Succesfully extracted stock firmware with programmer. Researching further.
$ file stock.bin
stock.bin: u-boot legacy uImage, SPI Flash Image, Linux/MIPS, Standalone Program (Not compressed), 106800 bytes, Thu Sep 13 12:39:46 2012, Load Address: 0x80200000, Entry Point: 0x80200000, Header CRC: 0x04186E5D, Data CRC: 0x2BD65CC3
$ binwalk -v stock.bin
/usr/local/Cellar/binwalk/0.5.0/etc/binwalk/magic.binwalk, 125: Warning: New continuation level 2 is more than one larger than current level 0
Scan Time: Jun 24, 2014 @ 13:51:36
Magic File: /usr/local/Cellar/binwalk/0.5.0/etc/binwalk/magic.binwalk
Signatures: 130
Target File: stock.bin
MD5 Checksum: 62b923ad75e73706179b3de33dd95284
DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x4186E5D, created: Thu Sep 13 12:39:46 2012, image size: 106800 bytes, Data Address: 0x80200000, Entry Point: 0x80200000, data CRC: 0x2BD65CC3, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: SPI Flash Image
70707 0x11433 88K BCS executable
71023 0x1156F 88K BCS executable
327680 0x50000 uImage header, header size: 64 bytes, header CRC: 0x13F9B3DC, created: Thu Oct 17 07:43:34 2013, image size: 3646089 bytes, Data Address: 0x80000000, Entry Point: 0x80412000, data CRC: 0xC09BA1FF, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: Linux Kernel Image
327744 0x50040 LZMA compressed data (sig 2), properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 6634236 bytes
Soldered serial, inside of router:
# mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw)
ramfs on /var type ramfs (rw)
none on /proc/bus/usb type usbfs (rw)
sysfs on /sys type sysfs (rw)
# cat /proc/version
Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #1360 Thu Oct 17 11:42:11 HKT 2013
# cat /proc/mtd
dev: size erasesize name
mtd0: 00030000 00010000 "Bootloader"
mtd1: 00010000 00010000 "Config"
mtd2: 00010000 00010000 "Factory"
mtd3: 003b0000 00010000 "Kernel"
# iwconfig
eth2 no wireless extensions.
lo no wireless extensions.
ra0 RTWIFI SoftAP ESSID:"Sample_7096b1" Nickname:""
Mode:Managed Channel=11 Access Point: 00:0C:43:70:96:B1
Bit Rate=0.003 kb/s
eth2.1 no wireless extensions.
eth2.2 no wireless extensions.
wds0 RTWIFI SoftAP ESSID:"Sample_7096b1" Nickname:""
Mode:Managed Channel=11 Access Point: 00:0C:43:70:96:B1
Bit Rate=-2.14748e+06 kb/s
wds1 RTWIFI SoftAP ESSID:"" Nickname:""
Mode:Managed Channel=11 Access Point: Not-Associated
Bit Rate:-2.14748e+06 kb/s
wds2 RTWIFI SoftAP ESSID:"" Nickname:""
Mode:Managed Channel=11 Access Point: Not-Associated
Bit Rate:-2.14748e+06 kb/s
wds3 RTWIFI SoftAP ESSID:"" Nickname:""
Mode:Managed Channel=11 Access Point: Not-Associated
Bit Rate:-2.14748e+06 kb/s
apcli0 RTWIFI SoftAP ESSID:"" Nickname:""
Mode:Managed Channel=11 Access Point: Not-Associated
Bit Rate:-2.14748e+06 kb/s
br0 no wireless extensions.
bootlog:
U-Boot 1.1.3 (Sep 13 2012 - 16:39:43)
Board: Ralink APSoC DRAM: 32 MB
relocate_code Pointer at: 81fb4000
spi_wait_nsec: 42
spi device id: ef 40 16 0 0 (40160000)
find flash: W25Q32BV
raspi_read: from:30000 len:1000
.*** Warning - bad CRC, using default environment
============================================
Ralink UBoot Version: 4.0.1.0
--------------------------------------------
ASIC 5350_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM_TYPE: SDRAM
DRAM_SIZE: 256 Mbits
DRAM_WIDTH: 16 bits
DRAM_TOTAL_WIDTH: 16 bits
TOTAL_MEMORY_SIZE: 32 MBytes
Flash component: SPI Flash
Date:Sep 13 2012 Time:16:39:43
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 360 MHZ ####
estimate memory size =32 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP. 0
3: System Boot system code via Flash.
