seems to only recognise 16MB of it.
Also, the mtd structure doesn't seem like any other clone's.
Which OpenWRT build can I install on it without losing any functionality? (mainly 3G to WiFi routing, but sometimes WiFi repeating also) Also, I don't want to solder any JTAG related things.
Thanks.

(Last edited by iscream1 on 20 Jun 2015, 12:38)

Unless you already have a copy of the original firmware, I would advise against putting any different firmware on your clone.  Not all of these clones are exact copies.  Some will not work properly with firmwares built for the Hame A1.  For example the wired ethernet port may become inactive after booting. I speak from personal experience of that happening to mine.

I have looked at photos of many of these clones and never seen one exactly the same as mine

(Last edited by drgeoff on 27 Jun 2015, 12:42)

Hello,

I got a clone of the mpr A1 from ebay a few years ago.
I was really suprised about that it is really functioning for that little price.

Now I found this page and I want to get more from my mpr A1 by setting up open wrt.

details of my device so far:

Wifi: 3G-Routerxxxx
PW: 12345678
Telnet: zorlik / zorlikafter2012
Blue and green LED for Power and LAN
32 MB RAM
8 MB Flash

Wireshark detects NO pakets when device is switchend on with reset pressed
there are NO declared TX and RX solder pads. There are four undeclared solder pads - one is gnd. But with PL203.. connected there is no traffic detected.

It was very very tricky to get into telnet and make a copy of all MTDs and put it via ftp to a server. But I have all partitions - MTD0.ALL is exactly 8192K .

Now - I think with 8192k of flash and 32M of RAM there are great possibilities to upgrade to open wrt.

Everytime I want to flash any bin via the genuine "GoAhead" Webserver it says invalid firmware. Outer I flashed the bootloader directly 192kb bin and device got bricked

Because of no TX and RX pin I could not see if there is anything booted. After some tutorial I desoldered the 8MB Flash, erased it and flashed the original BIN via SPI and a raspberry. Resoldered again and it came up normally... PUUUH

Now my question is:
is there any possibility to change uboot to a version which I know what it is doing - (to flash the openwrt image blind via tftp) or is it possible to build a complete binary with 8192k with uboot and openwrt included (so with all partitions)

If you want pictures I can upload some.

THX in advance

(Last edited by ChAoSWK on 30 Jun 2015, 09:47)

hi
Does any one know how to make it connect to a wifi hotspot then share that conncetion to other devices?

When running OpenWRT or stock?  If stock, a Hame A1 or clone?  If a clone, not all clones have the same firmware or UI.

Hello.

Is it posible upgrade Flash from 4MB to 8MB or 16MB ?

(Last edited by mszerg on 10 Oct 2015, 22:29)

Hi, I'm pretty new to this pocket router business, but recently purchased an "Aukey PB-W2" which is *very* similar in shape and web interface to the Hame A1. Flash size is 4MB, RAM 16MB. MAC starts with 9C:41:7C (indicating Hame OEM).

There are a few differences I have noticed:
- access is admin/aukey (although the printed manual suggests a capital A as in Aukey)
- in the main web interface, all Hame strings (incl. (C) ones!) have been carefully replaced
- if one looks closer, Hame references are everywhere (/etc_ro/motd, 192.168.169.1/adm/upload_firmware.asp, etc.)
- fw version is 2.4.106.256 (according to /sbin/oem.in; the Web interface says "v.20140530101311")
- "Click to down Update list" returns "undefined undefined Bytes", very promising... (got to wireshark that)
- SSID starts with "Aukey_PB-W2_" followed by positions 8 through 11 of the MAC (in small letters, as usual)
- there's no hint towards FW upgrades or GPL sources on aukey.com
- I couldn't get it to mount a USB pendrive
My guess is that there haven't been too many changes in the hardware (but I'll disassemble the device later), and that it may be added to the TOH as a link to the A1.

