[andrewpendleton]

I have two of these and wouldn't mind DD-WRTing them, but they're not listed as supported.

Vendor info page is here:
http://www.trendnet.com/asp/download_manager/list_subcategory.asp?SUBTYPE_ID=1335

FCC ID is S9ZTEW638APB (https://gullfoss2.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=621660&fcc_id=%27S9ZTEW638APB%27 includes links to internal photos)

Chipset is Ralink RT3052F

I'm pretty sure the Flash and RAM are 4M and 32M, respectively, but I can't find parts exactly matching either the RAM or Flash chips in the picture.

What are my next steps?

Andrew

[Borage]

Can you telnet to this router?

[andrewpendleton]

I don't think so. Port 23 isn't open, and I don't see any way to enable it from the web GUI.

[andrewpendleton]

*bump* anyone? I'm willing to do the legwork to figure out how to make it work; I'm just not sure about what the next steps are.

[700zx]

I'd love to see the dd-wrt on this device as well. I've got one and i really would appreciate it if someone would give it a try - I would do it but I know next to nothing about routers and modifying their firmware. Thanks.

[d3hilton]

Serial pins are the same for the TEW-639gr so here is a boot log

U-Boot 1.1.3 (Sep 24 2008 - 11:41:48)

Board: RT2880 DRAM: 16 MB

twe0 set to <NULL>

toe0 set to <NULL>

vender : MX_MANUFACT

flash id=000022a7

MX_ID_LV320CT, Size = 00400000 bytes
flash_protect ON: from 0xBC400000 to 0xBC42A607
protect on 0
protect on 1
protect on 2
flash_protect ON: from 0xBC430000 to 0xBC43FFFF
protect on 3
Flash: 4 MB
*** Warning - bad CRC, using default environment

============================================
ASIC -VerB/C (MAC to 100PHY Mode)
DRAM COMPONENT=128Mbits
DRAM BUS=16BIT
Total memory = 16Mbytes
Date:Sep 24 2008 Time:11:41:48
============================================
D-CACHE set to 4 way
I-CACHE set to 4 way

##### The CPU freq = 266 MHZ ####

SDRAM bus set to 16 bit
SDRAM size =16 Mbytes

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
5: Load ucos code to SDRAM via TFTP. 0
Net:
eth_register
Eth0 (10/100-M)
enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:18
00:AA:BB:CC:DD:18:

eth_current->name = Eth0 (10/100-M)


0: Execute Bootp and Auto load Linux Kernel to FLASH via TFTP.
Please Input new ones /or Ctrl-C to discard
Input device IP (10.10.10.123)
Input server IP (10.10.10.3)
Input Linux Kernel filename (<NULL>)

netboot_common, argc= 3
*************buf = 0x8afce7a4
**********NexTxPacket = 8afe6980

NetTxPacket = 0x8AFE6980

NetRxPackets[0] = 0x8AFE6F80

NetRxPackets[1] = 0x8AFE7580

NetRxPackets[2] = 0x8AFE7B80

NetRxPackets[3] = 0x8AFE8180

NetRxPackets[4] = 0x8AFE8780

NetRxPackets[5] = 0x8AFE8D80

NetRxPackets[6] = 0x8AFE9380

NetRxPackets[7] = 0x8AFE9980

NetRxPackets[8] = 0x8AFE9F80

NetRxPackets[9] = 0x8AFEA580

NetRxPackets[10] = 0x8AFEAB80

NetRxPackets[11] = 0x8AFEB180

NetRxPackets[12] = 0x8AFEB780

NetRxPackets[13] = 0x8AFEBD80

NetRxPackets[14] = 0x8AFEC380

NetRxPackets[15] = 0x8AFEC980

NetRxPackets[16] = 0x8AFECF80

NetRxPackets[17] = 0x8AFED580

NetRxPackets[18] = 0x8AFEDB80

NetRxPackets[19] = 0x8AFEE180

KSEG1ADDR(NetTxPacket) = 0xAAFE6980

NetLoop,call eth_halt !
STOP_RT2880_ETH

NetLoop,call eth_init !
Trying Eth0 (10/100-M)

Waitting RT2880_RX_DMA_BUSY status Start... done

Mac to 100Phy mode

Enable GMAC Phy !!