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
. Image Name: Linux Kernel Image
Created: 2013-10-17 3:43:34 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 3646089 Bytes = 3.5 MB
Load Address: 80000000
Entry Point: 80412000
raspi_read: from:50040 len:37a289
........................................................ Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80412000) ...
## Giving linux memsize in MB, 32
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #1360 Thu Oct 17 11:42:11 HKT 2013
The CPU feqenuce set to 360 MHz
CPU revision is: 0001964c
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists. Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = c0808008, status = 11000000
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 0015f900(1440000)
CPU frequency 360.00 MHz
Using 0.050 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 25732k/32768k available (3285k kernel code, 7036k reserved, 879k data, 2312k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
detected lzma initramfs
detected lzma initramfs
initramfs: LZMA lc=3,lp=0,pb=2,dictSize=1048576,origSize=9310720
LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com>...............................................................................................................................................deice id : ef 40 16 0 0 (40160000)
Warning: un-recognized chip ID, please update SPI driver!
EN25MAX(ef 40170000) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 4 MTD partitions on "raspi":
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x00400000 : "Kernel"
Load Ralink DFS Timer Module
RT3xxx EHCI/OHCI init.
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
NTFS driver 2.1.28 [Flags: R/W].
fuse init (API version 7.8)
io scheduler noop registered (default)
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.7 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
rdm_major = 254
MAC_ADRH -- : 0x00000000
MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.0 256 rx/tx descriptors allocated, mtu = 1500!
MAC_ADRH -- : 0x00008c88
MAC_ADRL -- : 0x2b00314c
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
PPTP driver version 0.8.1
=== pAd = c0019000, size = 632400 ===
<-- RTMPAllocAdapterBlock, Status=0
block2mtd: version $Revision: 1.1.1.1 $
rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus number 1
rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: Product: Ralink EHCI Host Controller
usb usb1: Manufacturer: Linux 2.6.21 ehci_hcd
usb usb1: SerialNumber: rt3xxx
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus number 2
rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
usb usb2: Product: RT3xxx OHCI Controller
usb usb2: Manufacturer: Linux 2.6.21 ohci_hcd
usb usb2: SerialNumber: rt3xxx-ohci
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
drivers/usb/class/cdc-acm.c: v0.25:USB Abstract Control Model driver for USB modems and ISDN adapters
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
ipt_time loading
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
_nvram_read checksum = 182c save checksum = 182c
Freeing unused kernel memory: 2312k freed
Hit enter to continue...RETH 5350
switch reg write offset=14, value=405555
switch reg write offset=50, value=2001
switch reg write offset=98, value=7f3f
switch reg write offset=e4, value=3f
switch reg write offset=40, value=1001
switch reg write offset=44, value=1001
switch reg write offset=48, value=1002
switch reg write
phy_tx_ring = 0x0041b000, tx_ring = 0xa041b000
phy_rx_ring0 = 0x0041c000, rx_ring0 = 0xa041c000
offset=70, valuRT305x_ESW: Link Status Changed
stat_curr = 81808100
e=ffff506f
Algorithmics/MIPS FPU Emulator v1.5
SCSI subsystem initialized
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
insmod: cannot insert '/lib/modules/2.6.21/kernel/drivers/scsi/scsi_mod.ko': Success
insmod: cannot insert '/lib/modules/2.6.21/kernel/drivers/usb/storage/usb-storage.ko': Success
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
RX DESC a0631000 size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
RTMP_TimerListAdd: add timer obj c0083e50!