I managed to set up a small webspace and upload a (mipsel) busybox (taken from busybox.org, watch out to get a statically linked one!), then telnet'ed into the box, and ran

cd /tmp
wget -O busybox http://.../busybox-mipsel
chmod +x busybox
cat /dev/mtd0ro | ./busybox nc 192.168.169.2 1234

while running another nc instance on my laptop, to write the received stream into a file.
I did the same with all MTD partitions (0..6).
Also, I packed / into a tar and transferred that as well - although this failed copying /proc file contents.
Eventually I found this way:

/tmp/busybox find /proc -type f ! -name kcore ! -name kmsg -maxdepth 1 | while read f
do
  echo $f
  cp $f /tmp/proc/
done
/tmp/busybox tar -cf - -C /tmp proc | /tmp/busybox nc 192.168.169.2 1234

Phew... so now I have a full copy of the FW, and may start with the dangerous things

While playing around, I found that "goahead -x" (perhaps even without that option) would start a second but somewhat crippled web server, with some iptables magic before, and sending a ^Z to that would reload it. Funny.

I'm also waiting for a noname router (similar to the A5-V11 described elsewhere). Maybe it comes with more RAM...

(Last edited by steve8x8 on 13 Oct 2015, 09:14)

It's not only a clone, it seems to be a real, rebranded, A1 (V2.2):
(uplink is slow, sorry)

Is there anything known about hardware flaws for this PCB version?

I'm also uploading mtdblock{1,4,5,6} (Uboot, Kernel, Rootfs, Kernel_Rootfs combined) to the same directory (partitions 2 and 3 contain my MAC address...).

The very small device arrived. It identifies as "Mifi" but is very similar (if not identical) to the A5-V11 discussed
over here: https://forum.openwrt.org/viewtopic.php?id=43444 (last post). It doesn't have the antenna bug though

Thanks to the "runshellcmd" trick and the automounted USB pendrive, I could dump the flash partitions (it was rather tricky to get the pendrive unmounted again). 0 is uBoot, 1 and 2 are config stuff like MAC and NVRAM, 3=4=5 is the rest, containing Kernel, Romfs, Firmware.

I dug a bit deeper, and found that the "kernel" partition indeed contains a rather big kernel,

$ file mtdblock3 
mtdblock3: u-boot legacy uImage, Linux Kernel Image, Linux/MIPS, OS Kernel Image (lzma), 3794821 bytes, Fri Aug 23 09:31:57 2013, Load Address: 0x80000000, Entry Point: 0x80307000, Header CRC: 0x539B40FF, Data CRC: 0x2C4F9070

So next, I stripped the 64-byte prefix and cut out the next 3794821 bytes (leaving 71739 bytes of garbage). I lzma-uncompressed that and ended up with a kernel file 5969916 bytes in size - which seems to contain the "rootfs" as initrd(?) - how would I extract that? (With the Aukey PB-W2 this was easy as there was a separate mtd partition for the squashfs root.)

I had to update binwalk in firmware-mod-kit (to 2.0 from github.com/devttys0/binwalk.git, I'll have to pick up sasquatch from the same author as well!), but still matryoshka mode doesn't work:

$ binwalk -M mtdblock3 

Scan Time:     2015-10-16 12:36:06
Target File:   .../NoName Mifi/flash/mtdblock3
MD5 Checksum:  745257541987b609d9608300db4b24d3
Signatures:    343

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x539B40FF, created: 2013-08-23 07:31:57, image size: 3794821 bytes, Data Address: 0x80000000, Entry Point: 0x80307000, data CRC: 0x2C4F9070, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
64            0x40            LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 5969916 bytes

but binwalking the unpacked kernel(/rootfs) yields

$ binwalk kernel_rootfs 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
222584        0x36578         LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 788785 bytes
251484        0x3D65C         LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 788785 bytes
425124        0x67CA4         LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 788785 bytes
733561        0xB3179         LZMA compressed data, properties: 0x88, dictionary size: 1048576 bytes, uncompressed size: 4608 bytes
1930604       0x1D756C        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 788785 bytes
2411952       0x24CDB0        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 788785 bytes
2412564       0x24D014        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 788785 bytes
2433084       0x25203C        Linux kernel version "2.6.21 (root@hex.centos.mac) (gcc version 3.4.2) #3378 Fri Aug 23 15:31:27 HKT 2013"
2465440       0x259EA0        CRC32 polynomial table, little endian
2703946       0x29424A        Unix path: /mru/rcvseq/sendseq/lns debug reorderto
2761747       0x2A2413        Neighborly text, "neighbor %.2x%.2x.%.2x:%.2x:%.2x:%.2x:%.2x:%.2x lost on port %d(%s)(%s)"
3317760       0x32A000        LZMA compressed data, properties: 0x5D, dictionary size: 1048576 bytes, uncompressed size: 10946560 bytes

Dictionary sizes of 16 MB don't make real sense, right? In particular when showing up before the kernel entry point. So let's try the last match:

$ dd if=kernel_rootfs bs=3317760 skip=1 of=rootfs.xz
0+1 records in
0+1 records out
2652156 bytes (2.7 MB) copied, 0.0220645 s, 120 MB/s
Press any key to continue...