Waitting to GMAC1 link up Start!! GMAC1 link up !!.

rx_ring = AAFCEBC0, tx_ring0 = AAFCEA80

Header Payload scatter function is Disable !!

RT2880_PDMA_GLO_CFG=00000020

*************************************************

RT2880_RX_CALC_IDX0=19

RT2880_RX_DRX_IDX0 = 0

*************************************************

ETH_STATE_ACTIVE!!
BOOTP broadcast 1
BOOTP broadcast 2

Retry count exceeded; starting again
Bootp operation fail, system Boot system code via Flash.
## Booting image at bc450000 ...
Image Name: Linux Kernel Image
Created: 2009-03-27 9:47:01 UTC
System Control Status = 0x02110084
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2326633 Bytes = 2.2 MB
Load Address: 8a000000
Entry Point: 881c6040
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 881c6040) ...
## Giving linux memsize in MB, 16

Starting kernel ...


THIS IS ASIC
ramsize = 16 MBytes
rambase not set, set to default (0x08000000)
MEMORY DESCRIPTOR dump:
[0,883d6100]: base<08000000> size<01000000> type<Free RAM memory>

The CPU feqenuce set to 266 MHz
CPU revision is: 0001906c
icache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0
dcache: sets:256, ways:4, linesz:16 ,total:16384, waybit:12, flags:0x0
i waysize = 4096, d waysize = 4096, i sets= 256, d sets=256
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 4-way, linesize 16 bytes.
[setup_scache]:1032
Linux version 2.4.30 (tom.hung@RH001.u-media.com) (gcc version 3.3.6) #1395 Fri Mar 27 17:46:56 CST 2009
Determined physical RAM map:
memory: 01000000 @ 08000000 (usable)
Initial ramdisk at: 0x881f2000 (1679360 bytes)
On node 0 totalpages: 36864
zone(0): 36864 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS1,57600n8 root=/dev/ram0
cause = c0c08314, status = 1000de00
calculating r4koff... 00144b50(1330000)
CPU frequency 133.00 MHz
Using 133.000 MHz high precision timer.
Calibrating delay loop... 265.42 BogoMIPS
Memory: 10852k/16384k available (1802k kernel code, 5532k reserved, 1732k data, 76k init, 0k highmem)
Dentry cache hash table entries: 32768 (order: 6, 262144 bytes)
Inode cache hash table entries: 16384 (order: 5, 131072 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 8192 (order: 3, 32768 bytes)
Page-cache hash table entries: 65536 (order: 6, 262144 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
pty: 256 Unix98 ptys configured
Ralink gpio driver initialized
spidrv_major = 217
Serial driver version 5.05c (2001-07-0 with no serial options enabled
ttyS00 at 0x300500 (irq = 9) is a 16550A
ttyS01 at 0x300c00 (irq = is a 16550A
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
RA2880 Ethernet Driver Initilization. v1.01 256 rx/tx descriptors allocated!
NAPI enable, weight = 0, Tx Ring = 256, Rx Ring = 256Netlink init ok!
PROC INIT OK!
set PHY ADDR 0Dh for RTL8201CP Single PHY and auto_polling_en to 1
software reset PHY, PHY REG 0 = 0x8000
rdm_major = 254
FLASH_API: MAN_ID=C2 DEV_ID=22A7 SIZE=4MB
physmap flash device: 4000000 at bf000000
Amd/Fujitsu Extended Query Table v1.1 at 0x0040
RT2880 SOC Physically mapped flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
Region0: SectorSize=0x10000 SectorNum=63
Region1: SectorSize=0x2000 SectorNum=8
cfi_cmdset_0002: Using word write method.
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Using physmap partition definition
Creating 4 MTD partitions on "RT2880 SOC Physically mapped flash":
0x00000000-0x00030000 : "Bootloader"
mtd: Giving out device 0 to Bootloader
0x00030000-0x00040000 : "Config "
mtd: Giving out device 1 to Config
0x00040000-0x00050000 : "Factory"
mtd: Giving out device 2 to Factory
0x00050000-0x00400000 : "Kernel"
mtd: Giving out device 3 to Kernel
IPv6 v0.8 for NET4.0
IPv6 over IPv4 tunneling driver
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 1024 buckets, 8Kbytes
TCP: Hash tables configured (established 16384 bind 32768)
Linux IP multicast router 0.06 plus PIM-SM
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 1640k freed
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing prom memory: 0kb freed
Freeing unused kernel memory: 76k freed
console started
trying to start /sbin/init
Algorithmics/MIPS FPU Emulator v1.5
init started: BusyBox v1.8.2 (2009-03-27 17:23:34 CST)
starting pid 10, tty '': '/etc_ro/rcS'
mount: mounting none on /proc/bus/usb failed: No such file or directory
Welcome to
_______ _______ ___ __ ____ _ _ ___
| ___ \| __ || | |__|| \ | || | / /
| |___| || |__| || |__ __ | \| || |/ /
| _ /| _ || || || |\ || \
|__| \__\|__| |__||______||__||_| \____||_|\___\