RTMP_TimerListAdd: add timer obj c0021014!
RTMP_TimerListAdd: add timer obj c0020be4!
RTMP_TimerListAdd: add timer obj c0020fc0!
RTMP_TimerListAdd: add timer obj c0020fe8!
RTMP_TimerListAdd: add timer obj c00210cc!
RTMP_TimerListAdd: add timer obj c00210f8!
RTMP_TimerListAdd: add timer obj c00212a4!
RTMP_TimerListAdd: add timer obj c0024158!
RTMP_TimerListAdd: add timer obj c0023d28!
RTMP_TimerListAdd: add timer obj c0024104!
RTMP_TimerListAdd: add timer obj c002412c!
RTMP_TimerListAdd: add timer obj c0024210!
RTMP_TimerListAdd: add timer obj c002423c!
RTMP_TimerListAdd: add timer obj c00243e8!
RTMP_TimerListAdd: add timer obj c002729c!
RTMP_TimerListAdd: add timer obj c0026e6c!
RTMP_TimerListAdd: add timer obj c0027248!
RTMP_TimerListAdd: add timer obj c0027270!
RTMP_TimerListAdd: add timer obj c0027354!
RTMP_TimerListAdd: add timer obj c0027380!
RTMP_TimerListAdd: add timer obj c002752c!
RTMP_TimerListAdd: add timer obj c002a3e0!
RTMP_TimerListAdd: add timer obj c0029fb0!
RTMP_TimerListAdd: add timer obj c002a38c!
RTMP_TimerListAdd: add timer obj c002a3b4!
RTMP_TimerListAdd: add timer obj c002a498!
RTMP_TimerListAdd: add timer obj c002a4c4!
RTMP_TimerListAdd: add timer obj c002a670!
RTMP_TimerListAdd: add timer obj c002d524!
RTMP_TimerListAdd: add timer obj c002d0f4!
RTMP_TimerListAdd: add timer obj c002d4d0!
RTMP_TimerListAdd: add timer obj c002d4f8!
RTMP_TimerListAdd: add timer obj c002d5dc!
RTMP_TimerListAdd: add timer obj c002d608!
RTMP_TimerListAdd: add timer obj c002d7b4!
RTMP_TimerListAdd: add timer obj c0030668!
RTMP_TimerListAdd: add timer obj c0030238!
RTMP_TimerListAdd: add timer obj c0030614!
RTMP_TimerListAdd: add timer obj c003063c!
RTMP_TimerListAdd: add timer obj c0030720!
RTMP_TimerListAdd: add timer obj c003074c!
RTMP_TimerListAdd: add timer obj c00308f8!
RTMP_TimerListAdd: add timer obj c00337ac!
RTMP_TimerListAdd: add timer obj c003337c!
RTMP_TimerListAdd: add timer obj c0033758!
RTMP_TimerListAdd: add timer obj c0033780!
RTMP_TimerListAdd: add timer obj c0033864!
RTMP_TimerListAdd: add timer obj c0033890!
RTMP_TimerListAdd: add timer obj c0033a3c!
RTMP_TimerListAdd: add timer obj c00368f0!
RTMP_TimerListAdd: add timer obj c00364c0!
RTMP_TimerListAdd: add timer obj c003689c!
RTMP_TimerListAdd: add timer obj c00368c4!
RTMP_TimerListAdd: add timer obj c00369a8!
RTMP_TimerListAdd: add timer obj c00369d4!
RTMP_TimerListAdd: add timer obj c0036b80!
RTMP_TimerListAdd: add timer obj c00519bc!
RTMP_TimerListAdd: add timer obj c005158c!
RTMP_TimerListAdd: add timer obj c0051968!
RTMP_TimerListAdd: add timer obj c0051990!