$ file rootfs.xz
rootfs: LZMA compressed data, non-streamed, size 10946560

Well... that looks promising.

$ lzma -dvvk rootfs.xz 
rootfs.xz (1/1)
  100 %      2,590.0 KiB / 10.4 MiB = 0.242                   0:01             
$ file rootfs 
rootfs: ASCII cpio archive (SVR4 with no CRC)

Nice! cpio archive probably indicates an initrd. Luckily the device has enough RAM! To eat up 13 MB just for the OS would throttle everything else...

$ cpio -t <rootfs | head
/sbin
/sbin/ntpclient
/sbin/poweroff
/sbin/smartd
/sbin/lsmod
/sbin/start_3g
/sbin/udhcpd
/sbin/fdisk
/sbin/insmod
/sbin/smbpasswd

There we go... ready for more inspection.

Hi !
Do you guys have a hint where i could solder an external antenna ?
I know this guys main advantage is size but i'd like to upgrade the reception a small bit as i would use it as a repeater in our garden house (just take it with me if i go there, no power socket there).

Greetings,

Ender

Hi again !
I found a thead describing the Antenna mod (link here if someone else searches it):
http://forum.openwrt.org/viewtopic.php?id=57377

But up to now i cannot flash OpenWRT, i use the image openwrt-15.05-ramips-rt305x-a5-v11-squashfs-factory.bin

I can flash it from the stock GUI Interface but then it reboots and the Stock firmware is "still alive".

I bet its a stupid mistake but i still dont know why this happens, any idea or hint ?

Thank you,

Ender

Were you able to get any custom firmware running on the PB-W2? I was looking for a way to have it connect to my VPN to share that VPN'ed connection to the connected users but it doesnt seem that the stock firmware has a VPN client.

With OpenWrt clone device

(Last edited by nightsaber_f on 16 Apr 2016, 19:23)

how do i determine the ram of my device? the following is the output from cat /proc/meminfo and /proc/cpuinfo

# cat meminfo
MemTotal: 28616 kB
MemFree: 4104 kB
Buffers: 0 kB
Cached: 17860 kB
SwapCached: 0 kB
Active: 11996 kB
Inactive: 7064 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 1232 kB
Mapped: 716 kB
Slab: 4224 kB
SReclaimable: 620 kB
SUnreclaim: 3604 kB
PageTables: 200 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
CommitLimit: 14308 kB
Committed_AS: 3128 kB
VmallocTotal: 1048404 kB
VmallocUsed: 804 kB
VmallocChunk: 1047524 kB

# cat cpuinfo
system type : Ralink SoC
processor : 0
cpu model : MIPS 24K V4.12
BogoMIPS : 239.61
wait instruction : yes
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : yes
hardware watchpoint : yes
ASEs implemented : mips16 dsp
VCED exceptions : not available
VCEI exceptions : not available

Hi,

Can anyone help me find the tx/RX on this MPR-A1 clone? I tried the pins marked in the website but they aren't working.

(Last edited by vj_v1 on 11 Aug 2016, 11:00)

Hi, Any help for the above pics?

Will it support 4g Usb dongle/modem after patch or flashing with openwrt firmware..Guys pls revert

Get your full USB modem support from the port "Rooter" from OfModemsAndMen.com

I don't think any of these support non-Chinese modems out of the box but I only tried a few prior to discovering the aforementioned version of OpenWRT.

P.S. They have a full Luci interface and full modem support for the 4M models which is really nice and might be a challenge to build from scratch.   Been using that build with a few of the A5-V11 clones successfully across the US and northern parts of Latin America with several modems with the bands to match.

(Last edited by DonJuane on 17 Feb 2018, 17:52)