forked from Ivasoft/openwrt
f8b02130d2
Beeline SmartBox Flash is a wireless AC1300 (WiFi 5) router manufactured
by Arcadyan company.
Device specification
--------------------
SoC Type: MediaTek MT7621AT
RAM: 256 MiB, Winbond W632GU6NB
Flash: 128 MiB (NAND), Winbond W29N01HVSINF
Wireless 2.4 GHz (MT7615DN): b/g/n, 2x2
Wireless 5 GHz (MT7615DN): a/n/ac, 2x2
Ethernet: 3xGbE (WAN, LAN1, LAN2)
USB ports: 1xUSB3.0
Button: 1 (Reset/WPS)
LEDs: 1 RGB LED
Power: 12 VDC, 1.5 A
Connector type: Barrel
Bootloader: U-Boot (Ralink UBoot Version: 5.0.0.2)
OEM: Arcadyan WE42022
Installation
------------
1. Place *factory.trx on any web server (192.168.1.2 in this example)
2. Connect to the router using telnet shell (no password required)
3. Save MAC adresses to U-Boot environment:
uboot_env --set --name eth2macaddr --value $(ifconfig | grep eth2 | \
awk '{print $5}')
uboot_env --set --name eth3macaddr --value $(ifconfig | grep eth3 | \
awk '{print $5}')
uboot_env --set --name ra0macaddr --value $(ifconfig | grep ra0 | \
awk '{print $5}')
uboot_env --set --name rax0macaddr --value $(ifconfig | grep rax0 | \
awk '{print $5}')
4. Ensure that MACs were saved correctly:
uboot_env --get --name eth2macaddr
uboot_env --get --name eth3macaddr
uboot_env --get --name ra0macaddr
uboot_env --get --name rax0macaddr
5. Download and write the OpenWrt images:
cd /tmp
wget http://192.168.1.2/factory.trx
mtd_write erase /dev/mtd4
mtd_write write factory.trx /dev/mtd4
6. Set 1st boot partition and reboot:
uboot_env --set --name bootpartition --value 0
reboot
Back to Stock
-------------
1. Run in the OpenWrt shell:
fw_setenv bootpartition 1
reboot
2. Optional step. Upgrade the stock firmware with any version to
overwrite the OpenWrt in Slot 1.
MAC addresses
-------------
+-----------+-------------------+----------------+
| Interface | MAC | Source |
+-----------+-------------------+----------------+
| label | 30:xx:xx:51:xx:09 | No MACs was |
| LAN | 30:xx:xx:51:xx:09 | found on Flash |
| WAN | 30:xx:xx:51:xx:06 | [1] |
| WLAN_2g | 30:xx:xx:51:xx:07 | |
| WLAN_5g | 32:xx:xx:41:xx:07 | |
+-----------+-------------------+----------------+
[1]:
a. Label wasb't found neither in factory nor in other places.
b. MAC addresses are stored in encrypted partition "glbcfg". Encryption
key hasn't known yet. To ensure the correct MACs in OpenWrt, a hack
with saving of the MACs to u-boot-env during the installation was
applied.
c. Default Ralink ethernet MAC address (00:0C:43:28:80:36) was found in
"Factory" 0xfff0. It's the same for all Smartbox Flash devices. OEM
firmware also uses this MAC when initialazes ethernet driver. In
OpenWrt we use it only as internal GMAC (eth0), all other MACs are
unique. Therefore, there is no any barriers to the operation of several
Smartbox Flash devices even within the same broadcast domain.
Stock firmware image format
---------------------------
+--------------+---------------+----------------------------------------+
| Offset | 1.0.15 | Description |
+==============+===============+========================================+
| 0x0 | 5d 43 6f 74 | TRX magic "]Cot" |
+--------------+---------------+----------------------------------------+
| 0x4 | 00 70 ff 00 | Length (reverse) |
+--------------+---------------+----------------------------------------+
| | | htonl(~crc) from 0xc ("flag_version") |
| 0x8 | 72 b3 93 16 | to "Length" |
+--------------+---------------+----------------------------------------+
| 0xc | 00 00 01 00 | Flags |
+--------------+---------------+----------------------------------------+
| | | Offset (reverse) of Kernel partition |
| 0x10 | 1c 00 00 00 | from the start of the header |
+--------------+---------------+----------------------------------------+
| | | Offset (reverse) of RootFS partition |
| 0x14 | 00 00 42 00 | from the start of the header |
+--------------+---------------+----------------------------------------+
| 0x18 | 00 00 00 00 | Zeroes |
+--------------+---------------+----------------------------------------+
| 0x1c | 27 05 19 56 … | Kernel data + zero padding |
+--------------+---------------+----------------------------------------+
| | | RootFS data (starting with "hsqs") + |
| 0x420000 | 68 73 71 73 … | zero padding to "Length" |
+--------------+---------------+----------------------------------------+