=System Architecture Department=

cp: cannot stat '/usr/local/etc/services': No such file or directory
cp: cannot stat '/etc_ro/rfw/help.txt': No such file or directory
config file size in "getfile()" = 1456
Link Status MDIO_CFG = 2d015f01, Link Down!
/etc_ro/rcS: line 23: crond: not found
Create a message queue in goahead for interprocess communication!!
internet.sh
0
insmod: bridge.o: module not found
insmod: mii.o: module not found
insmod: raeth.o: module not found
interface apcli0 does not exist!
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
rmmod: rt2860v2_ap
rmmod: rt2860v2_sta
2860 version : 1.6.0.0 (Mar 27 2009)


=== pAd = c40ff000, size = 639760 ===

<-- RTMPAllocAdapterBlock, Status=0
rmmod: ip_nat_proto_gre
rmmod: ip_nat_pptp
rmmod: ip_conntrack_pptp
rmmod: ip_conntrack_proto_gre
MDIO_CFG = 2d015f01
GDMA1_FWD_CFG = 10000
DSP_EN OFF version driver

phy_tx_ring = 08a79000, tx_ring = a8a79000, size: 16 bytes

phy_rx_ring = 08a78000, rx_ring = a8a78000, size: 16 bytes
RX DESC a8ae5000 size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
1. Phy Mode = 9
2. Phy Mode = 9
Read EEPROM, EthCloneMac is 00:14:d1:c5:7c:e4!
3. Phy Mode = 9
MCS Set = ff ff 00 00 01
The UUID Hex string is:2880288028801880a8800014d1c57ce4
The UUID ASCII string is:28802880-2880-1880-a880-0014d1c57ce4!
<==== RTMPInitialize, Status=0
0x1300 = 00064300
insmod: 8021q.o: module not found
starting pid 101, tty '/dev/console': '/bin/sh'