RTMP_TimerListAdd: add timer obj c0051a74!
RTMP_TimerListAdd: add timer obj c0051aa0!
RTMP_TimerListAdd: add timer obj c00519e8!
RTMP_TimerListAdd: add timer obj c0051a14!
RTMP_TimerListAdd: add timer obj c0051a40!
RTMP_TimerListAdd: add timer obj c0084370!
RTMP_TimerListAdd: add timer obj c0084348!
RTMP_TimerListAdd: add timer obj c0084320!
RTMP_TimerListAdd: add timer obj c005ac0c!
RTMP_TimerListAdd: add timer obj c005ad10!
RTMP_TimerListAdd: add timer obj c005ac34!
RTMP_TimerListAdd: add timer obj c0051f84!
RTMP_TimerListAdd: add timer obj c001e4d8!
RTMP_TimerListAdd: add timer obj c002161c!
RTMP_TimerListAdd: add timer obj c0024760!
RTMP_TimerListAdd: add timer obj c00278a4!
RTMP_TimerListAdd: add timer obj c002a9e8!
RTMP_TimerListAdd: add timer obj c002db2c!
RTMP_TimerListAdd: add timer obj c0030c70!
RTMP_TimerListAdd: add timer obj c0033db4!
RTMP_TimerListAdd: add timer obj c0051ca4!
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
TXALC> bInternalTxALC = 0
3. Phy Mode = 9
RTMP_TimerListAdd: add timer obj c001e0e0!
NICInitAsicFromEEPROM: pAd->TxPowerCtrl.bInternalTxALC = 0
RTMPSetPhyMode: channel is out of range, use first channel=0
MCS Set = ff 00 00 00 01
RTMP_TimerListAdd: add timer obj 8060890c!
RTMP_TimerListAdd: add timer obj 80608938!
RTMP_TimerListAdd: add timer obj 80681684!
RTMP_TimerListAdd: add timer obj 80608984!
SYNC - BBP R4 to 20MHz.l
RTMP_TimerListAdd: add timer obj c0052554!
The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2
Main bssid = 00:0c:43:70:96:b1
<==== rt28xx_init, Status=0
0x1300 = 00064380
killall: rt2860apd: no process killed
rt2860apd: No such file or directory
eth2.1: Setting MAC address to 00 0c 43 70 96 b2.
device eth2 entered promiscuous mode
VLAN (eth2.1): Setting underlying device (eth2) to promiscious mode.
device ra0 entered promiscuous mode
eth2.1: dev_set_promiscuity(master, 1)
device eth2.1 entered promiscuous mode
br0: port 2(eth2.1) entering learning state
br0: port 1(ra0) entering learning state
br0: topology change detected, propagating
br0: port 2(eth2.1) entering forwarding state
br0: topology change detected, propagating
br0: port 1(ra0) entering forwarding state
Changing password for admin
Password for admin changed by admin
- setting default address to 192.168.8.1
samba.sh NEXX WORKGROUP
smbpasswd -a admin admin
startsmbfilepwent_internal: file /etc/smbpasswd did not exist. File successfully created.
Added user admin.
Sys led Error
info, udhcp server (v0.9.8) started
time.windows.com: Unknown host
The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2
eth2.2: Setting MAC address to 00 0c 43 70 96 b3.
info, udhcp client (v0.9.8) started
IDLE
Hit enter to continue...info, Sending discover... (12)
info, Sending discover... (14)
info, Sending discover... (16)
info, Sending discover... (25)
info, Sending discover... (27)
info, Sending discover... (29)
info, Sending discover... (38)
info, Sending discover... (40)
info, Sending discover... (42)
info, Sending discover... (51)
info, Sending discover... (53)
info, Sending discover... (55)
BusyBox v1.12.1 (2013-10-17 11:35:12 HKT) built-in shell (ash)
Enter 'help' for a list of built-in commands.
#
(Last edited by hackru on 24 Jun 2014, 12:07)