Thanks Heini66!
Before going live I want to be sure... If I bricked my Fonera I would need to build the serail adaptor
From your post is not clear if you successfully tested:
1) Access Redboot using telnet/ethernet. Could you do it?
2) The command mtd -e "RedBoot config" write out.hex "RedBoot config". After modifing the configuration in order to disable the IP/ethernet access, does the mtd command renable the ethernet access again?
done some more changes, to meet my network, timeout to 100 sec and port to 23.
Code:
sudo nmap -v -sS -P0 192.168.0.19
Starting Nmap 4.10 ( http://www.insecure.org/nmap/ ) at 2006-12-27 13:29 CET
Initiating ARP Ping Scan against 192.168.0.19 [1 port] at 13:29
The ARP Ping Scan took 0.07s to scan 1 total hosts.
DNS resolution of 1 IPs took 13.00s.
Initiating SYN Stealth Scan against 192.168.0.19 [1679 ports] at 13:29
Increasing send delay for 192.168.0.19 from 0 to 5 due to 12 out of 39 dropped probes since last increase.
Discovered open port 23/tcp on 192.168.0.19
The SYN Stealth Scan took 12.61s to scan 1679 total ports.
Host 192.168.0.19 appears to be up ... good.
Interesting ports on 192.168.0.19:
Not shown: 1678 closed ports
PORT STATE SERVICE
23/tcp open telnet
MAC Address: 00:18:84:12:EC:CC (Unknown)
Nmap finished: 1 IP address (1 host up) scanned in 26.115 seconds
Raw packets sent: 1742 (76.646KB) | Rcvd: 1680 (77.276KB)
xtc@schlepp-tux:~/trunk/toolchain_build_mipsel/uClibc-0.9.28/include/net$ telnet 192.168.0.19
Trying 192.168.0.19...
Connected to 192.168.0.19.
Escape character is '^]'.
== Executing boot script in 89.490 seconds - enter ^C to abort
Code:
mtd -e "RedBoot config" write out.hex "RedBoot config"
Could not open mtd device: RedBoot config
Can't open device for writing!
when i dig to my kernel/driver/mtd/mtdpart.c , the code is included at line 463 _________________ freenode.net #openwrt
Well, I suppose that there are 3 alternatives to overcome the last obstacle:
1) Hack the memory of the kernel in order to find the address "mtd.flags" variable and make it writeable.
2) Create a new "mtd8" that covers the Redboot config and the FIS. Create a file that match the new partion and flash it! (some documentation can be find here: http://www.linux-mtd.infradead.org/archive/tech/)
3) Recompile the FONERA source that FON has distributed with the patch in the link above. Reflash just the kernel using mtd -e vmlinux.bin.l7 write kernel.lzma vmlinux.bin.l7. Restart. Flash the "Redboot config" that now should be writeable.
Heini66, do you want to try option 3?
I will work on option 1 or 2 (for this will be very useful to have the mtd-utils compiled for the Fonera. ( http://www.linux-mtd.infradead.org/archive/tech/ )
Got a new Fonera today to replace my bricked one, and after doing the 2 html injection hacks, it doesn't seem to grab an IP from my server anymore. It will still assign you an IP over the wireless part, but it no longer connects to the internet and tries to receive an IP address. The network settings are set to DHCP. Any ideas what could have happened, or what to check when I SSH into it?
I've always been too curious...
To make a long story short I download the fonera source and built it. I run "make" save the configuration without altering anything in order to write the "Config.in" and then I run "make world". Correct, right?
Once it was built I compared the result of output (openwrt-ar531x-2.4-vmlinux.lzma) with the mtd4 of my Fonera. Interesting enough the kernel images are a bit different. From ver 7.0 r1 to ver .71.r1 the kernel has not changed for what I know. This can mean that FON didn't really release the last firmware source:-/ Or maybe I didn't build it how I was suppose to Another stange thing is that mtd_20050122.orig.tar.gz in the fonera source is not used to patch the kernel.
Anyway. I patched the kernel. Now all the MTD partions should be writeable. Please note that they were not writeable for a reason. Writing "Redboot config" is probably going to reset the FIS directory because it is on the same "erase sector". This is not a major problem since with Redboot we can easily recreate them and to install Openwrt we must do this anyway.
Ok... this is what is necessary to do starting with a Fonera with firmware FON 7.x already hacked (SSH access):
1 - Download the file http://rapidshare.com/files/9240866/openwrt-ar531x-2.4-vmlinux-CAMICIA.lzma.html on your on PC e move it on your Fonera /tmp folder
2 - Run "mtd -e vmlinux.bin.l7 write openwrt-ar531x-2.4-vmlinux-CAMICIA.lzma vmlinux.bin.l7"
3 - Restart the router. If everything went OK, it should work as usual. If you have the serial console you will see the messages of my hack
4 - Connect with SSH e move the Heini66 file ( http://rapidshare.com/files/9116527/out.hex.html ) on your /tmp
5 - Run: mtd -e "RedBoot config" write out.hex "RedBoot config"
6 - Reboot.
Your Fonera's Redboot should be now accessible at 192.168.1.254 through telnet.
NOTE: The procedure is UNTESTED yet. It's necessary that someone with a serial console tests it.
Heini66: thanks for your patience. Can you try this and let me know if it works?
wget http://192.168.0.5/apache2-default/out.hex
Connecting to 192.168.0.5[192.168.0.5]:80
out.hex 100% |*****************************| 4096 00:00 ETA
root@(none):~# mtd -e "RedBoot config" write out.hex "RedBoot config"
Unlocking RedBoot config ...
Erasing RedBoot config ...
Writing from out.hex to RedBoot config ... [w]
root@(none):~# reboot
The system is going down NOW !!
Sending SIGTERM to all processes.
Please stand by while rebooting the system.
Restarting system.
+PHY ID is 0022:5521
Ethernet eth0: MAC address 00:18:84:13:57:08
IP: 192.168.1.254/255.255.255.0, Gateway: 0.0.0.0
Default server: 0.0.0.0
RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version v1.3.0 - built 16:57:58, Aug 7 2006
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Board: ap51
RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
FLASH: 0xa8000000 - 0xa87f0000, 128 blocks of 0x00010000 bytes each.
== Executing boot script in 10.000 seconds - enter ^C to abort
^C
RedBoot> fconfig
Run script at boot: true
Boot script:
.. fis load -l vmlinux.bin.l7
.. exec
Enter script, terminate with empty line
>>
Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address: 192.168.1.254
Local IP address mask: 255.255.255.0
Default server IP address:
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
I have just flashed my fonera with camicia's openwrt and executed redboot. But now i can't access my fonera anymore. I have no serial console, only ssh. How can i do? thanks
Tried exact the way you descriped but after i "flashed" camicas openwrt my wlan-light dont starts to blink anymore. And i cant access the router through 169.254.255.1 via ssh even ping is impossible.
Tried to reset the router by pressing the button on the bottom but doesnt seem to work.
I used the files from the mirror perhaps they are broken?
If I bricked my Fonera I would need to build the serail adaptor 