| | | Some signature data (format is |
| | | unknown). Necessary for the fw |
| "Lenght" | 00 00 00 00 … | update via oem fw web interface. |
+--------------+---------------+----------------------------------------+
| "Lenght" + | | TRX magic "HDR0". U-Boot is |
| 0x10c | 48 44 52 30 | checking it at every boot. |
+--------------+---------------+----------------------------------------+
| | | 1.00: |
| | | Zero padding to ("Lenght" + 0x23000) |
| | | 1.0.12: |
| | | Zero padding to ("Lenght" + 0x2a000) |
| "Lenght" + | | 1.0.13, 1.0.15, 1.0.16: |
| 0x110 | 00 00 00 00 | Zero padding to ("Lenght" + 0x10000) |
+--------------+---------------+----------------------------------------+
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
132 lines
3.0 KiB
Bash
Executable File
132 lines
3.0 KiB
Bash
Executable File
#
|
|
# Copyright (C) 2010 OpenWrt.org
|
|
#
|
|
|
|
PART_NAME=firmware
|
|
REQUIRE_IMAGE_METADATA=1
|
|
|
|
RAMFS_COPY_BIN='fw_printenv fw_setenv'
|
|
RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
|
|
|
|
platform_check_image() {
|
|
return 0
|
|
}
|
|
|
|
platform_do_upgrade() {
|
|
local board=$(board_name)
|
|
|
|
case "$board" in
|
|
alfa-network,quad-e4g)
|
|
[ "$(fw_printenv -n dual_image 2>/dev/null)" = "1" ] &&\
|
|
[ -n "$(find_mtd_part backup)" ] && {
|
|
PART_NAME=backup
|
|
if [ "$(fw_printenv -n bootactive 2>/dev/null)" = "1" ]; then
|
|
fw_setenv bootactive 2 || exit 1
|
|
else
|
|
fw_setenv bootactive 1 || exit 1
|
|
fi
|
|
}
|
|
;;
|
|
ampedwireless,ally-00x19k|\
|
|
ampedwireless,ally-r1900k)
|
|
if [ "$(fw_printenv --lock / -n bootImage 2>/dev/null)" != "0" ]; then
|
|
fw_setenv --lock / bootImage 0 || exit 1
|
|
fi
|
|
;;
|
|
mikrotik,routerboard-750gr3|\
|
|
mikrotik,routerboard-760igs|\
|
|
mikrotik,routerboard-m11g|\
|
|
mikrotik,routerboard-m33g)
|
|
[ "$(rootfs_type)" = "tmpfs" ] && mtd erase firmware
|
|
;;
|
|
asus,rt-ac65p|\
|
|
asus,rt-ac85p)
|
|
echo "Backing up firmware"
|
|
dd if=/dev/mtd4 bs=1024 count=4096 > /tmp/backup_firmware.bin
|
|
dd if=/dev/mtd5 bs=1024 count=52224 >> /tmp/backup_firmware.bin
|
|
mtd -e firmware2 write /tmp/backup_firmware.bin firmware2
|
|
;;
|
|
esac
|
|
|
|
case "$board" in
|
|
ampedwireless,ally-00x19k|\
|
|
ampedwireless,ally-r1900k|\
|
|
asus,rt-ac65p|\
|
|
asus,rt-ac85p|\
|
|
beeline,smartbox-flash|\
|
|
dlink,dir-1960-a1|\
|
|
dlink,dir-2640-a1|\
|
|
dlink,dir-2660-a1|\
|
|
dlink,dir-853-a3|\
|
|
hiwifi,hc5962|\
|
|
iptime,a3004t|\
|
|
iptime,ax2004m|\
|
|
iptime,t5004|\
|
|
jcg,q20|\
|
|
linksys,e5600|\
|
|
linksys,ea6350-v4|\
|
|
linksys,ea7300-v1|\
|
|
linksys,ea7300-v2|\
|
|
linksys,ea7500-v2|\
|
|
linksys,ea8100-v1|\
|
|
linksys,ea8100-v2|\
|
|
netgear,r6220|\
|
|
netgear,r6260|\
|
|
netgear,r6350|\
|
|
netgear,r6700-v2|\
|
|
netgear,r6800|\
|
|
netgear,r6850|\
|
|
netgear,r6900-v2|\
|
|
netgear,r7200|\
|
|
netgear,r7450|\
|
|
netgear,wac104|\
|
|
netgear,wac124|\
|
|
netis,wf2881|\
|
|
raisecom,msg1500-x-00|\
|
|
sercomm,na502|\
|
|
xiaomi,mi-router-3g|\
|
|
xiaomi,mi-router-3-pro|\
|
|
xiaomi,mi-router-4|\
|
|
xiaomi,mi-router-ac2100|\
|
|
xiaomi,mi-router-cr6606|\
|
|
xiaomi,mi-router-cr6608|\
|
|
xiaomi,mi-router-cr6609|\
|
|
xiaomi,redmi-router-ac2100)
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
iodata,wn-ax1167gr2|\
|
|
iodata,wn-ax2033gr|\
|
|
iodata,wn-dx1167r|\
|
|
iodata,wn-dx2033gr)
|
|
iodata_mstc_upgrade_prepare "0xfe75"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
iodata,wn-dx1200gr)
|
|
iodata_mstc_upgrade_prepare "0x1fe75"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
ubnt,edgerouter-x|\
|
|
ubnt,edgerouter-x-sfp)
|
|
platform_upgrade_ubnt_erx "$1"
|
|
;;
|
|
zyxel,nr7101)
|
|
fw_setenv CheckBypass 0
|
|
fw_setenv Image1Stable 0
|
|
CI_KERNPART="Kernel"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
zyxel,wap6805)
|
|
local kernel2_mtd="$(find_mtd_part Kernel2)"
|
|
[ "$(hexdump -n 4 -e '"%x"' $kernel2_mtd)" = "56190527" ] &&\
|
|
[ "$(hexdump -n 4 -s 104 -e '"%x"' $kernel2_mtd)" != "0" ] &&\
|
|
dd bs=4 count=1 seek=26 conv=notrunc if=/dev/zero of=$kernel2_mtd 2>/dev/null &&\
|
|
echo "Kernel2 sequence number was reset to 0"
|
|
CI_KERNPART="Kernel"
|
|
nand_do_upgrade "$1"
|
|
;;
|
|
*)
|
|
default_do_upgrade "$1"
|
|
;;
|
|
esac
|
|
}
|