BusyBox v1.8.2 (2009-03-27 17:23:34 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# ifconfig: ioctl 0x8913 failed: No such device
bridge br0 doesn't exist; can't delete it
/sbin/internet.sh: line 244: iptables: not found
/sbin/internet.sh: line 245: iptables: not found
/sbin/internet.sh: line 246: iptables: not found
device ra0 entered promiscuous mode
##### restore IC+ to dump switch #####
Set: phy[20].reg[4] = ffff
Set: phy[20].reg[13] = ffff
Set: phy[21].reg[1] = ffff
Set: phy[22].reg[0] = ffff
Set: phy[22].reg[2] = ffff
Set: phy[22].reg[10] = ffff
Set: phy[22].reg[14] = ffff
Set: phy[22].reg[15] = ffff
Set: phy[23].reg[8] = ffff
Set: phy[23].reg[16] = ffff
Set: phy[22].reg[4] = ffff
Set: phy[22].reg[5] = ffff
Set: phy[22].reg[6] = ffff
Set: phy[22].reg[7] = ffff
Set: phy[22].reg[8] = ffff
Set: phy[23].reg[0] = ffff
device eth2 entered promiscuous mode
eth2: attempt to add interface with same source address.
BusyBox v1.8.2 (2009-03-27 17:23:34 CST) multi-call binary

Usage: ifconfig [-a] interface [address]

br0: port 2(eth2) entering learning state
br0: port 1(ra0) entering learning state
route: ioctl 0x890c failed: No such process
/sbin/lan.sh: line 144: iptables: not found
/sbin/lan.sh: line 144: iptables: not found
/sbin/lan.sh: line 144: iptables: not found
/sbin/lan.sh: line 144: iptables: not found
route: ioctl 0x890c failed: No such process
Adding muticast routing
br0: port 2(eth2) entering forwarding state
br0: topology change detected, propagating
br0: port 1(ra0) entering forwarding state
br0: topology change detected, propagating
Start UPnP: upnpd
check: eth2.2 br0
killall rt2860apd 1>/dev/null 2>&1
iptables -F -t filter 1>/dev/null 2>&1
iptables -D FORWARD -j ipport_block 1>/dev/null 2>&1
iptables -F ipport_block 1>/dev/null 2>&1
iptables -D FORWARD -j mac_block 1>/dev/null 2>&1
iptables -F mac_block 1>/dev/null 2>&1
iptables -P INPUT ACCEPT
sh: iptables: not found
iptables -P OUTPUT ACCEPT
sh: iptables: not found
iptables -P FORWARD ACCEPT
sh: iptables: not found
iptables -t filter -N ipport_block 1>/dev/null 2>&1
iptables -t filter -N mac_block 1>/dev/null 2>&1
iptables -t filter -A FORWARD -j mac_block 1>/dev/null 2>&1
iptables -t filter -A FORWARD -j ipport_block 1>/dev/null 2>&1
iptables -t nat -D PREROUTING -j port_forward 1>/dev/null 2>&1
iptables -t nat -F port_forward 1>/dev/null 2>&1; iptables -t nat -X port_forward 1>/dev/null 2>&1
iptables -t nat -D PREROUTING -j DMZ 1>/dev/null 2>&1
iptables -t nat -F DMZ 1>/dev/null 2>&1; iptables -t nat -X DMZ 1>/dev/null 2>&1
iptables -t nat -N port_forward 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 1 -j port_forward 1>/dev/null 2>&1
iptables -t nat -N DMZ 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 2 -j DMZ 1>/dev/null 2>&1
ntp.sh
ddns.sh
route delete 239.255.255.250 1>/dev/null 2>&1
killall wscd 1>/dev/null 2>&1
killall -9 wscd 1>/dev/null 2>&1
iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1
route add -host 239.255.255.250 dev br0 1>/dev/null 2>&1
wscd -m 1 -a 192.168.1.100 -i ra0 &
iwpriv ra0 set WscConfMode=7
Interface doesn't accept private ioctl...
set (8BE2): Invalid argument
setup-wizard.sh
getBoardID
webs: Listening for HTTP requests at address 192.168.1.100
Try to auto connect profile AP in the STA mode.

Get EEP[0x39]:0x1600

Get EEP[0x38]:0x0000
jacky - check country_region_bg:0(0), country_region_a:0(0)
Commit crc = ba1caa52